diff --git a/scripts/afp-path-vuln.nse b/scripts/afp-path-vuln.nse index 2b72cc15c..3b52f84cf 100644 --- a/scripts/afp-path-vuln.nse +++ b/scripts/afp-path-vuln.nse @@ -1,4 +1,26 @@ -description = [[ Detects the Mac OS X AFP directory traversal vulnerability CVE-2010-0533 ]] +description = [[ +Detects the Mac OS X AFP directory traversal vulnerability CVE-2010-0533. + +This script attempt to iterate over all AFP shares on the remote +host. For each share it attempts to access the parent directory by +exploiting the directory traversal vulnerability as described in +CVE-2010-0533. + +The script reports whether the system is vulnerable or not. In +addition it lists the contents of the parent and child directories to +a max depth of 2. + +When running in verbose mode, all items in the listed directories are +shown. In non verbose mode, output is limited to the first 5 items. + +If the server is not vulnerable, the script will not return any +information. + +For additional information: +* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0533 +* http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap +* http://support.apple.com/kb/HT1222 +]] --- -- @args afp.username The username to use for authentication. (If unset it first attempts to use credentials found by afp-brute then no credentials) @@ -17,25 +39,6 @@ description = [[ Detects the Mac OS X AFP directory traversal vulnerability CVE- -- | -- |_AFP path traversal (CVE-2010-0533): VULNERABLE -- --- Description --- ----------- --- This script attempt to iterate over all AFP shares on the remote host. --- For each share it attempts to access the parent directory by exploiting --- the directory traversal vulnerability as described in CVE-2010-0533. --- --- The script reports whether the system is vulnerable or not. In addition it --- lists the contents of the parent and child directories to a max depth of 2. --- --- When running in verbose mode, all items in the listed directories are shown. --- In non verbose mode, output is limited to the first 5 items. --- --- If the server is not vulnerable, the script will not return any information. --- --- --- For additional information: --- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0533 --- http://www.cqure.net/wp/2010/03/detecting-apple-mac-os-x-afp-vulnerability-cve-2010-0533-with-nmap --- http://support.apple.com/kb/HT1222 -- -- Version 0.3