Lucene search

K
nessusThis script is Copyright (C) 2003-2022 and is owned by Tenable, Inc. or an Affiliate thereof.ACCOUNT_EZSETUP.NASL
HistoryFeb 20, 2003 - 12:00 a.m.

Unpassworded 'EZsetup' Account

2003-02-2000:00:00
This script is Copyright (C) 2003-2022 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
56

The account ‘EZsetup’ has no password set. An attacker may use it to gain further privileges on this system.

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

account = "EZsetup";

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(11241);
  script_version("1.36");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_cve_id("CVE-1999-0502");

  script_name(english:"Unpassworded 'EZsetup' Account");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an account with no password set.");
  script_set_attribute(attribute:"description", value:
"The account 'EZsetup' has no password set. 
An attacker may use it to gain further privileges on this system.");
  script_set_attribute(attribute:"solution", value:
"Set a password for this account or disable it.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:TF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:T/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'SSH User Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2001/01/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2003/02/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"default_account", value:"true");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Default Unix Accounts");

  script_copyright(english:"This script is Copyright (C) 2003-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service1.nasl", "os_fingerprint.nasl", "ssh_detect.nasl", "account_check.nasl");
  script_exclude_keys("global_settings/supplied_logins_only");
  script_require_ports("Services/telnet", 23, "Services/ssh", 22);

  exit(0);
}

#
# The script code starts here : 
#
include("audit.inc");
include("default_account.inc");
include("global_settings.inc");

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

if ( ! thorough_tests && ! get_kb_item("Settings/test_all_accounts"))
{
 os = get_kb_item("Host/OS");
 if ( os && "IRIX" >!< os )
 exit(0, "Neither thorough_tests nor 'Settings/test_all_accounts' is set, and the remote OS is not IRIX.");
}

affected = FALSE;
ssh_ports = get_service_port_list(svc: "ssh", default:22);
foreach port (ssh_ports)
{
  port = check_account(login:account, port:port, svc:"ssh");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(affected) exit(0);

telnet_ports = get_service_port_list(svc: "telnet", default:23);
foreach port (telnet_ports)
{
  port = check_account(login:account, port:port, svc:"telnet");
  if (port)
  {
    affected = TRUE;
    security_report_v4(port:port, severity:SECURITY_HOLE, extra:default_account_report());
  }
}
if(!affected) audit(AUDIT_HOST_NOT, "affected");

Related for ACCOUNT_EZSETUP.NASL