Re: Xexcg50 plugin 11889

On Mon, May 22, 2006 at 10:03:55AM -0700, Larry Petty Jr. wrote:

> Retina finds the Xexcg50 vulnerability on a host I'm working on but Nessus
> does not. Below is the results from testing the NASL manually.  The Nessus
> plugin contains the string "^354 Send Binary Data".  The actual grab is
> "354 Send Binary Data".  The "carrot" is the difference.  

Actually, the Nessus plugin contains "^354 Send binary" (note the
difference in case). Since it's in an egrep(), this is actually a
regular express, and "^" anchors it to the start of the line.

> Is this a fat
> finger in the Nessus plugin?  I need to find out what tool is correct...
> Retina or Nessus. Thanks.

Would you edit the plugin (exchange_xexch50_overflow.nasl) and add the
following line:

  debug = 1;

after the one that reads "greeting = smtp_recv_banner(socket:soc);"? Run
the plugin from a commandline (eg, "nasl -t target
exchange_xexch50_overflow.nasl") and check the output.

There are two issues that might be occuring:

1) the plugin does a (case-insensitive) check for "microsoft" in the
banner, which might be affected if there's a proxy between your nessusd
host and the target. [I'm not clear where you ran your test from.]

2) The plugin uses a "EHLO" rather than "HELO" and makes sure "XEXCH50"
is reported as a supported command.


George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus