Mailing List Archive: Nessus: devel

plugins_bugtraq_id, plugins_cve_id and plugins_xrefs oddities

Index | Next | Previous | View Threaded

jfl at phalanx

Apr 2, 2004, 7:03 PM

Post #1 of 3 (632 views)
Permalink

plugins_bugtraq_id, plugins_cve_id and plugins_xrefs oddities

The following preference settings are supposed to add information to
the
PLUGIN_LIST message in NTP/1.2:

plugins_bugtraq_id
plugins_cve_id
plugins_xrefs

I was having some trouble making this work, and I did some poking
around
in the code and discovered the following:

1. The PLUGIN_LIST is dumped immediately when the client logs on, before
the client sends it's preference list.

2. There is no way to enable the extra info in the nessusd.conf file, it
has to be done using the PREFERENCES message sent from the client.

3. There is no way to make the server resend the PLUGIN_LIST (at least
to my knowledge).

The result of this is that it is actually not possible to enable the
extra info, ever. Or am I missing something here?

There are several ways to fix this:

1. Add the plugins_* variables to the variables read from the
nessusd.conf file. This is a quick and easy fix.

2. Make it possible for the client to retrigger the PLUGIN_LIST message
from the server. This would create nearly twice the network traffic,
and does seem like a suboptimal solution.

If this is something that should be addressed, let me know which
approach is preferable and I'll fix it.

On a closely related subject: Are the any plans for deprecating the
script_bugtraq_id() and script_cve_id() functions now that there's a
more generic script_xref() function?

--
Jan Fredrik Leversund <jfl [at] phalanx>
Phalanx Security Services <URL:http://www.phalanx.no/>

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

theall at tifaware

Apr 12, 2004, 1:39 PM

Post #2 of 3 (606 views)
Permalink

Re: plugins_bugtraq_id, plugins_cve_id and plugins_xrefs oddities [In reply to]

On Sat, Apr 03, 2004 at 04:03:06AM +0200, Jan Fredrik Leversund wrote:

I hope this isn't too late to be of use...

> The following preference settings are supposed to add information to
> the
> PLUGIN_LIST message in NTP/1.2:
>
> plugins_bugtraq_id
> plugins_cve_id
> plugins_xrefs
>
> I was having some trouble making this work,

These are some possible extensions specified when negotiating the NTP
protocol. That is, immediately on connecting you would put something like:

< NTP/1.2 >< plugins_cve_id plugins_bugtraq_id plugins_xrefs >

Indeed, look in nessus-core/nessus/nessus.h for PROTO_NAME -- that gives
the extensions used by the nessus client when it connects.

> 1. The PLUGIN_LIST is dumped immediately when the client logs on, before
> the client sends it's preference list.

You can, by the way, skip this using the extension "fast_login".

> 2. There is no way to enable the extra info in the nessusd.conf file, it
> has to be done using the PREFERENCES message sent from the client.

I don't understand -- what extra info?

> 3. There is no way to make the server resend the PLUGIN_LIST (at least
> to my knowledge).

Provided you specify the md5_caching extension when connecting, you can
use the COMPLETE_LIST message to list plugins; eg,

< NTP/1.2 >< md5_caching plugins_cve_id plugins_bugtraq_id plugins_xrefs >
...
CLIENT <|> COMPLETE_LIST <|> CLIENT

George
--
theall [at] tifaware

jfl at phalanx

Apr 15, 2004, 12:18 AM

Post #3 of 3 (598 views)
Permalink

Re: plugins_bugtraq_id, plugins_cve_id and plugins_xrefs oddities [In reply to]

On Mon, 12 Apr 2004 16:39:15 -0400, George Theall <theall [at] tifaware>
wrote:

> These are some possible extensions specified when negotiating the NTP
> protocol. That is, immediately on connecting you would put something
> like:
>
> < NTP/1.2 >< plugins_cve_id plugins_bugtraq_id plugins_xrefs >

> < NTP/1.2 >< md5_caching plugins_cve_id plugins_bugtraq_id plugins_xrefs
> >
> ...
> CLIENT <|> COMPLETE_LIST <|> CLIENT

Excellent, this solves all my problems. I was looking for the solutions in
all the wrong places.

--
Jan Fredrik Leversund <jfl [at] phalanx>
Phalanx Security Services <URL:http://www.phalanx.no/>

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads