sendmail_debug_leak.nasl

来自「漏洞扫描源码,可以扫描linux,windows,交换机路由器」· NASL 代码 · 共 47 行

# This script was written by Michel Arboi <[e-mail]>
#
# GPL
#
# References:
# From: "Michal Zalewski" <[e-mail]>
# To: [e-mail]
# CC: [e-mail]
# Subject: RAZOR advisory: multiple Sendmail vulnerabilities

if(description)
{
 script_id(11088);
 script_bugtraq_id(3898);
 script_cve_id("CVE-2001-0715");
 script_version ("$Revision: 38 $");
 
 name["english"] = "Sendmail debug mode leak";
 name["francais"] = "Fuite d'information dans le mode debug de sendmail";
 script_name(english:name["english"],
 	     francais:name["francais"]);
 
 desc["english"] = "
According to the version number of the remote mail server, 
a local user may be able to obtain the complete mail configuration
and other interesting information about the mail queue even if
he is not allowed to access those information directly, by running
	sendmail -q -d0-nnnn.xxx
where nnnn & xxx are debugging levels.

If users are not allowed to process the queue (which is the default)
then you are not vulnerable.

Solution : upgrade to the latest version of Sendmail or 

do not allow users to process the queue (RestrictQRun option)
Risk factor : Low
Note : This vulnerability is _local_ only"; 


 desc["francais"] = "
D'apr鑣 le num閞o de version du serveur sendmail distant, 
un utilisateur local peut obtenir des informations sur la configuration
du courrier et sur l'閠at de la file d'attente m阭e s'il n'y a pas
acc鑣 directement, en lan鏰nt :
	send -q d0-nnnn.xxx
o