@@ -16,21 +16,24 @@ def initialize(info = {})
16
16
'Name' => 'Oracle TNS Listener Checker' ,
17
17
'Description' => %q{
18
18
This module checks the server for vulnerabilities like TNS Poison.
19
- Module sends to server a packet with command to register new TNS Listener and check response.
19
+ Module sends a server a packet with command to register new TNS Listener and checks
20
+ for a response indicating an error. If the registration is errored, the target is not
21
+ vulnearble. Otherwise, the target is vulnerable to malicious registrations.
20
22
} ,
21
23
'Author' => [ 'ir0njaw (Nikita Kelesis) <nikita.elkey[at]gmail.com>' ] , # of Digital Security [http://dsec.ru]
22
24
'References' =>
23
25
[
24
26
[ 'URL' , 'http://seclists.org/fulldisclosure/2012/Apr/204' ] ,
25
27
] ,
28
+ 'DisclosureDate' => 'Apr 18 2012' ,
26
29
'License' => MSF_LICENSE ) )
27
30
28
31
register_options (
29
32
[
30
33
Opt ::RPORT ( 1521 )
31
34
] , self . class )
32
35
33
- deregister_options ( 'RHOST' )
36
+ deregister_options ( 'RHOST' ) # Provided by the TNS mixin, but not needed in a scanner module
34
37
end
35
38
36
39
def run_host ( ip )
@@ -41,6 +44,7 @@ def run_host(ip)
41
44
packet = sock . read ( 100 )
42
45
find_packet = packet . include? "(ERROR_STACK=(ERROR="
43
46
find_packet == true ? print_error ( "#{ ip } :#{ rport } is not vulnerable " ) : print_good ( "#{ ip } :#{ rport } is vulnerable" )
47
+ #TODO: Module should report_vuln if this finding is solid.
44
48
rescue ::Rex ::ConnectionError , ::Errno ::EPIPE
45
49
print_error ( "#{ ip } :#{ rport } unable to connect to the server" )
46
50
end
0 commit comments