#  This script was written by David Maciejak <david dot maciejak at kyxar dot fr>
#  based on work from
# (C) Tenable Network Security
#
# Ref: Sebastian Krahmer
#
# This script is released under the GNU GPL v2


if(description)
{
 script_id(14313);
 script_bugtraq_id(10955);
 script_cve_id("CAN-2004-0778");
 script_version ("$Revision: 1.3 $");
 
 
 name["english"] = "CVS file existence information disclosure weakness";
 script_name(english:name["english"]);
 
 desc["english"] = "
The remote CVS server, according to its version number,
can be exploited by malicious users to gain knowledge of 
certain system information.

This behaviour can be exploited to determine the existence 
and permissions of arbitrary files and directories on a 
vulnerable system.


Solution : Upgrade to CVS 1.11.17 and 1.12.9, or newer

Risk factor : Low";


 script_description(english:desc["english"]);
 
 summary["english"] = "Logs into the remote CVS server and asks the version";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2004 David Maciejak");
 family["english"] = "General";
 script_family(english:family["english"]);
 script_require_ports("Services/cvspserver", port);
 script_dependencies("find_service.nes", "cvs_public_pserver.nasl");
 exit(0);
}

port = get_kb_item("Services/cvspserver");
if(!port)
	port = 2401;
if(!get_port_state(port))
	exit(0);

login = get_kb_item(string("cvs/", port, "/login"));
pass  = get_kb_item(string("cvs/", port, "/pass"));
dir   = get_kb_item(string("cvs/", port, "/dir"));

if(!login || !dir) {
	soc = open_sock_tcp(port);
	if(!soc)
		exit(0);

	req = string("BEGIN AUTH REQUEST\n",
	"\n",
	"\n",
	"A\n",
	"END AUTH REQUEST\n");
	send(socket:soc, data:req);
	r = recv_line(socket:soc, length:4096);
	if("repository" >< r || "I HATE" >< r)
		exit(0);
}

soc = open_sock_tcp(port);
if(!soc)
	exit(0);

req = string("BEGIN AUTH REQUEST\n",
dir, "\n",
login,"\n",
"A", pass,"\n",
"END AUTH REQUEST\n");

send(socket:soc, data:req);
r = recv_line(socket:soc, length:4096);
if("I LOVE YOU" >< r)
{
    send(socket:soc, data:string("version\n"));
    r = recv_line(socket:soc, length:4096);
    if("Concurrent" >< r)
    {
     	set_kb_item(name:string("cvs/", port, "/version"), value:r);
     	if(ereg(pattern:".* 1\.([0-9]\.|10\.|11\.([0-9][^0-9]|1[0-6])|12\.[0-8][^0-9]).*", string:r))
     		security_warning(port);
    }
}

close(soc);
 
