Overview of pkg-lib-deb.inc

Public Function Summary

Public functions are intended to be called by the code that imports this library.

Name Summary
dpkgnorm
isdpkgvuln

Public Function Details

dpkgnorm

Named Parameters

rls
str

Code

function dpkgnorm(str, rls) {
    local_var str2, m;
    str2 = str_replace(find:"-lenny", string: str, replace:"lenny");
    str2 = str_replace(find:"+lenny", string: str2, replace:"lenny");
    str2 = str_replace(find:".lenny", string: str2, replace:"lenny");
    str2 = str_replace(find:"-squeeze", string: str, replace:"squeeze");
    str2 = str_replace(find:"+squeeze", string: str2, replace:"squeeze");
    str2 = str_replace(find:".squeeze", string: str2, replace:"squeeze");
    str2 = str_replace(find:"-wheezy", string: str, replace:"wheezy");
    str2 = str_replace(find:"+wheezy", string: str2, replace:"wheezy");
    str2 = str_replace(find:".wheezy", string: str2, replace:"wheezy");
    m = eregmatch(pattern:"^([0-9]:)?(.*)$", string:str2);
    if(isnull(m)) return str2;

    return(m[2]);
}

# dpkg gives us the package name and version number nicely separated out.

		
top

isdpkgvuln

Named Parameters

pkg
rls
rls_regex
ver

Code

function isdpkgvuln(pkg, ver, rls, rls_regex) {
    local_var kbrls, rpms, pat, matches, rc, pat_a, pat_b, report;

    # Check that we have the data for this release.
    kbrls = get_kb_item("ssh/login/release");

    if(! rls_regex && kbrls != rls) {
      return NULL;
    }

    if( rls_regex ) {
      if( ! ereg(pattern:rls_regex, string:kbrls))
        return NULL;
    }

    rpms = get_kb_item("ssh/login/packages");
    if(!rpms) return NULL;
    pat = string("ii  (", pkg, ") +([0-9]:)?([^ ]+)");
    matches = eregmatch(pattern:pat, string:rpms);
    if(isnull(matches)) {
	return NULL;
    }

    __pkg_match = TRUE; # Package was installed.

    # Normalize our two strings for known idiosyncrasies
    pat_a = dpkgnorm(str:matches[3], rls:rls);
    pat_b = dpkgnorm(str:ver, rls:rls);
    rc = revcomp(a:pat_a, b:pat_b);
    if(rc<0) {
	report = "Package " + pkg + " version " +
		matches[3] + ' is installed which is known to be vulnerable.\n';
	return report;
    }
    return NULL;
}


		
top