LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-28-2012, 09:38 PM   #1
OtagoHarbour
Member
 
Registered: Oct 2011
Posts: 332

Rep: Reputation: 3
Linux Malware Detect (LMD)/netofficedwins_demosession.nasl


I am using Ubuntu 11.10. I installed Linux Malware Detect (LMD) v1.4.1 and ran it. It reported the following infection.

Code:
netofficedwins_demosession.nasl
I did a search for this infaction and found this info. It makes it seem pretty bad but it does not say how to get rid of it. I set LMD to clean and quarantine infections but it found this infection after two runs.

What is the best way to get rid of this infection?

Thanks,
Peter.
 
Old 07-29-2012, 05:15 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by OtagoHarbour View Post
I did a search for this infaction and found this info. It makes it seem pretty bad but it does not say how to get rid of it. I set LMD to clean and quarantine infections but it found this infection after two runs. What is the best way to get rid of this infection?
Unlike with the Other Platform software vulnerabilities in Linux commonly are not, and should not be made subject to, "erase and be at ease"-type of cleaning up. It's unfortunate to see LMD tries to shove such a "solution" down your throat. Software vulnerabilities in Linux commonly require you to verify software integrity and update software.
You should always inform yourself well enough to be able to assess the problem (that IMHO is "the Linux way", not "erase and be at ease") and this is best done using any CVE identifiers with which you consult:
0. your distributions security information: Ubuntu: CVE-2008-2044 and in your case upstream Debian: CVE-2008-2044,
1. the vendor site: netOffice Dwins,
2. the CVE: netOffice (or the OSVDB, NVD or Secunia) and see details at CVE security vulnerability database: CVE-2008-2044,
3. Determine if the machine you run LMD on serves web pages or web applications and if it specifically runs the vulnerable version. Only if it does, then:
- check directories and files the user the web server runs as has access to for anomalies like uploaded files,
- check your login database and system logs for anomalies and your web server logs for access where either 0) files like "projects_site/uploadfile.php" are in the URI or 1) where the "demoSession" variable is set to "1",
- know from the vendor site version 1.3.1 was released as a fix on 2008-04-22 and the current version is 1.5.

HTH
 
Old 07-29-2012, 12:58 PM   #3
heinblöd
Member
 
Registered: May 2004
Location: France
Distribution: Slackware Gentoo
Posts: 186

Rep: Reputation: 31
I guess your malware scanner just stubled of a detection file from nessus,
(.nasl files are just nessus detection patterns)
http://www.tenable.com/products/nessus/

It's like one anti-virus regards the detection-patterns of a second one as infection in the win-world

So nothing to worry about, if you have Nessus installed

Actually the link you provided says it all:
Quote:
NASLDB: netOffice Dwins demoSession Parameter Authentication Bypass
General

ID: 31342
Name: netOffice Dwins demoSession Parameter Authentication Bypass

Summary: Accesses the

Credits: Tenable Network Security, Inc.

AND :

Plugin

Version: 1.11
Filename: netofficedwins_demosession.nasl
Filesize: 7345 bytes
MD5 Hash: 2fcd79678a2e4fb0a2e95b9fe93211cd

Last edited by heinblöd; 07-29-2012 at 01:29 PM.
 
1 members found this post helpful.
Old 07-29-2012, 01:05 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by heinblöd View Post
So nothing to worry about, if you have Nessus installed
"I think", "don't worry" and other such fuzzy human phrasings are what we like to avoid in this particular forum. If you did actually read my reply you should dig that sharing knowledge and tools (aka giving a man a fishing rod) trumps, and should trump, "don't worry" responses (giving a man a fish) each and every time.
 
Old 07-29-2012, 01:26 PM   #5
heinblöd
Member
 
Registered: May 2004
Location: France
Distribution: Slackware Gentoo
Posts: 186

Rep: Reputation: 31
First of all my answer was "So nothing to worry about, if"

Secondly I read your answer and all the links provided and I could nowhere detect a hint to Nessus.

If you read the OPs question you'll read
Quote:
Code:

netofficedwins_demosession.nasl
Which is not in any way a file which belongs to netOffice Dwins

but a Nessus Plugin or a file witten in the "Nessus plugin language"
http://www.virtualblueness.net/nasl.html#tth_sEc1.1

Last edited by heinblöd; 07-29-2012 at 02:00 PM.
 
Old 07-29-2012, 02:09 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by heinblöd View Post
Which is not in any way a file which belongs to netOffice Dwins

but a Nessus Plugin or a file witten in the "Nessus plugin language"
Ahhh! Now I realize what you mean.
Yours is the right answer.
My apologies.
 
1 members found this post helpful.
Old 07-29-2012, 02:23 PM   #7
heinblöd
Member
 
Registered: May 2004
Location: France
Distribution: Slackware Gentoo
Posts: 186

Rep: Reputation: 31
Quote:
Originally Posted by unSpawn View Post
Ahhh! Now I realize what you mean.
You're welcome, don't worry

I just had several times already the situation, where a possible security problem turned out to be detection pattern files from different security scanner or anti-virus software, which simply played "detection ping pong" with their respective pattern files ...

Last edited by heinblöd; 07-29-2012 at 02:25 PM.
 
Old 07-29-2012, 02:32 PM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Well, that doesn't detract from the fact that I just should have read the OP more carefully...
 
Old 07-29-2012, 03:51 PM   #9
OtagoHarbour
Member
 
Registered: Oct 2011
Posts: 332

Original Poster
Rep: Reputation: 3
Quote:
Originally Posted by heinblöd View Post
You're welcome, don't worry

I just had several times already the situation, where a possible security problem turned out to be detection pattern files from different security scanner or anti-virus software, which simply played "detection ping pong" with their respective pattern files ...
I would like to thank you both for your responses. They have been very enlightening. So far I'm liking LMD since the installation and operation is straight forward although I was fooled when it picked up the Nessus file. I guess it was more of a weakness in an older version of Nessus, in that things could get through, rather than actual Malware.

Thanks again,
Peter.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Malware Detect questions, please answer. TheOnlyQ Linux - Newbie 1 05-17-2011 07:13 AM
[SOLVED] May have contracted malware. Yes, malware. Firefox on Ubuntu Fiesty. Seeking a fix drachenchen Linux - Security 22 08-17-2008 01:05 PM
May have contracted malware. Yes, malware. Firefox on Ubuntu Fiesty. Seeking a fix drachenchen Linux - Security 1 06-12-2008 05:10 AM
NASL scripting s0n|k Linux - Newbie 1 04-29-2006 05:16 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:32 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration