From 7e98af5f255bdd2eaa19272a34b4fb27bf7086da Mon Sep 17 00:00:00 2001 From: Tom Sellers Date: Thu, 23 Jul 2020 06:43:12 -0500 Subject: [PATCH] Sonar / CPE updates (#279) * Sonar / CPE updates * Filezilla is Windows only * Add CPEs to SSH * More HTTP CPEs * DNS updates * SMTP.. * more smtp * pop * IMAP --- cpe-remap.yaml | 17 ++++++- identifiers/hw_family.txt | 2 +- identifiers/hw_product.txt | 2 +- identifiers/service_product.txt | 2 +- xml/dns_versionbind.xml | 12 +++-- xml/ftp_banners.xml | 55 +++++++++++++++++++-- xml/http_servers.xml | 56 +++++++++++++++++++-- xml/imap_banners.xml | 4 ++ xml/pop_banners.xml | 2 + xml/smtp_banners.xml | 86 ++++++++++++++++++++++++++++++++- xml/ssh_banners.xml | 8 ++- 11 files changed, 226 insertions(+), 20 deletions(-) diff --git a/cpe-remap.yaml b/cpe-remap.yaml index 2b129c56..3cf63fa7 100644 --- a/cpe-remap.yaml +++ b/cpe-remap.yaml @@ -16,6 +16,10 @@ mappings: weblogic: weblogic_server blue_coat: vendor: bluecoat + carnegie_mellon_university: + vendor: cmu + products: + cyrus_imap: cyrus_imap_server centos: vendor: centos products: @@ -32,6 +36,9 @@ mappings: vendor: debian products: linux: debian_linux + embedthis: + products: + goahead_webserver: goahead f5: vendor: f5 products: @@ -41,12 +48,12 @@ mappings: vendor: hp products: ilo: integrated_lights_out - lotus_domino: lotus_domino_server tru64_unix: tru64 ibm: vendor: ibm products: lotus_domino: lotus_domino_server + ibm_domino: lotus_domino os/400: os_400 jamf: products: @@ -57,6 +64,10 @@ mappings: junos_os: junos kibana: vendor: elasticsearch + cz.nic: + vendor: knot-dns + litespeed_technologies: + vendor: litespeedtech linux: vendor: linux products: @@ -94,6 +105,10 @@ mappings: vendor: modwsgi mort_bay: vendor: mortbay + nlnet_labs: + vendor: nlnetlabs + products: + dnsd: name_server_daemon net-snmp: vendor: net-snmp products: diff --git a/identifiers/hw_family.txt b/identifiers/hw_family.txt index 93a9519f..47650622 100644 --- a/identifiers/hw_family.txt +++ b/identifiers/hw_family.txt @@ -93,4 +93,4 @@ iPad iPad Air iPad Pro iPad mini -iPhone \ No newline at end of file +iPhone diff --git a/identifiers/hw_product.txt b/identifiers/hw_product.txt index 33beb2dc..65a928a8 100644 --- a/identifiers/hw_product.txt +++ b/identifiers/hw_product.txt @@ -325,4 +325,4 @@ iPhone X iPhone XR iPhone XS iPhone XS Max -vManage \ No newline at end of file +vManage diff --git a/identifiers/service_product.txt b/identifiers/service_product.txt index e1658367..280ff704 100644 --- a/identifiers/service_product.txt +++ b/identifiers/service_product.txt @@ -421,6 +421,7 @@ Symantec Endpoint Protection Manager Symantec Mail Security for SMTP Symantec Messaging Gateway TBS FTP Server +TCP/IP TCPIP POP server TUX Web Server TeamCity @@ -554,4 +555,3 @@ vsFTPd vsFTPd Extended z/OS FTP Server zFTPServer -TCP/IP diff --git a/xml/dns_versionbind.xml b/xml/dns_versionbind.xml index 5d90db4c..2a2a7a31 100644 --- a/xml/dns_versionbind.xml +++ b/xml/dns_versionbind.xml @@ -516,6 +516,7 @@ + @@ -525,6 +526,7 @@ + @@ -533,6 +535,7 @@ + @@ -583,8 +586,9 @@ Knot DNS 2.5.0-dev - + + @@ -754,7 +758,8 @@ DNSServer - + + @@ -855,9 +860,10 @@ gdnsd gdnsd - + + diff --git a/xml/ftp_banners.xml b/xml/ftp_banners.xml index 6e4d51c3..4da49e31 100644 --- a/xml/ftp_banners.xml +++ b/xml/ftp_banners.xml @@ -360,6 +360,7 @@ example.com FTP server (Version: Mac OS X Server) ready. =(<*>)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(<*>)=- =(<*>)=-.:. (( Welcome to Pure-FTPd 1.0.11 )) .:.-=(<*>)=- more stuff + @@ -374,16 +375,20 @@ more stuff --------- Welcome to Pure-FTPd [privsep] [TLS] ---------- more text + + Basic Pure-FTPd banner, no version Welcome to Pure-FTPd Pure-FTPd. + + @@ -391,26 +396,56 @@ more text =(<*>)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(<*>)=- =(<*>)=-.:. (( Welcome to PureFTPd 1.1.0 )) .:.-=(<*>)=- more text + + - - Serv-U (only runs on Windows) + + + + SolarWinds Serv-U with version + Serv-U FTP Server v15.1.3.25 ready... + + + + + + + + + Serv-U Serv-U with version on Windows Serv-U FTP-Server v2.5n for WinSock ready... Serv-U FTP Server v6.0 for WinSock ready - Serv-U FTP Server v7.2 ready... - + + + + Serv-U Serv-U with version + Serv-U FTP Server v7.2 ready... + Serv-U FTP Server v14.0 ready... + + + + + + + + + Common FTP banner modification to look like Serv-U -- assert nothing. + Welcom to Serv-U FTP Server + + zftpserver (only runs on Windows) zFTPServer v4.0, build 2008-12-24 01:41 ready. @@ -427,23 +462,28 @@ more text vsFTPd (Very Secure FTP Daemon) (vsFTPd 1.1.3) host (vsFTPd 2.0.5) + + vsFTPd (Very Secure FTP Daemon) - break me variant ready, dude (vsFTPd 1.1.0: beat me, break me) + + vsFTPd (Very Secure FTP Daemon) extended build (vsftpd.devnet.ru) vsFTPd 2.0.4+ (ext.3) ready... + @@ -453,8 +493,10 @@ more text vsFTPd (Very Secure FTP Daemon) error message OOPS: vsftpd: root is not mounted. OOPS: cannot read user list file:/etc/vsftpd.user_list + + @@ -463,9 +505,14 @@ more text FileZilla Server version 0.9.13a beta FileZilla Server 0.9.54 beta FileZilla Server v0.9.33 beta + + + + + diff --git a/xml/http_servers.xml b/xml/http_servers.xml index 6d9ef258..bb59311b 100644 --- a/xml/http_servers.xml +++ b/xml/http_servers.xml @@ -793,6 +793,7 @@ + @@ -828,8 +829,9 @@ Serv-U/15.1.6.31 - + + @@ -1151,18 +1153,29 @@ Glassfish with version information Sun GlassFish Enterprise Server v2.1 - + + Glassfish Open Source Edition with version information GlassFish Server Open Source Edition 4.1.2 GlassFish Server Open Source Edition 3.1.2.2 - + + + + + + + + Oracle GlassFish Server + Oracle GlassFish Server 3.1.2.14 + + @@ -1343,9 +1356,11 @@ thttpd with SSL support thttpd/2.19-MX Jan 24 2006 + + @@ -1367,9 +1382,11 @@ Lighttpd lighttpd/1.4.16 lighttpd/1.3.7 (Mar 23 2007/16:00:15) + + @@ -1596,6 +1613,18 @@ + + SAP NetWeaver Application Server Java - without version + SAP J2EE Engine + + + + + + + + + SAP NetWeaver Application Server without version SAP NetWeaver Application Server @@ -2325,9 +2354,10 @@ GoAhead-Webs - no version GoAhead-Webs - + + @@ -2430,10 +2460,11 @@ A small HTTP server mini_httpd/1.14 23jun2000 mini_httpd/1 23jun2000 - + + @@ -2594,8 +2625,10 @@ Boa/0.93.15 (with Intersil Extensions) Boa/0.92p OS-9 Version Boa/0.93.15 + + @@ -2755,8 +2788,10 @@ gSOAP gSOAP/2.7 + + @@ -3870,4 +3905,15 @@ + + NEC Univerge Router - enterprise class with VPN, UTM, etc + IX Series IX2106 (magellan-sec) Software, Version 10.2.20, RELEASE SOFTWARE + IX Series IX2105 (magellan-sec) Software, Version 9.6.12A, MAINTENANCE RELEASE SOFTWARE + + + + + + + \ No newline at end of file diff --git a/xml/imap_banners.xml b/xml/imap_banners.xml index 0f465b90..41e53070 100644 --- a/xml/imap_banners.xml +++ b/xml/imap_banners.xml @@ -113,8 +113,10 @@ Dovecot Secure IMAP Server Dovecot ready. Dovecot DA ready. + + @@ -163,6 +165,7 @@ + @@ -179,6 +182,7 @@ + diff --git a/xml/pop_banners.xml b/xml/pop_banners.xml index 14e89db3..d372004c 100644 --- a/xml/pop_banners.xml +++ b/xml/pop_banners.xml @@ -180,8 +180,10 @@ Dovecot Secure POP Server + + diff --git a/xml/smtp_banners.xml b/xml/smtp_banners.xml index f0e2c1da..c06f84be 100644 --- a/xml/smtp_banners.xml +++ b/xml/smtp_banners.xml @@ -861,6 +861,7 @@ + @@ -940,11 +941,13 @@ Postfix - version + build, followed by os + + @@ -952,27 +955,33 @@ Postfix - Std semantic versioning, w/ optional parens foo.bar ESMTP Postfix (3.1.4) foo.bar ESMTP Postfix 2.7.1 + + Postfix - version + build foo.bar ESMTP Postfix (2.8-20100306) + + Postfix - Ubuntu foo.bar ESMTP Postfix (Ubuntu) + + @@ -984,8 +993,10 @@ Postfix - Ubuntu, Mail-in-a-Box package foo.bar ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/) foo.bar Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/) + + @@ -996,8 +1007,10 @@ Postfix - Debian foo.bar ESMTP Postfix (Debian/GNU) + + @@ -1008,8 +1021,10 @@ Postfix - generic banner with amusing comments in parentheses foo.bar ESMTP Postfix (lol) + + @@ -1017,23 +1032,29 @@ Postfix - generic banner foo.bar ESMTP Postfix foo.bar SMTP Postfix + + Postfix - banner without hostname or version ESMTP Postfix + + Postfix - generic w/o ESMTP foo.bar Postfix + + @@ -1070,13 +1091,16 @@ Sendmail - short banner w/o hostname, version, platform, or date. Sendmail ESMTP ready + + Sendmail - HP-UX with a PHNE (HP Networking patch) installed foo.bar ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT) + @@ -1086,6 +1110,7 @@ + @@ -1094,6 +1119,7 @@ Sendmail - HP-UX foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT + @@ -1104,12 +1130,14 @@ + Sendmail - Unixware foo.bar ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300) + @@ -1118,6 +1146,7 @@ + @@ -1125,6 +1154,7 @@ Sendmail - AIX (UCB variant) foo.bar ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT) + @@ -1135,12 +1165,14 @@ + Sendmail - AIX (UCB/ready at variant) foo.bar Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500 + @@ -1151,6 +1183,7 @@ + @@ -1159,6 +1192,7 @@ Sendmail - AIX foo.bar ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT) foo.bar ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800 + @@ -1169,6 +1203,7 @@ + @@ -1176,6 +1211,7 @@ Sendmail - SuSE Linux foo.bar ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200 + @@ -1185,6 +1221,7 @@ + @@ -1193,6 +1230,7 @@ Sendmail - Solaris with date (no time offeset variant) foo.bar ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT + @@ -1202,6 +1240,7 @@ + @@ -1209,6 +1248,7 @@ Sendmail - Solaris with date (ready variant) foo.bar ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST) + @@ -1218,6 +1258,7 @@ + @@ -1226,6 +1267,7 @@ Sendmail - Debian foo.bar ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800 foo.bar ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700 + @@ -1235,6 +1277,7 @@ + @@ -1244,6 +1287,7 @@ Sendmail - Debian 7.x (wheezy) foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+wheezy1; Thu, 30 Nov 2017 10:33:05 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+deb7u1; Thu, 30 Nov 2017 11:00:33 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1254,6 +1298,7 @@ + @@ -1261,6 +1306,7 @@ Sendmail - Debian 8.x (jessie) foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-8+deb8u2; Thu, 30 Nov 2017 10:25:48 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1271,6 +1317,7 @@ + @@ -1278,6 +1325,7 @@ Sendmail - Debian 5.x (lenny) foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-5+lenny1; Thu, 30 Nov 2017 12:29:40 +0300; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1288,6 +1336,7 @@ + @@ -1295,6 +1344,7 @@ Sendmail - Debian 4.x (etch) foo.bar ESMTP Sendmail 8.13.8/8.13.8/Debian-3+etch1; Thu, 30 Nov 2017 10:28:23 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1305,6 +1355,7 @@ + @@ -1312,6 +1363,7 @@ Sendmail - Debian 3.1 (sarge) foo.bar ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge1; Thu, 30 Nov 2017 10:55:47 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1322,6 +1374,7 @@ + @@ -1331,6 +1384,7 @@ foo.bar ESMTP Sendmail 8.15.2/8.15.2/Debian-3; Thu, 30 Nov 2017 10:55:50 +0200; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-9.4; Thu, 30 Nov 2017 10:11:54 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] foo.bar ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Thu, 30 Nov 2017 04:09:50 -0600; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1340,6 +1394,7 @@ + @@ -1348,6 +1403,7 @@ Sendmail - Ubuntu foo.bar ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4.1ubuntu1; Thu, 30 Nov 2017 11:00:30 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1] + @@ -1357,12 +1413,14 @@ + Sendmail - Solaris (SMI variant) foo.bar Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400 + @@ -1372,6 +1430,7 @@ + @@ -1379,6 +1438,7 @@ Sendmail - unknown platform (linuxconf variant) foo.bar ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400 + @@ -1386,6 +1446,7 @@ + @@ -1417,10 +1478,12 @@ foo.bar ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET) foo.bar ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400 foo.bar ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700 + + @@ -1428,10 +1491,12 @@ Sendmail - with timezone and timestamp, w/o timezone offset or OS foo.bar ESMTP Sendmail 8.14.4/8.14.4; Thu, 5 Apr 2018 19:30:58 GMT + + @@ -1439,33 +1504,39 @@ Sendmail - with version and date (optional timezone), w/o config version foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET) + + Sendmail - revision variant 1 foo.foo.bar ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST) + + Sendmail - revision variant 2 foo.foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT) + + @@ -1480,8 +1551,10 @@ foo.bar ESMTP Sendmail ready. foo.bar ESMTP Sendmail foo.bar Sendmail ready. + + @@ -1490,10 +1563,12 @@ Sendmail - with version and date, w/o hostname or platform (semicolon variant) ESMTP Sendmail 8.13.1/8.13.1; Thu, 30 Nov 2017 01:58:22 -0700 + + @@ -1501,11 +1576,13 @@ Sendmail - unknown (date in version string variant) mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET) + + @@ -1513,19 +1590,23 @@ Sendmail - unknown platform, variant 1 + + Sendmail - basic with version and date + + @@ -1751,11 +1832,12 @@ foo.bar ESMTP CommuniGate Pro 5.3.1 foo.bar ESMTP CommuniGate Pro 6.2c3 foo.bar ESMTP CommuniGate Pro 4.3.12. It is you again :-( - + - + + diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml index 8a8d25db..cfa41cdc 100644 --- a/xml/ssh_banners.xml +++ b/xml/ssh_banners.xml @@ -1962,8 +1962,10 @@ Dropbear w/o version - http://matt.ucc.asn.au/dropbear/dropbear.html dropbear + - + + @@ -1971,8 +1973,10 @@ dropbear_2015.67 dropbear_0.49 + - + +