From 6f38892828afb9fd335dbd598763b296671c1fc6 Mon Sep 17 00:00:00 2001 From: fyodor Date: Fri, 12 Jun 2009 10:04:11 +0000 Subject: [PATCH] Working on the CHANGELOG for the 4.85BETA10 release, which I hope to make today if possible. I still have more CHANGELOG entries to add and shuffling/spell-checking/etc to perform --- CHANGELOG | 285 ++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 215 insertions(+), 70 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index b914acd62..418acc04a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,62 +1,25 @@ # Nmap Changelog ($Id$); -*-text-*- -o [Zenmap] Fixed two bugs: 1) HostInfo objects would be modified in memory to - reflect information gathered from new scans, making scan comparisons - difficult. Now, modifications are done to copies of existing hosts. - 2) Canceling a scan and then removing it would cause the NetworkInventory - hosts dictionary to be cleared and not refreashed [Josh Marlow] +Nmap 4.85BETA10 [2009-06-12] -o [Zenmap] Added the -PS option found in the Quick Traceroute profile to some of - the Intense scan profiles [Josh Marlow] - -o [Ncat] There is a backwards-incompatible change in the way that - listen mode works. The new default behavior is to accept only one - connection, and quit when the connection ends. This was necessary to - prevent data loss in some situations; some programs require Ncat to - send an EOF before they flush their internal buffers and finish - processing the last bit of data. See - http://seclists.org/nmap-dev/2009/q2/0528.html for more information. - Use the new -k or --keep-open option to get the old behavior, in - which Ncat will accept multiple simultaneous connection, combine all - their input, and accept more connections after a disconnection. - [Daniel Roethlisberger] - -o The --version-trace option now shows the names of the probes as they - are sent. The patch was from Tom Sellers. - -o [Ncat] SSL in listen mode was made to work on systems like BSD in - which a socket inherits its blocking of non-blocking status from the - listening socket. Thanks to Daniel Roethlisberger for reporting the - bug and providing test results. [David] - -o Rewrote the port list merging code in validate_scan_lists to be more - maintainable [Josh Marlow] - -o [Ncat] Made Ncat compile with versions of OpenSSL before 0.9.7. It - would fail in ncat_openssl.c with the message "structure has no - member named `it'". The problem was reported by Jaroslav Fojtik. - [David] - -o Tweaked validate_scan_lists so as to handle -SP and -SA at the same time when - running nmap as nonroot or using IPv6. It now combines the two port lists - [Josh Marlow] - -o Added another case to NmapOps::RawScan() to cover the case where we are using - a SYN ping scan and issuing raw packets. This fixes a bug wherein nmap would - not display the "Raw packets sent..." message [Josh Marlow] - -o Changed the ICMP ping probes to use a random non-zero ICMP id. Some hosts - seem to drop probes when ICMP id is 0 [Josh Marlow] - -o Changed the default UDP ping port to 40125. This appears to be a - better port based on tests done by David [Josh Marlow] +o There is a new default ping probe set: -PE -PS443 -PA80 -PP. In + exhaustive testing of 90 different probes, this one emerged as the + best four-probe combination, finding 14% more Internet hosts than + the previous default, -PE -PA80. The default for nonroot users is + -PS80,443, replacing the previous default of -PS80. In addition, + ping probes are now sent in order of effectiveness (-PE first) so + that less likely probes may not have to be sent. [David, Fyodor] o [Ncat] Handling of newlines on Windows has been improved. CRLF is automatically converted to bare LF when input is from the console, but not when it is from a pipe or a file. No newline translation is done on output (it was being done before). This makes it possible to - transfer binary files with Ncat on Windows without any corruption. - [David] + transfer binary files with Ncat on Windows without any corruption, + while still being able to interactively ncat into UNIX shells and + other processes which require bare newlines. Ncat clients now work + the same way on UNIX and Windows in that respect. For cases where + you do want \r\n line endings (such as connections to web and email + servers or Windows cmd.exe shells), you can still specify -C. [David] o Added initial SCTP port scanning support to Nmap. SCTP is a layer 4 protocol used mostly for telephony related applications. @@ -76,32 +39,175 @@ o Added initial SCTP port scanning support to Nmap. SCTP is Part of the work on SCTP support was kindly sponsored by Compass Security AG, Switzerland. [Daniel Roethlisberger] +o [NSE] Added the new script http-iis-webdav-vuln.nse, which detects + the recently discovered WebDAV unicode bug in MS IIS 5.1/6.0 web + server which can allow arbitrary users to access password protected + folders without authentication. See + http://nmap.org/svn/scripts/http-iis-webdav-vuln.nse. [Ron] + +o [NSE] Added the imap-capabilities script, which uses the CAPABILITY + command to determine the capabilities of a target IMAP mail server. + A simple supporting IMAP library was added as well. See + http://nmap.org/nsedoc/scripts/imap-capabilities.html. [Brandon] + +o Optimized some Nmap version detection match lines for slightly + better performance. See + http://seclists.org/nmap-dev/2009/q2/0328.html. [Brandon] + +o Open Source Press completed and released the German translation of + the official Nmap book (Nmap Network Scanning). Learn more at + http://nmap.org/book/#translations. + +o Nmap RPM packages (x86 and x86-64) are now built with OpenSSL + support (statically linked in to avoid dependencies). They are also + now built on CentOS 5.3 for compatability with RHEL, Fedora, and + other distributions. Please let us know if you discover any + compatability problems (or other issues) with the new RPMs. [Fyodor] + +o The Nmap Reference Guide has been translated to German by Open + Source Press and Indonesian by Tedi Heriyanto. You can now read it + in 16 langauges at http://nmap.org/docs.html. We're always looking + for more translations of Nmap and it's documentation--see + http://seclists.org/nmap-dev/2009/q2/0667.html if you'd like to help. + o [Zenmap] The Topology tab now has a "Save Graphic" button that allows saving the current topology display as PNG, PostScript, PDF, and SVG. - [Joao Medeiros] + [Joao Medeiros, David] -o Fixed a bug with the --defeat-rst-ratelimit option [Josh] +o Version detection can now detect Ncat's --chat mode (IPv4 and + IPv6). [David] + +o Changed the default UDP ping port to 40125. This appears to be a + better port based on tests done by David [Josh Marlow] + +o [Ncat] There is a backwards-incompatible change in the way that + listen mode works. The new default behavior is to accept only one + connection, and quit when the connection ends. This was necessary to + prevent data loss in some situations; some programs require Ncat to + send an EOF before they flush their internal buffers and finish + processing the last bit of data. See + http://seclists.org/nmap-dev/2009/q2/0528.html for more information. + Use the new -k or --keep-open option to get the old behavior, in + which Ncat will accept multiple simultaneous connection, combine all + their input, and accept more connections after a disconnection. + [Daniel Roethlisberger] + +o Improved validate_scan_lists to handle -SP and -SA at the same time + when running nmap as nonroot or using IPv6. It now combines the two + port lists [Josh Marlow] + +o [Ncat] SSL in listen mode now works on systems like BSD in which a + socket inherits its blocking or non-blocking status from the + listening socket. Thanks to Daniel Roethlisberger for reporting the + bug and providing test results. [David] + +o The --version-trace option now shows the names of the probes as they + are sent to ease debugging/understanding. [Tom Sellers] + +o The GPG detached signatures of Nmap releases now use the more + standard .asc extension rather than .gpg.txt. They can still be + found at http://nmap.org/dist/sigs/ and the .gpg.txt versions for + previous releases are still retained for compatability reasons. For + instructions on verifying Nmap package integrity, see + http://nmap.org/book/install.html#inst-integrity. [Fyodor] + +o [Zenmap] Fixed two bugs: 1) HostInfo objects would be modified in memory to + reflect information gathered from new scans, making scan comparisons + difficult. Now, modifications are done to copies of existing hosts. + 2) Canceling a scan and then removing it would cause the NetworkInventory + hosts dictionary to be cleared and not refreashed [Josh Marlow] + +o [Zenmap] Added the -PS22,25,80 option found in the Quick Traceroute + profile to some of the Intense scan profiles for improved host + discovery. [Josh Marlow] + +o [Ndiff] Avoid printing a "Not shown:" line if there weren't any + ports in that (extraports) state. [David] + +o [Ncat] Fixed Ncat compilation with versions of OpenSSL before 0.9.7. + Previously it would fail in ncat_openssl.c with the message + "structure has no member named `it'". The problem was reported by + Jaroslav Fojtik. [David] + +o [NSE] Removed the packet.hextobin(str) and packet.bintohex(str) + functions. They are redundant since you get the same functionality + by calling with bin.pack("H", str) and bin.unpack("H", str), + respectively. [Patrick] + +o [NSE[ Fixed the parsing of --script-args, which was only accepting + values with alphanumeric characters and underscores. Now a key, value, + or array value may be a sequence of characters except '{', '}', ',', + '=', and all space characters. You may overcome this restriction by + using quotes (single or double) to allow all characters within the + quotation marks. You may also use the quote delimiter inside the + sequence so long as it is escaped by a backslash. See + http://seclists.org/nmap-dev/2009/q2/0211.html. [Patrick] + +o [NSE] When a script ends for any reason, all of its mutexes are + unlocked. This prevents a permanant (and painful to debug) deadlock + when a script crashes without unlocking a mutex. See + http://seclists.org/nmap-dev/2009/q2/0533.html. + +o Added another case to NmapOps::RawScan() to cover the case where we are using + a SYN ping scan and issuing raw packets. This fixes a bug wherein nmap would + not display the post-scan count of raw packets sent. [Josh Marlow] + +o Changed the ICMP ping probes to use a random non-zero ICMP id. Some hosts + seem to drop probes when the ICMP id is 0 [Josh Marlow] + +o Fixed a --script argument processing bug in which Nmap would abort + when an expression matches a set of scripts which were loaded by + other expressions first (a simple example is + "--script default,DEFAULT". [Patrick] + +o Fixed a bug with the --defeat-rst-ratelimit option which prevented + it from working properly. See this thread: + http://seclists.org/nmap-dev/2009/q2/0476.html. [Josh] o [Zenmap] Operating system icons are now always loaded as PNGs, even on - platforms that support SVG images. Loading PNGs was over ten times - faster in some tests [Josh] + platforms which support SVG images. That is much faster, and Zenmap + currently never scales the images anyway. [Josh] -o There is a new default ping probe set: -PE -PS443 -PA80 -PP. In - exhaustive testing of 90 different probes, this one emerged as the - best four-probe combination, finding 14% more Internet hosts than - the previous default, -PE -PA80. The default for nonroot users is - -PS80,443, replacing the previous default of -PS80. In addition, - ping probes are now sent in order of effectiveness (-PE first) so - that less likely probes may not have to be sent. [David/Fyodor] +o [Ncat] The Nmap Windows uninstaller now removes the Ncat CA list + (ca-bundle.crt) which has been installed since 4.85BETA9. [Jah] + +o [NSE] Brandon Enright from UCSD reports that, thanks to all the NSE + fixes in this release, he no longer sees any Nmap crashes in his + large scale scans. See + http://seclists.org/nmap-dev/2009/q2/0639.html. + +o [NSE] Upon connection failure, a socket now immediately unlocks its + "socket lock" to allow other pending socket connections to succeed + sooner. This slightly improves scan speeds by removing the wait for + garbage collection to free the resource. [Patrick] + +o [NSE] Corrected a bug in nse_nsock.cc that could result in the use + of an invalid Lua state if a thread is collected due to timeout or + other even more rare reasons. Essentially, the callbacks from the + nsock library were returning to an already-collected Lua state. We + now maintain a reference to the Lua State Thread in the nsock + userdata environment table to prevent early collection. This is a + temporary patch for the stable release pending a more detailed + review of the NSE nsock library binding. [Patrick] + +o [NSE] When an NSE script in the database (script.db) is requested + but not found on the filesystem, Nmap now prints a warning rather + than aborting. We accidentally shipped with such a phantom script + (smb-check-vulns-2.nse) in 4.85BETA8. [Patrick] o Fixed a bug where an ICMP echo, timestamp, or address mask reply could be matched up with the wrong ICMP probe if more than one ICMP - probe type was being sent (as with the new default ping). [David] + probe type was being sent (as with the new default ping). This lead + to timing calculation problems. [David] + +o Improved the host expression parser to better handle a few cases + where invalid target specifiers would case Nmap to scan unintended + hosts. See http://seclists.org/nmap-dev/2009/q2/0319.html. [Jah] o [Zenmap] Fixed a crash, introduced in 4.85BETA4, that happened when - searching scan results by date. [David] The error message was - File "zenmapGUI\SearchGUI.pyo", line 816, in set_date - TypeError: argument must be sequence of length 9, not 3 + searching scan results by date. [David] + The error message was: File "zenmapGUI\SearchGUI.pyo", line 816, in + set_date TypeError: argument must be sequence of length 9, not 3 o Patched configure.ac to detect Lua include and library files in "lua5.1" subdirectories of /usr/include and the like. Apparently @@ -109,20 +215,59 @@ o Patched configure.ac to detect Lua include and library files in /usr/include/lua.h and /usr/include/lua/lua.h as well. [Jan Christoph Nordholz] +o The --traceroute feature is now properly disabled whenever IPv6 (-6) + is requested, since IPv6 traceroutes are not yet supported. [Jah] + o Fixed an assertion failure which could occur on at least SPARC Linux The error looked like "nsock_core.c:294: handle_connect_result: Assertion `0' failed. Aborted". [David Fifield, Fabio Pedretti] +o Nmap's make install target now uses $(INSTALL) rather than cp to + copy NSE scripts and libraries to ensure that file permissions are + set properly. [Fyodor] + o Improved the Oracle DB version detection signatures. [Tom Sellers] +o [NSE] Clean up output (generally reducing default verbosity) for the + p2p-conficker, smb-check-vulns, and http-iis-webdav-vuln scripts. In + general, we don't ask scripts to report that a host is clean unless + Nmap's verbosity level (-v) is at least one or two. [Ron, Fyodor] + +o [NSE] Remove the old nse_macros.h header file. This involved + removing the SCRIPT_ENGINE_* status defines, moving the likes of + SCRIPT_ENGINE_LUA_DIR to nse_main.h, removing the last remaining use + of SCRIPT_ENGINE_TRY, and moving the FILES and DIRS defines to + nse_fs.h. [Patrick] + +o Cleaned up the libpcre build system a bit by removing Makefile.am + and modifying configure.ac to prevent uneccesary removal of + pcre_chartables.cc in some instances. [Fyodor] + +o Fixed a bug which would cause Nmap to sometimes miscount the number + of hosts scanned and produce warnings such as "WARNING: No targets + were specified, so 0 hosts scanned" when --traceroute and -sP were + combined. [Jah] + +o Changed Nmap's configure.ac to check in more situations whether -ldl + is required for compilation and add it where necessary. [Fyodor] + +o When building Nmap RPMs using the spec file, you can now pass in an + openssl argument, the contents of which are passed to ./configure's + --with-openssl option. So you can pass rpmbuild an option such as + --define "openssl /usr/local/ssl". [Fyodor] + +o Fixed the make distclean target to avoid a failure which could occur + when you ran it right after a make clean and potentially in other + situations. [David] + o Updated nmap-mac-prefixes with the latest MAC address prefix data from http://standards.ieee.org/regauth/oui/oui.txt as of 5/20/09. [Fyodor] -o [Ncat] Now Ncat can send a certificate in connect mode for client authentication - using --ssl-cert and --ssl-key options.Ncat sends client certificate which is added - using --ssl-cert and --ssl-key only when it is requested by ssl server otherwise not. - [Venkat] +o Ncat can now send SSL certificates in connect mode for client + authentication by using the --ssl-cert and --ssl-key options. The + specified certificates are only sent when requested by the + server. [Venkat] Nmap 4.85BETA9 [2009-05-12]