Zenmap 歷史版本列表
更新時間：2016-03-23
更新細節：
What's new in this version:
- [NSE][GH#341] Added support for diffie-hellman-group-exchange-* SSH key exchange methods to ssh2.lua, allowing ssh-hostkey to run on servers that only support custom Diffie-Hellman groups. [Sergey Khegay]
- [NSE] Added support in sslcert.lua for Microsoft SQL Server's TDS protocol, so you can now grab certs with ssl-cert or check ciphers with ssl-enum-ciphers. [Daniel Miller]
- [Zenmap] Fix a crash when setting default window geometry: TypeError: argument of type 'int' is not iterable
- [Zenmap] Fix a crash when displaying the date from an Nmap XML file due to an empty or unknown locale: File "zenmapCore/NmapParser.py", line 627, in get_formatted_date locale.getpreferredencoding()), LookupError: unknown encoding:
- [Zenmap] Fix a crash due to incorrect file paths when installing to /usr/local prefix. Example: Exception: File '/home/blah/.zenmap/scan_profile.usp' does not exist or could not be found!
更新時間：2015-12-10
更新細節：
更新時間：2015-11-20
更新細節：
What's new in this version:
- This is the most important release since Nmap 6.00 back in May 2012! For a list of the most significant improvements and new features,
- [NSE] Added 6 NSE scripts from 6 authors, bringing the total up to 515! and the summaries are below (authors are listed in brackets):
* targets-xml extracts target addresses from previous Nmap XML results files
* ssl-dh-params checks for problems with weak, non-safe, and export-grade Diffie-Hellman parameters in TLS handshakes. This includes the LOGJAM vulnerability (CVE-2015-4000)
* nje-node-brute does brute-forcing of z/OS JES Network Job Entry node names
* ip-https-discover detectings support for Microsoft's IP over HTTPS tunneling protocol
* broadcast-sonicwall-discover detects and extracts information from SonicWall firewalls
* http-vuln-cve2014-8877 checks for and optionally exploits a vulnerability in CM Download Manager plugin for Wordpress
- New option --no-shutdown prevents Ncat from shutting down when it reads EOF on stdin. This is the same as traditional netcat's "-d" option
- Improve parsing in http.lua for multiple Set-Cookie headers in a single response
更新時間：2014-08-26
更新細節：
What's new in this version:
- Integrated all of your IPv4 OS fingerprint submissions since June 2013. Added 366 fingerprints, bringing the new total to 4485. Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2, OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
- (Windows, RPMs) Upgraded the included OpenSSL to version 1.0.1i.
- (Windows) Upgraded the included Python to version 2.7.8.
- Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This was added in 6.45, and resulted in trouble for Nmap XML parsers without network access, as well as increased traffic to Nmap's servers.
- [Ndiff] Fixed the installation process on Windows, which was missing the actual Ndiff Python module since we separated it from the driver script.
- [Ndiff] Fixed the ndiff.bat wrapper in the zipfile Windows distribution, which was giving the error, "Microsoft was unexpected at this time.
- [Zenmap] Fixed the Zenmap .dmg installer for OS X.
- [Ncat] Fixed SOCKS5 username/password authentication. The password length was being written in the wrong place, so authentication could not succeed.
- Avoid formatting NULL as "%s" when running nmap --iflist. GNU libc converts this to the string "(null)", but it caused segfault on Solaris.
- [Zenmap][Ndiff] Avoid crashing when users have the antiquated PyXML package installed. Python tries to be nice and loads it when we import xml, but it isn't compatible. Instead, we force Python to use the standard library xml module.
- Handle ICMP admin-prohibited messages when doing service version detection.
- [NSE] Fix a bug causing http.head to not honor redirects.
- [Zenmap] Fix a bug in DiffViewer causing this crash: TypeError: GtkTextBuffer.set_text() argument 1 must be string or read-only buffer, not NmapParserSAX Crash happened when trying to compare two scans within Zenmap.
更新時間：2014-04-22
更新細節：
What's new in this version:
- [NSE] Made numerous improvements to ssl-heartbleed to provide more reliable detection of the vulnerability.
- [Zenmap] Fixed a bug which caused this crash message: IOError: [Errno socket error] [Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond
- The bug was caused by us adding a DOCTYPE definition to Nmap's XML output which caused Python's XML parser to try and fetch the DTD every time it parses an XML file. We now override that DTD-fetching behavior.
- [NSE] Fix some bugs which could cause snmp-ios-config and snmp-sysdescr scripts to crash
- [NSE] Improved performance of citrixlua library when handling large XML responses containing application lists.
更新時間：2014-04-15
更新細節：
What's new in this version:
- [NSE] Add ssl-heartbleed script to detect the Heartbleed bug in OpenSSL
- [NSE] Fixed an error-handling bug in socks-open-proxy that caused it to fail when scanning a SOCKS4-only proxy.
- [NSE] Improved ntp-info script to handle underscores in returned data.
- [NSE] Add quake1-info script for retrieving server and player information from Quake 1 game servers. Reports potential DoS amplification factor.
- [NSE] Add unicode library for decoding and encoding UTF-8, UTF-16, CP437 and other character sets to Unicode code points. Scripts that previously just added or skipped nulls in UTF-16 data can use this to support non-ASCII characters.
- When doing a ping scan (-sn), the --open option will prevent down hosts from being shown when -v is specified. This aligns with similar output for other scan types.
- [Ncat] Added support for socks5 and corresponding regression tests.
- [NSE] Add http-ntlm-info script for getting server information from Web servers that require NTLM authentication.
- Added TCP support to dns.lua.
- Added safe fd_set operations. This makes nmap fail gracefully instead of crashing when the number of file descriptors grows over FD_SETSIZE.
- [NSE] Added tls library for functions related to SSLv3 and TLS messages. Existing ssl-enum-ciphers, ssl-date, and tls-nextprotoneg scripts were updated to use this library.
- [NSE] Add sstp-discover script to discover Microsoft's Secure Socket Tunnelling Protocol
- [NSE] Added unittest library and NSE script for adding unit tests to NSE libraries. See unittest.lua for examples, and run `nmap --script=unittest --script-args=unittest.run -d` to run the tests.
- Updated bundled liblua from 5.2.2 to 5.2.3 (bugfix release)
- Added version detection signatures and probes for a bunch of Android remote mouse/keyboard servers, including AndroMouse, AirHID, Wifi-mouse, and RemoteMouse.
- [NSE] Added allseeingeye-info for gathering information from games using this query protocol. A version detection probe was also added.
- [NSE] Add freelancer-info to gather information about the Freelancer game server. Also added a related version detection probe and UDP protocol payload for detecting the service.
- [Ncat] Fixed compilation when --without-liblua is specified in configure (an #include needed an ifdef guard).
- [NSE] Add http-server-header script to grab the Server header as a last-ditch effort to get a software version. This can't be done as a softmatch because of the need to match non-HTTP services that obey some HTTP requests.
- [NSE] Add rfc868-time script to get the date and time from an RFC 868 Time server.
- [NSE] Add weblogic-t3-info script that detects the T3 RMI protocol used by Oracle/BEA Weblogic. Extracts the Weblogic version, as well
- Fixed a bug in libdnet with handling interfaces with AF_LINK addresses on FreeBSD >9 .Likely affected other *BSDs. Handled by skipping these non-network addresses.
- Fixed a bug with UDP checksum calculation. When the UDP checksum is zero (0x0000), it must be transmitted as 1's-complement -0 (0xffff) to avoid ambiguity with +0, which indicates no checksum was calculated. This affected UDP on IPv4 only.
- [NSE] Removed a fixed value (28428) which was being set for the Request ID in the snmpWalk library function; a value based on nmap.clock_ms will now be set instead.
- [NSE] Add http-iis-short-name-brute script that detects Microsoft IIS servers vulnerable to a file/folder name disclosure and a denial of service vulnerability. The script obtains the "shortnames" of the files and folders in the webroot folder.
- Idle scan now supports IPv6. IPv6 packets don't usually come with fragments identifiers like IPv4 packets do, so new techniques had to be developed to make idle scan possible.
- [NSE] Add http-dlink-backdoor script that detects DLink routers with firmware backdoor allowing admin access over HTTP interface.
- The ICMP ID of ICMP probes is now matched against the sent ICMP ID, to reduce the chance of false matches.
- [NSE] Made telnet-brute support multiple parallel guessing threads, reuse connections, and support password-only logins.
- [NSE] Made the table returned by ssh1.fetch_host_key contain a "key" element, like that of ssh2.fetch_host_key. This fixed a crash in the ssh-hostkey script. The "key" element of ssh2.fetch_host_key now is base64-encoded, to match the format used by the known_hosts file.
- [Nsock] Handle timers and timeouts via a priority queue (using a heap) for improved performance. Nsock now only iterates over events which are completed or expired instead of inspecting the entire event set at each iteration.
- [NSE] Update dns-cache-snoop script to use a new list of top 50 domains rather than a 2010 list.
- [NSE] Added the qconn-exec script , which tests the QNX QCONN service for remote command execution.
- [Zenmap] Fixed a crash that would happen when you entered a search term starting with a colon: "AttributeError: 'FilteredNetworkInventory' object has no attribute 'match_'".
- [Ncat] Added NCAT_PROTO, NCAT_REMOTE_ADDR, NCAT_REMOTE_PORT, NCAT_LOCAL_ADDR and NCAT_LOCAL_PORT environment variables being set in all --*-exec child processes.
更新時間：2013-07-30
更新細節：
What's new in this version:
- [Nping] Nping now checks for a matching ICMP ID on echo replies, to avoid receiving crosstalk from other ping programs running at the same time.
- [NSE] Added http-adobe-coldfusion-apsa1301.nse. It exploits an authentication bypass vulnerability in Adobe Coldfusion servers.
- [NSE] The ipOps.isPrivate library now considers the deprecated site-local prefix fec0::/10 to be private.
- [Ncat] Added --lua-exec. This feature is basically an equivalent of ncat --sh-exec "lua " and allows you to run Lua scripts with Ncat, redirecting all stdin and stdout operations to the socket connection.
- [NSE] Oops, there was a vulnerability in one of our 437 NSE scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system. stdnse.filename_escape function for extra safety.
- [NSE] Added teamspeak2-version.nse
- Nmap's routing table is now sorted first by netmask, then by metric. Previously it was the other way around, which could cause a very general route with a low metric to be preferred over a specific route with a higher metric.
- [Ncat] The -i option (idle timeout) now works in listen mode as well as connect mode.
- Fixed a byte-ordering problem on little-endian architectures when doing idle scan with a zombie that uses broken ID incremements.
- [Ncat] Ncat now support chained certificates with the --ssl-cert option.
- Stop parsing TCP options after reaching EOL in libnetutil.
- [NSE] The dns-ip6-arpa-scan script now optionally accepts "/" syntax for a network mask.
- [Ncat] Reduced the default --max-conns limit from 100 to 60 on Windows, to stay within platform limitations.
- Fixed IPv6 routing table alignment on NetBSD.
- [NSE] Added http-phpmyadmin-dir-traversal
- Added a service probe for Erlang distribution nodes.
- Updated libdnet to not SIOCIFNETMASK before SIOCIFADDR on OpenBSD. This was reported to break on -current as of May 2013.
- Fixed address matching for SCTP (-PY) ping.
- Removed some non-ANSI-C strftime format strings ("%F") and locale-dependent formats ("%c") from NSE scripts and libraries. C99-specified %F
- [Zenmap] Added Polish translation
- [NSE] Added http-coldfusion-subzero. It detects Coldfusion 9 and 10 vulnerable to a local file inclusion vulnerability and grabs the version, install path and the administrator credentials.
- [Nsock] Added a minimal regression test suite for nsock.
- [NSE] Updated redis-brute.nse and redis-info.nse to work against the latest versions of redis server.
- [Ncat] Fixed errors in conneting to IPv6 proxies.
- Added a service probe for Minecraft servers.
- [NSE] Updated hostmap-bfk to work with the latest version of their website.
- [NSE] Added XML structured output support to hostmap-bfk, hostmap-robtex, and hostmap-ip2hosts.
- [NSE] Added hostmap-ip2hosts. It uses the service provider ip2hosts.com to list domain names pointing to the same IP address.
- [NSE] Added http-vuln-cve2013-0156. It detects Ruby on Rails servers vulnerable to remote command execution.
- Added a service probe for the Hazelcast data grid.
- [NSE] Rewrote telnet-brute for better compatibility with a variety of telnet servers.
- [Nsock] Added initial proxy support to nsock. Nsock based modules (version scan, nse) of nmap can now establish TCP connections through chains of proxies. HTTP CONNECT and SOCKS4 protocols are supported, with some limitations.
- Fixed a regression that changed the number of delimiters in machine output.
- [Zenmap] Updated the Italian translation.
- Handle ICMP type 11 (Time Exceeded) responses to port scan probes. Ports will be reported as "filtered", to be consistent with existing Connect scan results, and will have a reason of time-exceeded.
- Add new decoders (BROWSER, DHCP6 and LLMNR) to broadcast-listener and changed output of some of the decoders slightly.
- Timeout script-args are now standardized to use the timespec that Nmap's command-line arguments take (5s, 5000ms, 1h, etc.). Some scripts that previously took an integer number of milliseconds will now treat that as a number of seconds if not explicitly denoted as ms.
- The list of nameservers on Windows now ignores nameservers from inactive interfaces.
- Namespace the pipes used to communicate with subprocesses by PID, to avoid multiple instances of Ncat from interfering with each other.
- Nmap may now partially rearrange its target list for more efficient host groups. Previously, a single target with a different interface, or with an IP address the same as a that of a target already in the group, would cause the group to be broken off at whatever size it was. Now, we buffer a small number of such targets, and keep looking through the input for more targets to fill out the current group.
- [NSE] Changed ip-geolocation-geoplugin to use the web service's new output format.
- Limited the number of open sockets in ultra_scan to FD_SETSIZE. Very fast connect scans could write past the end of an fd_set and cause a variety of crashes: nmap: scan_engine.cc:978: bool ConnectScanInfo::clearSD(int): Assertion `numSDs > 0' failed. select failed in do_one_select_round(): Bad file descriptor (9)
- Fixed a bug that prevented Nmap from finding any interfaces when one of them had the type ARP_HDR_APPLETALK; this was the case for AppleTalk interfaces. However, This support is not complete since AppleTalk interfaces use different size hardware addresses than Ethernet. Nmap IP level scans should work without any problem
- [Nping] Nping now skips localhost targets for privileged pings (with an error message) because those generally don't work.
- [Ncat] Ncat now keeps running in connect mode after receiving EOF from the remote socket, unless --recv-only is in effect.
- Routes are now sorted to prefer those with a lower metric. Retrieval of metrics is supported only on Linux and Windows. [David Fifield]
- Packet trace of ICMP packets now include the ICMP ID and sequence number by default.
- [NSE] Added ike-version and a new ike library
- [NSE] Fixed various NSEDoc bugs
- [Zenmap] Zenmap now understands the NMAP_PRIVILEGED and NMAP_UNPRIVILEGED environment variables.
- It's now possible to mix IPv4 range notation with CIDR netmasks in target specifications. For example, 192.168-170.4-100,200.5/16 is effectively the same as 192.168.168-170.0-255.0-255.
- Added nmap-fo.xsl, This converts Nmap XML into XSL-FO, which can be converted into PDF using Apache FOP.
- Increased the number of slack file descriptors not used during connect scan. Previously, the calculation did not consider the descriptors used by various open log files. Connect scans using a lot of sockets could fail with the message "Socket creation in sendConnectScanProbe: Too many open files".
- [Zenmap] Fixed internationalization files. Running in a language other than the default English would result in the error "ValueError: too many values to unpack".
- Changed the --webxml XSL stylesheet to point to the new location of nmap.xsl in the new respository,
- [NSE] Made the vulnerability library able to preserve vulnerability information across multiple ports of the same host.
- [NSE] Added ventrilo-info, This gets information from a Ventrilo VoIP server.
- Removed the undocumented -q option, which renamed the nmap process to something like "pine".
- Moved the Japanese man page from man1/jp to man1/ja. jp is a country code while ja is a language code.
- [NSE] Added mysql-enum script which enumerates valid mysql server usernames
- [Nsock] Reworked the logging infrastructure to make it more flexible and consistent. Updated nmap, nping and ncat accordingly. Nsock log level can now be adjusted at runtime by pressing d/D in nmap.
- [NSE] Fixed scripts using unconnected UDP sockets.
- [NSE] Added structured output to http-git.nse.
- [NSE] Added murmur-version, This gets the server version and other information for Murmur, the server for the Mumble VoIP system.
- Added a corresponding UDP payload for Murmur.
- [Zenmap] Fixed a crash that could be caused by opening the About dialog, using the window manager to close it, and opening it again.
- [Ncat] Made test-addrset.sh exit with nonzero status if any tests fail. This in turn causes "make check" to fail if any tests fail.
- Fixed compilation with --without-liblua.
- Fixed CRC32c calculation (as used in SCTP scans) on 64-bit platforms.
- [NSE] Added multicast group name output to broadcast-igmp-discovery.nse.
- [NSE] Added new fingerprints for http-enum: Sitecore, Moodle, typo3, SquirrelMail, RoundCube.
更新時間：2012-12-03
更新細節：
What's new in this version:
- [NSE] Added CPE to smb-os-discovery output.
- [Ncat] Fixed the printing of warning messages for large arguments to the -i and -w options.
- [Ncat] Shut down the write part of connected sockets in listen mode when stdin hits EOF, just as was already done in connect mode.
- [Zenmap] Removed a crashing error that could happen when canceling a "Print to File" on Windows:
> Traceback (most recent call last):
> File "zenmapGUIMainWindow.pyo", line 831, in _print_cb
> File "zenmapGUIPrint.pyo", line 156, in run_print_operation
GError: Error from StartDoc
- Added some new checks for failed library calls. [Bill Parker]
更新時間：2012-06-19
更新細節：
What's new in this version:
- [Zenmap] Fixed a hang that would occur on Mac OS X 10.7. A symptom of the hang was this message in the system console: "Couldn't recognize the image file format for file '/Applications/Zenmap.app/Contents/MacOS/../Resources/share/zenmap/pixmaps/radialnet/padlock.png'".
- [Zenmap] Fixed a crash that happened when activating the host filter. File "zenmapCoreSearchResult.pyo", line 155, in match_os KeyError: 'osmatches'
- Fixed an error that occurred when scanning certain addresses like 192.168.0.0 on Windows XP: get_srcaddr: can't connect socket: The requested address is not valid in its context. nexthost: failed to determine route to 10.80.0.0
- Fixed a bug that caused Nmap to fail to find any network interface when at least one of them is in the monitor mode. The fix was to define the ARP_HRD_IEEE80211_RADIOTAP 802.11 radiotap header identifier in the libdnet-stripped code. Network interfaces that are in this mode are used by radiotap for 802.11 frame injection and reception.
- Fixed the greppable output of hosts that time-out (when --host-timeout was used and the host timed-out after something was received from that host).
- [Zenmap] Updated the version of Python used to build the Windows release from 2.7.1 to 2.7.3 to remove a false-positive security alarm flagged by tools such as Secunia PSI. There was a minor vulnerability in certain Python27.dll web functionality (which Nmap doesn't use anyway) and Secunia was flagging all software which includes that version of Python27.dll. This update should prevent the false alarm.
更新時間：2012-05-22
更新細節：
What's new in this version:
- [NSE] Added the script http-traceroute, which exploits the Max-Forwards HTTP header to detect reverse proxies.
- Added the script distcc-CVE-2004-2687 that checks and exploits a remote command execution vulnerability in distcc.
- Added two new scripts mysql-query and mysql-dump-hashes, which add support for performing custom MySQL queries and dump MySQL password hashes.
- Improved the mysql library to handle multiple columns with the same name, added a formatResultset function to format a query response to a table suitable for script output.
- The message "nexthost: failed to determine route to ..." is now a warning rather than a fatal error. Addresses that are skipped in this way are recorded in the XML output as elements.
- [NSE] Added the script http-drupal-modules, which enumerates the installed Drupal modules using drupal-modules.lst.
- [NSE] Added http-vuln-cve2012-1823.nse, which checks for PHP CGI installations with a remote code execution vulnerability.
- [NSE] Added the script dict-info, which retrieves information from a DICT server, by issuing the SHOW SERVER command.
- [NSE] Added the script gkrellm-info, which displays information retrieved from the GKRellm monitoring service.
- [NSE] Added the script ajp-request, which adds support for creating custom Apache JServer Protocol requests.
- [NSE] Added the script ajp-brute, which enables password brute force auditing against the Apache JServ Protocol service.
- [NSE] Added the script broadcast-tellstick-discover, which discovers Telldus Technologies TellStickNet devices on the LAN.
- [NSE] Added the Apache JServer Protocol (AJP) library and the scripts ajp-methods, ajp-headers and ajp-auth.
- In XML output, elements are now child elements of the they belong to. Old output was thus:
......
New output is:
......
The option --deprecated-xml-osclass restores the old output, in case you use an Nmap XML parser that doesn't understand the new structure. The xmloutputversion has been increased to 1.04.
- Added a new element to XML output that indicates when a target specification was ignored, perhaps because of a syntax error or DNS failure. It looks like this:
- Nmap's development pace has increased because Google (again) sponsored 5 full-time college and graduate student programmer interns this summer as part of their Summer of Code program!
- [NSE] Added the script mmouse-exec that connects to a Mobile Mouse server, starts an application, and sends a sequence of keystrokes to it.
- [NSE] Added the script mmouse-brute that performs brute force password auditing against the Mobile Mouse service.
- [NSE] Added the script cups-queue-info that lists the contents of a remote CUPS printer queue.
- [NSE] Added the script ip-forwarding that detects devices that have IP forwarding enabled (acting as routers).
- [NSE] Added the script samba-vuln-cve-2012-1182 which detects the SAMBA CVE 2012-1182 vulnerability.
- [NSE] Added the script dns-check-zone that checks DNS configuration against best practices including RFC 1912.
- [NSE] Added the http-gitweb-projects-enum that queries a gitweb for a list of Git projects, their authors and descriptions.
- [NSE] targets-sniffer now is capable of sniffing IPv6 addresses.
- [NSE] Added the script traceroute-geolocation that queries geographic locations of each traceroute hop and allows to export the results to KLM, allowing the hops to be plotted on a map.
- [NSE] Added the ipp library and the script cups-info that lists available printers by querying the cups network daemon.
- [NSE] Added the mobilme library and the scripts http-icloud-findmyiphone and http-icloud-sendmsg, that finds the location of iOS devices and provides functionality to send them messages.
- [NSE] Added gps library and the gpsd-info script that collects GPS data from the gpsd daemon.
- [NSE] Ported the pop3-brute script to use the brute library.
- Fixed a compilation problem on Solaris 9 caused by a missing definition of IPV6_V6ONLY.
- Upgraded included libpcap to version 1.2.1.
- [NSE] Added hostmap-robtex.nse by Arturo Busleiman, which finds other domain names sharing the IP address of the target.
- [NSE] Renamed hostmap.nse to hostmap-bfk.nse.
- [NSE] Added http-robtex-shared-ns by Arturo Busleiman, finding domain names that share the same name server as the target.
- [NSE] Added the script http-vlcstreamer-ls which queries the VLC Streamer helper service for a list of files in a given directory.
- [NSE] Added the script targets-ipv6-mld that sends a malformed ICMP6 MLD Query to discover IPv6 enabled hosts on the LAN.
- [NSE] Added script http-virustotal that allows checking files, or hashes of previously scanned files, against the major antivirus engines.
- Setting --min-parallelism by itself no longer forces the maximum parallelism to the same value.
- [NSE] Added an error message indicating script failure, when Nmap is being run in non verbose/debug mode.
- Service-scan information is now included in XML and grepable output even if -sV wasn't used. This information can be set by scripts in the absence of -sV.
- [NSE] Added the script dns-ip6-arpa-scan which uses a very efficient technique to scan the ip6.arpa zone for PTR records.
- Changed XML output to show the "service" element whenever a tunnel is discovered for a port, even if the service behind it was unknown.
- [Zenmap] Fixed a crash that would happen in the profile editor when the script.db file doesn't exist.
- [Zenmap] It is now possible to compare scans having the same name or command line.
- [NSE] Added rdp-vuln-ms12-020.nse by Aleksandar Nikolic. This tests for two Remote Desktop vulnerabilities, including one allowing remote code execution, that were fixed in the MS12-020 advisory.
- Fixed an error that could occur with ICMPv6 probes and -d4 debugging: "Unexpected probespec2ascii type encountered"
- Fixed the routing table loop on OS X so that on-link routes appear. Previously, they were ignored so that things like ARP scan didn't work.
- [NSE] Added new script http-chrono, which measures min, max and average response times of web servers.
- Applied a workaround to make pcap captures work better on Solaris 10. This involves peeking at the pcap buffer to ensure that captures are not being lost. A symptom of behavior before this fix was that, when doing ARP host discovery against two targets, only one would be reported up.
- Added ciphers from RFC 5932 and Fortezza-based ciphers to ssl-enum-ciphers.nse.
- [NSE] Added new script http-drupal-users-enum, which enumerates all available Drupal user accounts by exploiting a vulnerability in the Views module.
- [NSE] Added new script broadcast-ataoe-discover, which discovers ATA over Ethernet capable devices through LAN ethernet broadcasts.
- Fixed a bug that could cause Nsock timers to fire too early. This could happen for the timed probes in IPv6 OS detection, causing an incorrect measurement of the TCP_ISR feature.
- [NSE] Added a stun library and the scripts stun-version and stun-info, which extract version information and the external NAT:ed address.
- [NSE] Added the script duplicates which attempts to determine duplicate hosts by analyzing information collected by other scripts.
- Changed the way timeout calculations are made in the IPv6 OS engine. In rare cases a certain interleaving of probes and responses would result in an assertion failure.