Information found on port smtp (25/tcp)
A pop3pw server is running on this port
Nessus ID : 10330
Information found on port smtp (25/tcp)
For some reason, we could not send the EICAR test string to this MTA
Nessus ID : 11034
Vulnerability found on port ssh (22/tcp)
Warning found on port ssh (22/tcp)
You are running OpenSSH-portable 3.6.1 or older.
There is a flaw in this version which may allow an attacker to
bypass the access controls set by the administrator of this server.
OpenSSH features a mechanism which can restrict the list of
hosts a given user can log from by specifying a pattern
in the user key file (ie: *.mynetwork.com would let a user
connect only from the local network).
However there is a flaw in the way OpenSSH does reverse DNS lookups.
If an attacker configures his DNS server to send a numeric IP address
when a reverse lookup is performed, he may be able to circumvent
this mechanism.
Solution : Upgrade to OpenSSH 3.6.2 when it comes out
Risk Factor : Low
CVE : CAN-2003-0386
BID : 7831
Nessus ID : 11712
Warning found on port ssh (22/tcp)
You are running OpenSSH-portable 3.6.1p1 or older.
If PAM support is enabled, an attacker may use a flaw in this version
to determine the existence or a given login name by comparing the times
the remote sshd daemon takes to refuse a bad password for a non-existant
login compared to the time it takes to refuse a bad password for a
valid login.
An attacker may use this flaw to set up a brute force attack against
the remote host.
*** Nessus did not check whether the remote SSH daemon is actually
*** using PAM or not, so this might be a false positive
Solution : Upgrade to OpenSSH-portable 3.6.1p2 or newer
Risk Factor : Low
CVE : CAN-2003-0190
BID : 7482, 7467, 7342
Nessus ID : 11574
Information found on port ssh (22/tcp)
Remote SSH version : SSH-2.0-OpenSSH_3.4p1 Debian 1:3.4p1-1
Nessus ID : 10267
Information found on port ssh (22/tcp)
The remote SSH daemon supports the following versions of the
SSH protocol :
. 1.99
. 2.0
Nessus ID : 10881
Warning found on port daytime (13/tcp)
The daytime service is running.
The date format issued by this service
may sometimes help an attacker to guess
the operating system type.
In addition to that, when the UDP version of
daytime is running, an attacker may link it
to the echo port using spoofing, thus creating
a possible denial of service.
Solution : disable this service in /etc/inetd.conf.
Risk factor : Low
CVE : CVE-1999-0103
Nessus ID : 10052
Warning found on port discard (9/tcp)
The 'discard' port is open. This port is
not of any use nowadays, and may be a source of problems,
Solution : comment out 'discard' in /etc/inetd.conf
Risk factor : Low
CVE : CAN-1999-0636
Nessus ID : 11367
Vulnerability found on port http (80/tcp)
Warning found on port http (80/tcp)
Your webserver supports the TRACE and/or TRACK methods. It has been
shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
'Cross-Site-Tracing', when used in conjunction with
various weaknesses in browsers.
An attacker may use this flaw to trick your
legitimate web users to give him their
credentials.
Solution: Disable these methods.
If you are using Apache, add the following lines for each virtual
host in your configuration file :
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
If you are using Microsoft IIS, use the URLScan tool to deny HTTP TRACE
requests or to permit only the methods needed to meet site requirements
and policy.
See http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html
Risk factor : Medium
Nessus ID : 11213
Warning found on port http (80/tcp)
The remote host appears to be running a version of
Apache which is older than 1.3.27
There are several flaws in this version, you should
upgrade to 1.3.27 or newer.
*** Note that Nessus solely relied on the version number
*** of the remote server to issue this warning. This might
*** be a false positive
Solution : Upgrade to version 1.3.27
See also : http://www.apache.org/dist/httpd/Announcement.html
Risk factor : Medium
CVE : CAN-2002-0839, CAN-2002-0840, CAN-2002-0843
BID : 5847, 5884, 5995, 5996
Nessus ID : 11137
Information found on port http (80/tcp)
A web server is running on this port
Nessus ID : 10330
Information found on port http (80/tcp)
The remote web server type is :
Apache/1.3.26 (Unix) Debian GNU/Linux
Solution : You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Nessus ID : 10107
Warning found on port auth (113/tcp)
The 'ident' service provides sensitive information
to potential attackers. It mainly says which accounts are running which
services. This helps attackers to focus on valuable services [those
owned by root]. If you don't use this service, disable it.
Risk factor : Low
Solution : comment out the 'auth' or 'ident' line in /etc/inetd.conf
CVE : CAN-1999-0629
Nessus ID : 10021
Information found on port sunrpc (111/tcp)
The RPC portmapper is running on this port.
An attacker may use it to enumerate your list
of RPC services. We recommend you filter traffic
going to this port.
Risk factor : Low
CVE : CAN-1999-0632, CVE-1999-0189
BID : 205
Nessus ID : 10223
Vulnerability found on port netbios-ssn (139/tcp)
Information found on port printer (515/tcp)
A LPD server seems to be running on this port
Nessus ID : 10330
Warning found on port general/tcp
The remote host does not discard TCP SYN packets which
have the FIN flag set.
Depending on the kind of firewall you are using, an
attacker may use this flaw to bypass its rules.
See also : http://archives.neohapsis.com/archives/bugtraq/2002-10/0266.html
http://www.kb.cert.org/vuls/id/464113
Solution : Contact your vendor for a patch
Risk factor : Medium
BID : 7487
Nessus ID : 11618
Information found on port general/tcp
Remote OS guess : Linux 2.1.19 - 2.2.20
CVE : CAN-1999-0454
Nessus ID : 11268
Warning found on port netbios-ns (137/udp)
. The following 7 NetBIOS names have been gathered :
MERLIN = This is the computer name registered for workstation services by a WINS client.
MERLIN = This is the current logged in user registered for this workstation.
MERLIN
__MSBROWSE__
HACK = Workgroup / Domain name
HACK
HACK = Workgroup / Domain name (part of the Browser elections)
. This SMB server seems to be a SAMBA server (this is not a security
risk, this is for your information). This can be told because this server
claims to have a null MAC address
If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.
Risk factor : Medium
CVE : CAN-1999-0621
Nessus ID : 10150
Vulnerability found on port general/icmp
Warning found on port general/icmp
The remote host answers to an ICMP timestamp request. This allows an attacker
to know the date which is set on your machine.
This may help him to defeat all your time based authentication protocols.
Solution : filter out the ICMP timestamp requests (13), and the outgoing ICMP
timestamp replies (14).
Risk factor : Low
CVE : CAN-1999-0524
Nessus ID : 10114
Information found on port general/udp
For your information, here is the traceroute to 192.168.123.6 :
?
192.168.123.6
Nessus ID : 10287