Summary

This document reports on the results of an automatic security scan. The report first summarises the results found. Then, for each host, the report describes every issue found. Please consider the advice given in each description, in order to rectify the issue.

Scan started: Thu Aug 5 07:52:45 2010
Scan ended: Thu Aug 5 07:56:59 2010

Host Summary

Host High Medium Low Log False Positive
1.1.1.1 1 2 20 8 0
Total: 1 1 2 20 8 0

Results per Host

Host 1.1.1.1

Scanning of this host started at: Thu Aug 5 07:52:46 2010
Number of results: 31

Port Summary for Host 1.1.1.1

Service (Port) Threat Level
microsoft-ds (445/tcp) High
netbios-ns (137/udp) Medium
vnc-http (5800/tcp) Medium
general/tcp Low
netbios-ssn (139/tcp) Low
ntp (123/udp) Low
ssh (22/tcp) Low
vnc (5900/tcp) Low
epmap (135/tcp) Log
general/CPE Log

Security Issues for Host 1.1.1.1

microsoft-ds (445/tcp)
High (CVSS: 7.1)
NVT: Vulnerabilities in SMB Could Allow Remote Code Execution (958687) - Remote (OID: 1.3.6.1.4.1.25623.1.0.900233)

  Overview: This host has critical security update missing according to
  Microsoft Bulletin MS09-001.

  Vulnerability Insight:
  The issue is due to the way Server Message Block (SMB) Protocol software
  handles specially crafted SMB packets.

  Impact: Successful exploitation could allow remote unauthenticated attackers
  to cause denying the service by sending a specially crafted network message
  to a system running the server service.

  Impact Level: System/Network

  Affected Software/OS:
  Microsoft Windows 2K Service Pack 4 and prior.
  Microsoft Windows XP Service Pack 3 and prior.
  Microsoft Windows 2003 Service Pack 2 and prior.

  Fix: Run Windows Update and update the listed hotfixes or download and
  update mentioned hotfixes in the advisory from the below link,
  http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx

  References:
  http://www.milw0rm.com/exploits/6463
  http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx

  CVSS Score:
    CVSS Base Score     : 7.1 (AV:N/AC:M/Au:NR/C:N/I:N/A:C)
    CVSS Temporal Score : 5.6
  Risk factor : High
CVE : CVE-2008-4114, CVE-2008-4834, CVE-2008-4835
BID : 31179
netbios-ns (137/udp)
Medium
NVT: Using NetBIOS to retrieve information from a Windows host (OID: 1.3.6.1.4.1.25623.1.0.10150)
The following 4 NetBIOS names have been gathered :
 POLYNOE         = This is the computer name registered for workstation services by a WINS↵
 client.
 INTEVATION      = Workgroup / Domain name
 POLYNOE         = Computer name
 INTEVATION      = Workgroup / Domain name (part of the Browser elections)
The remote host has the following MAC address on its adapter :
   00:11:2f:0e:75:11

If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.

Risk factor : Medium
CVE : CAN-1999-0621
vnc-http (5800/tcp)
Medium
NVT: Check for VNC HTTP (OID: 1.3.6.1.4.1.25623.1.0.10758)
The remote server is running VNC.
VNC permits a console to be displayed remotely.

Solution: Disable VNC access from the network by 
using a firewall, or stop VNC service if not needed.

Risk factor : Medium
general/tcp
Low
NVT: OS fingerprinting (OID: 1.3.6.1.4.1.25623.1.0.102002)
ICMP based OS fingerprint results: 

Microsoft Windows 2003 Server Enterprise Edition (accuracy 100%)
Microsoft Windows 2003 Server Standard Edition (accuracy 100%)
Microsoft Windows XP SP2 (accuracy 100%)


general/tcp
Low
NVT: Determine OS and list of installed packages via SSH login (OID: 1.3.6.1.4.1.25623.1.0.50282)
System identifier unknown: "bash: uname: command not found
"
Therefore no local security checks applied (missing list of installed packages) though ssh↵
 login provided and works
general/tcp
Low
NVT: Checks for open tcp ports (OID: 1.3.6.1.4.1.25623.1.0.900239)
Open TCP ports are 445, 5900, 22, 135, 5800, 139
general/tcp
Low
NVT: SLAD Fetch Results (OID: 1.3.6.1.4.1.25623.1.0.90003)
Slad_Fetch has no Result polled.
general/tcp
Low
NVT: SLAD Run (OID: 1.3.6.1.4.1.25623.1.0.90002)
ChkRootKit: The Plugin was not present on target system, but selected to execute.
ClamAV: The Plugin was not present on target system, but selected to execute.
Hardware MB sensors: The Plugin was not present on target system, but selected to execute.↵

Hardware MB sensors: The Plugin was not present on target system, but selected to execute.↵

LSOF: The Plugin was not present on target system, but selected to execute.
MBSA: The Plugin was not present on target system, but selected to execute.
Netstat: The Plugin was not present on target system, but selected to execute.
Ovaldi: The Plugin was not present on target system, but selected to execute.
Tiger: The Plugin was not present on target system, but selected to execute.
Tripwire HIDS: The Plugin was not present on target system, but selected to execute.
SFC: The Plugin was not present on target system, but selected to execute.
Snmptrapd: The Plugin was not present on target system, but selected to execute.
Snort: The Plugin was not present on target system, but selected to execute.
ssh vulnkey: The Plugin was not present on target system, but selected to execute.
SyslogWatch: The Plugin was not present on target system, but selected to execute.

general/tcp
Low
NVT: TCP timestamps (OID: 1.3.6.1.4.1.25623.1.0.80091)
Synopsis :

The remote service implements TCP timestamps.

Description :

The remote host implements TCP timestamps, as defined by RFC1323.
A side effect of this feature is that the uptime of the remote 
host can sometimes be computed.

See also :

http://www.ietf.org/rfc/rfc1323.txt

Risk factor : 

None
general/tcp
Low
NVT: Traceroute (OID: 1.3.6.1.4.1.25623.1.0.51662)
Here is the route from 192.168.11.233 to 1.1.1.1

192.168.11.233
1.1.1.1

microsoft-ds (445/tcp)
Low
NVT: SMB on port 445 (OID: 1.3.6.1.4.1.25623.1.0.11011)
A CIFS server is running on this port
microsoft-ds (445/tcp)
Low
NVT: SMB log in (OID: 1.3.6.1.4.1.25623.1.0.10394)
It was not possible to log into the remote host using user defined
login/password combinations :

microsoft-ds (445/tcp)
Low
NVT: SMB NativeLanMan (OID: 1.3.6.1.4.1.25623.1.0.102011)
Overview:
It is possible to extract OS, domain and SMB server information
from the Session Setup AndX Response packet which is generated
during NTLM authentication.
Detected SMB workgroup: INTEVATION
Detected SMB server: Windows 2000 LAN Manager
Detected OS: Windows 5.1

netbios-ssn (139/tcp)
Low
NVT: SMB on port 445 (OID: 1.3.6.1.4.1.25623.1.0.11011)
An SMB server is running on this port
ntp (123/udp)
Low
NVT: NTP read variables (OID: 1.3.6.1.4.1.25623.1.0.10884)
  A NTP (Network Time Protocol) server is listening on this port.

  Risk factor : Low
ssh (22/tcp)
Low
NVT: Services (OID: 1.3.6.1.4.1.25623.1.0.10330)
An ssh server is running on this port
ssh (22/tcp)
Low
NVT: SSH Authorization (OID: 1.3.6.1.4.1.25623.1.0.90022)
It was possible to login using the SSH credentials supplied.
Hence local security check are enabled.
ssh (22/tcp)
Low
NVT: SSH Server type and version (OID: 1.3.6.1.4.1.25623.1.0.10267)
Remote SSH version : SSH-2.0-OpenSSH_5.4

Remote SSH supported authentication : publickey,password,keyboard-interactive


ssh (22/tcp)
Low
NVT: SSH Protocol Versions Supported (OID: 1.3.6.1.4.1.25623.1.0.100259)

Overview:
The remote SSH Server supports the following SSH Protocol Versions:

1.99
2.0

SSHv2 Fingerprint: 59:10:f9:5c:e6:dd:3f:21:2b:b2:c8:68:03:f5:1e:55


Risk factor : None

vnc (5900/tcp)
Low
NVT: Check for VNC (OID: 1.3.6.1.4.1.25623.1.0.10342)
Synopsis :

The remote host is running a remote display software (VNC)

Description :

The remote server is running VNC, a software which ermits a 
console to be displayed remotely.

This allows authenticated users of the remote host to take its 
control remotely.

Solution : 

Make sure the use of this software is done in accordance with your
corporate security policy, filter incoming traffic to this port.

Risk factor : 

None

Plugin output :
The version of the VNC protocol is : RFB 003.003

vnc (5900/tcp)
Low
NVT: VNC security types (OID: 1.3.6.1.4.1.25623.1.0.19288)
The remote VNC server chose security type #2 (VNC authentication)
vnc-http (5800/tcp)
Low
NVT: Services (OID: 1.3.6.1.4.1.25623.1.0.10330)
A web server is running on this port
vnc-http (5800/tcp)
Low
NVT: w3af (NASL wrapper) (OID: 1.3.6.1.4.1.25623.1.0.80109)
Here is the w3af report:
[ Thu Aug  5 07:55:11 2010 - information ] Auto-enabling plugin: grep.error500
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ] plugins
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     audit sqli, xss
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     audit config sqli
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     audit config xss
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set checkStored True
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set numberOfChecks 3
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ] plugins
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     grep error500
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ] plugins
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     output textFile, console, gtkOutput
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     output config textFile
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set verbose False
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set fileName /tmp/openvas-w3af-1.1.↵
1.1-5800.rep
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set httpFileName /tmp/openvas-w3af-↵
1.1.1.1-5800.http
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set showCaller False
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     output config console
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set verbose False
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     output config gtkOutput
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ] plugins
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     discovery yahooSiteExplorer
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     discovery config yahooSiteExplorer
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         set resultLimit 300
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]         back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     back
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ] target
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     set target http://1.1.1.1:5800
[ Thu Aug  5 07:55:11 2010 - Enabled plugins ]     back
[ Thu Aug  5 07:55:11 2010 - error ] There is no point in searching yahoo site explorer fo↵
r site: "1.1.1.1" . Yahoo doesnt index private pages.
[ Thu Aug  5 07:55:11 2010 - information ] Found 1 URLs and 1 different points of injectio↵
n.
[ Thu Aug  5 07:55:11 2010 - information ] The list of URLs is:
[ Thu Aug  5 07:55:11 2010 - information ] - http://1.1.1.1:5800
[ Thu Aug  5 07:55:11 2010 - information ] The list of fuzzable requests is:
[ Thu Aug  5 07:55:11 2010 - information ] - http://1.1.1.1:5800 | Method: GET
[ Thu Aug  5 07:55:11 2010 - information ] Finished scanning process.
[ Thu Aug  5 07:55:12 2010 - console ] termios error: (25, 'Inappropriate ioctl for device↵
')
[ Thu Aug  5 07:55:12 2010 - console ] 
[ Thu Aug  5 07:55:12 2010 - console ] termios error: (25, 'Inappropriate ioctl for device↵
')
[ Thu Aug  5 07:55:12 2010 - console ] 
Bye.


epmap (135/tcp)
Log
NVT: (OID: 0)
Open port.
general/CPE
Log
NVT: CPE Inventory (OID: 1.3.6.1.4.1.25623.1.0.810002)
No CPE identities could be determined.
general/tcp
Log
NVT: Information about the scan (OID: 1.3.6.1.4.1.25623.1.0.19506)
Information about this scan : 

OpenVAS version : 3.1.0.rc1.
Plugin feed version : 201008041240
Type of plugin feed : Greenbone Security Feed
Scanner IP : 192.168.11.233
Port scanner(s) : nmap 
Port range : default
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report Verbosity : 1
Safe checks : yes
Max hosts : 20
Max checks : 4
Scan Start Date : 2010/8/5 7:52
Scan duration : 253 sec

microsoft-ds (445/tcp)
Log
NVT: (OID: 0)
Open port.
netbios-ssn (139/tcp)
Log
NVT: (OID: 0)
Open port.
ssh (22/tcp)
Log
NVT: (OID: 0)
Open port.
vnc (5900/tcp)
Log
NVT: (OID: 0)
Open port.
vnc-http (5800/tcp)
Log
NVT: (OID: 0)
Open port.
This file was automatically generated.