SummaryThis document reports on the results of an automatic security scan. The report first summarises the results found. Then, for each host, the report describes every issue found. Please consider the advice given in each description, in order to rectify the issue.
Host Summary
Results per HostHost 1.1.1.1
Port Summary for Host 1.1.1.1
Security Issues for Host 1.1.1.1microsoft-ds (445/tcp)
High
(CVSS: 7.1)
NVT:
Vulnerabilities in SMB Could Allow Remote Code Execution (958687) - Remote
(OID: 1.3.6.1.4.1.25623.1.0.900233)
Overview: This host has critical security update missing according to Microsoft Bulletin MS09-001. Vulnerability Insight: The issue is due to the way Server Message Block (SMB) Protocol software handles specially crafted SMB packets. Impact: Successful exploitation could allow remote unauthenticated attackers to cause denying the service by sending a specially crafted network message to a system running the server service. Impact Level: System/Network Affected Software/OS: Microsoft Windows 2K Service Pack 4 and prior. Microsoft Windows XP Service Pack 3 and prior. Microsoft Windows 2003 Service Pack 2 and prior. Fix: Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx References: http://www.milw0rm.com/exploits/6463 http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx CVSS Score: CVSS Base Score : 7.1 (AV:N/AC:M/Au:NR/C:N/I:N/A:C) CVSS Temporal Score : 5.6 Risk factor : High CVE : CVE-2008-4114, CVE-2008-4834, CVE-2008-4835 BID : 31179 netbios-ns (137/udp)
Medium
NVT:
Using NetBIOS to retrieve information from a Windows host
(OID: 1.3.6.1.4.1.25623.1.0.10150)
The following 4 NetBIOS names have been gathered : POLYNOE = This is the computer name registered for workstation services by a WINS↵ client. INTEVATION = Workgroup / Domain name POLYNOE = Computer name INTEVATION = Workgroup / Domain name (part of the Browser elections) The remote host has the following MAC address on its adapter : 00:11:2f:0e:75:11 If you do not want to allow everyone to find the NetBios name of your computer, you should filter incoming traffic to this port. Risk factor : Medium CVE : CAN-1999-0621 vnc-http (5800/tcp)
Medium
NVT:
Check for VNC HTTP
(OID: 1.3.6.1.4.1.25623.1.0.10758)
The remote server is running VNC. VNC permits a console to be displayed remotely. Solution: Disable VNC access from the network by using a firewall, or stop VNC service if not needed. Risk factor : Medium general/tcp
Low
NVT:
OS fingerprinting
(OID: 1.3.6.1.4.1.25623.1.0.102002)
ICMP based OS fingerprint results: Microsoft Windows 2003 Server Enterprise Edition (accuracy 100%) Microsoft Windows 2003 Server Standard Edition (accuracy 100%) Microsoft Windows XP SP2 (accuracy 100%) general/tcp
Low
NVT:
Determine OS and list of installed packages via SSH login
(OID: 1.3.6.1.4.1.25623.1.0.50282)
System identifier unknown: "bash: uname: command not found " Therefore no local security checks applied (missing list of installed packages) though ssh↵ login provided and works general/tcp
Low
NVT:
Checks for open tcp ports
(OID: 1.3.6.1.4.1.25623.1.0.900239)
Open TCP ports are 445, 5900, 22, 135, 5800, 139 general/tcp
Low
NVT:
SLAD Fetch Results
(OID: 1.3.6.1.4.1.25623.1.0.90003)
Slad_Fetch has no Result polled. general/tcp
Low
NVT:
SLAD Run
(OID: 1.3.6.1.4.1.25623.1.0.90002)
ChkRootKit: The Plugin was not present on target system, but selected to execute. ClamAV: The Plugin was not present on target system, but selected to execute. Hardware MB sensors: The Plugin was not present on target system, but selected to execute.↵ Hardware MB sensors: The Plugin was not present on target system, but selected to execute.↵ LSOF: The Plugin was not present on target system, but selected to execute. MBSA: The Plugin was not present on target system, but selected to execute. Netstat: The Plugin was not present on target system, but selected to execute. Ovaldi: The Plugin was not present on target system, but selected to execute. Tiger: The Plugin was not present on target system, but selected to execute. Tripwire HIDS: The Plugin was not present on target system, but selected to execute. SFC: The Plugin was not present on target system, but selected to execute. Snmptrapd: The Plugin was not present on target system, but selected to execute. Snort: The Plugin was not present on target system, but selected to execute. ssh vulnkey: The Plugin was not present on target system, but selected to execute. SyslogWatch: The Plugin was not present on target system, but selected to execute. general/tcp
Low
NVT:
TCP timestamps
(OID: 1.3.6.1.4.1.25623.1.0.80091)
Synopsis : The remote service implements TCP timestamps. Description : The remote host implements TCP timestamps, as defined by RFC1323. A side effect of this feature is that the uptime of the remote host can sometimes be computed. See also : http://www.ietf.org/rfc/rfc1323.txt Risk factor : None general/tcp
Low
NVT:
Traceroute
(OID: 1.3.6.1.4.1.25623.1.0.51662)
Here is the route from 192.168.11.233 to 1.1.1.1 192.168.11.233 1.1.1.1 microsoft-ds (445/tcp)
Low
NVT:
SMB on port 445
(OID: 1.3.6.1.4.1.25623.1.0.11011)
A CIFS server is running on this port microsoft-ds (445/tcp)
Low
NVT:
SMB log in
(OID: 1.3.6.1.4.1.25623.1.0.10394)
It was not possible to log into the remote host using user defined login/password combinations : microsoft-ds (445/tcp)
Low
NVT:
SMB NativeLanMan
(OID: 1.3.6.1.4.1.25623.1.0.102011)
Overview: It is possible to extract OS, domain and SMB server information from the Session Setup AndX Response packet which is generated during NTLM authentication. Detected SMB workgroup: INTEVATION Detected SMB server: Windows 2000 LAN Manager Detected OS: Windows 5.1 netbios-ssn (139/tcp)
Low
NVT:
SMB on port 445
(OID: 1.3.6.1.4.1.25623.1.0.11011)
An SMB server is running on this port ntp (123/udp)
Low
NVT:
NTP read variables
(OID: 1.3.6.1.4.1.25623.1.0.10884)
A NTP (Network Time Protocol) server is listening on this port. Risk factor : Low ssh (22/tcp)
Low
NVT:
Services
(OID: 1.3.6.1.4.1.25623.1.0.10330)
An ssh server is running on this port ssh (22/tcp)
Low
NVT:
SSH Authorization
(OID: 1.3.6.1.4.1.25623.1.0.90022)
It was possible to login using the SSH credentials supplied. Hence local security check are enabled. ssh (22/tcp)
Low
NVT:
SSH Server type and version
(OID: 1.3.6.1.4.1.25623.1.0.10267)
Remote SSH version : SSH-2.0-OpenSSH_5.4 Remote SSH supported authentication : publickey,password,keyboard-interactive ssh (22/tcp)
Low
NVT:
SSH Protocol Versions Supported
(OID: 1.3.6.1.4.1.25623.1.0.100259)
Overview: The remote SSH Server supports the following SSH Protocol Versions: 1.99 2.0 SSHv2 Fingerprint: 59:10:f9:5c:e6:dd:3f:21:2b:b2:c8:68:03:f5:1e:55 Risk factor : None vnc (5900/tcp)
Low
NVT:
Check for VNC
(OID: 1.3.6.1.4.1.25623.1.0.10342)
Synopsis : The remote host is running a remote display software (VNC) Description : The remote server is running VNC, a software which ermits a console to be displayed remotely. This allows authenticated users of the remote host to take its control remotely. Solution : Make sure the use of this software is done in accordance with your corporate security policy, filter incoming traffic to this port. Risk factor : None Plugin output : The version of the VNC protocol is : RFB 003.003 vnc (5900/tcp)
Low
NVT:
VNC security types
(OID: 1.3.6.1.4.1.25623.1.0.19288)
The remote VNC server chose security type #2 (VNC authentication) vnc-http (5800/tcp)
Low
NVT:
Services
(OID: 1.3.6.1.4.1.25623.1.0.10330)
A web server is running on this port vnc-http (5800/tcp)
Low
NVT:
w3af (NASL wrapper)
(OID: 1.3.6.1.4.1.25623.1.0.80109)
Here is the w3af report: [ Thu Aug 5 07:55:11 2010 - information ] Auto-enabling plugin: grep.error500 [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] plugins [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] audit sqli, xss [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] audit config sqli [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] audit config xss [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set checkStored True [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set numberOfChecks 3 [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] plugins [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] grep error500 [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] plugins [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] output textFile, console, gtkOutput [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] output config textFile [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set verbose False [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set fileName /tmp/openvas-w3af-1.1.↵ 1.1-5800.rep [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set httpFileName /tmp/openvas-w3af-↵ 1.1.1.1-5800.http [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set showCaller False [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] output config console [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set verbose False [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] output config gtkOutput [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] plugins [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] discovery yahooSiteExplorer [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] discovery config yahooSiteExplorer [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set resultLimit 300 [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] target [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] set target http://1.1.1.1:5800 [ Thu Aug 5 07:55:11 2010 - Enabled plugins ] back [ Thu Aug 5 07:55:11 2010 - error ] There is no point in searching yahoo site explorer fo↵ r site: "1.1.1.1" . Yahoo doesnt index private pages. [ Thu Aug 5 07:55:11 2010 - information ] Found 1 URLs and 1 different points of injectio↵ n. [ Thu Aug 5 07:55:11 2010 - information ] The list of URLs is: [ Thu Aug 5 07:55:11 2010 - information ] - http://1.1.1.1:5800 [ Thu Aug 5 07:55:11 2010 - information ] The list of fuzzable requests is: [ Thu Aug 5 07:55:11 2010 - information ] - http://1.1.1.1:5800 | Method: GET [ Thu Aug 5 07:55:11 2010 - information ] Finished scanning process. [ Thu Aug 5 07:55:12 2010 - console ] termios error: (25, 'Inappropriate ioctl for device↵ ') [ Thu Aug 5 07:55:12 2010 - console ] [ Thu Aug 5 07:55:12 2010 - console ] termios error: (25, 'Inappropriate ioctl for device↵ ') [ Thu Aug 5 07:55:12 2010 - console ] Bye. epmap (135/tcp)
Log
NVT:
(OID: 0)
Open port. general/CPE
Log
NVT:
CPE Inventory
(OID: 1.3.6.1.4.1.25623.1.0.810002)
No CPE identities could be determined. general/tcp
Log
NVT:
Information about the scan
(OID: 1.3.6.1.4.1.25623.1.0.19506)
Information about this scan : OpenVAS version : 3.1.0.rc1. Plugin feed version : 201008041240 Type of plugin feed : Greenbone Security Feed Scanner IP : 192.168.11.233 Port scanner(s) : nmap Port range : default Thorough tests : no Experimental tests : no Paranoia level : 1 Report Verbosity : 1 Safe checks : yes Max hosts : 20 Max checks : 4 Scan Start Date : 2010/8/5 7:52 Scan duration : 253 sec microsoft-ds (445/tcp)
Log
NVT:
(OID: 0)
Open port. netbios-ssn (139/tcp)
Log
NVT:
(OID: 0)
Open port. ssh (22/tcp)
Log
NVT:
(OID: 0)
Open port. vnc (5900/tcp)
Log
NVT:
(OID: 0)
Open port. vnc-http (5800/tcp)
Log
NVT:
(OID: 0)
Open port.
This file was automatically generated.
|