Nessus Scan Report
------------------
SUMMARY
- Number of hosts which were alive during the test : 1
- Number of security holes found : 0
- Number of security warnings found : 1
- Number of security notes found : 29
TESTED HOSTS
68.224.169.136 (Security warnings found)
DETAILS
+ 68.224.169.136 :
. List of open ports :
o ftp (21/tcp) (Security notes found)
o ssh (22/tcp) (Security notes found)
o time (37/tcp) (Security notes found)
o domain (53/tcp) (Security notes found)
o http (80/tcp) (Security notes found)
o ident (113/tcp) (Security notes found)
o ipp (631/tcp) (Security notes found)
o x11 (6000/tcp) (Security notes found)
o websm (9090/tcp)
o unknown (14534/tcp) (Security notes found)
o domain (53/udp) (Security warnings found)
o general/tcp (Security notes found)
o general/udp (Security notes found)
. Information found on port ftp (21/tcp)
An FTP server is running on this port.
Here is its banner :
220 ProFTPD 1.2.10 Server (ProFTPD Default Installation) [68.224.169.136]
. Information found on port ftp (21/tcp)
Synopsis :
An FTP server is listening on this port
Description :
It is possible to obtain the banner of the remote FTP server
by connecting to the remote port.
Risk factor :
None
Plugin output :
The remote FTP banner is :
220 ProFTPD 1.2.10 Server (ProFTPD Default Installation) [68.224.169.136]
. Information found on port ftp (21/tcp)
Synopsis :
The remote FTP server is affected by multiple vulnerabilities.
Description :
The remote host is using ProFTPD, a free FTP server for Unix and
Linux.
According to its banner, the version of ProFTPD installed on the
remote host suffers from multiple format string vulnerabilities, one
involving the 'ftpshut' utility and the other in mod_sql's
'SQLShowInfo' directive. Exploitation of either requires involvement
on the part of a site administrator and can lead to information
disclosure, denial of service, and even a compromise of the affected
system.
See also :
http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2
Solution :
Upgrade to ProFTPD version 1.3.0rc2 or later.
Risk factor :
Low / CVSS Base Score : 3
(AV:R/AC:H/Au:R/C:P/A:P/I:P/B:N)
CVE : CVE-2005-2390
BID : 14380, 14381
Other references : OSVDB:18270, OSVDB:18271
. Information found on port ssh (22/tcp)
An ssh server is running on this port
. Information found on port ssh (22/tcp)
Remote SSH version : SSH-1.99-OpenSSH_4.2
Remote SSH supported authentication :
publickey,password,keyboard-interactive
. Information found on port ssh (22/tcp)
The remote SSH daemon supports the following versions of the
SSH protocol :
. 1.33
. 1.5
. 1.99
. 2.0
SSHv1 host key fingerprint : f3:74:89:7a:2c:5f:b9:28:25:e5:f7:27:d2:66:8a:fe
SSHv2 host key fingerprint : 28:1b:8f:17:16:93:76:6f:38:e4:74:dc:92:da:e8:76
. Information found on port ssh (22/tcp)
Synopsis :
The remote service offers an insecure cryptographic protocol
Description :
The remote SSH daemon supports connections made
using the version 1.33 and/or 1.5 of the SSH protocol.
These protocols are not completely cryptographically
safe so they should not be used.
Solution :
Disable compatiblity with version 1 of the protocol.
Risk factor :
Low / CVSS Base Score : 3
(AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C)
CVE : CVE-2001-0361
BID : 2344
. Information found on port time (37/tcp)
A time server seems to be running on this port
. Information found on port domain (53/tcp)
A DNS server is running on this port. If you do not use it, disable it.
Risk factor : Low
. Information found on port http (80/tcp)
A web server is running on this port
. Information found on port http (80/tcp)
The following directories were discovered:
/cgi-bin, /classes, /css, /icons, /js, /manual, /scripts, /Dvd_Rips, /roms,
/wallpapers
While this is not, in and of itself, a bug, you should manually inspect
these directories to ensure that they are in compliance with company
security standards
Other references : OWASP:OWASP-CM-006
. Information found on port http (80/tcp)
The remote web server type is :
Apache/1.3.33 (Unix) mod_ssl/2.8.24 OpenSSL/0.9.7g PHP/5.2.0
Solution : You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
. Information found on port http (80/tcp)
Synopsis :
Debugging functions are enabled on the remote HTTP server.
Description :
The remote webserver supports the TRACE and/or TRACK methods. TRACE and
TRACK
are HTTP methods which are used to debug web server connections.
It has been shown that servers supporting this method are subject to
cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when
used in conjunction with various weaknesses in browsers.
An attacker may use this flaw to trick your legitimate web users to give
him their credentials.
Solution :
Disable these methods.
See also :
http://www.kb.cert.org/vuls/id/867593
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin output :
Solution :
Add the following lines for each virtual host in your configuration file :
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
CVE : CVE-2004-2320
BID : 9506, 9561, 11604
. Information found on port http (80/tcp)
Synopsis :
The remote web server contains a 'robots.txt' file.
Description :
The remote host contains a file named 'robots.txt' that is intended to
prevent web 'robots' from visiting certain directories in a web site for
maintenance or indexing purposes. A malicious user may also be able to
use the contents of this file to learn of sensitive documents or
directories on the affected site and either retrieve them directly or
target them for other attacks.
See also :
http://www.robotstxt.org/wc/exclusion.html
Solution :
Review the contents of the site's robots.txt file, use Robots META tags
instead of entries in the robots.txt file, and/or adjust the web
server's access controls to limit access to sensitive material.
Risk factor :
None
Contents of robots.txt :
User-Agent: *
Disallow: /mp3/
Disallow: /Dvd_Rips/
Disallow: /xxx/
Disallow: /roms/
Disallow: /wallpapers/
Disallow: /*.mp3
Disallow: /Music_Vids/
Disallow: ../cgi-bin/
Disallow: /cgi-bin/
. Information found on port ident (113/tcp)
An identd server is running on this port
. Information found on port ident (113/tcp)
The remote host is running an ident (also known as 'auth') daemon.
The 'ident' service provides sensitive information to potential
attackers. It mainly says which accounts are running which services.
This helps attackers to focus on valuable services (those
owned by root). If you do not use this service, disable it.
Solution : Under Unix systems, comment out the 'auth' or 'ident'
line in /etc/inetd.conf and restart inetd
Risk factor : Low
CVE : CVE-1999-0629
. Information found on port ipp (631/tcp)
A web server is running on this port
. Information found on port ipp (631/tcp)
The remote web server type is :
CUPS/1.1
. Information found on port x11 (6000/tcp)
Synopsis :
A X11 server is listening on the remote host
Description :
The remote host is running a X11 server. X11 is a client-server protocol
which can be used to display graphical applications running on a given
host on a remote client.
Since the X11 traffic is not ciphered, it is possible for an attacker
to eavesdrop on the connection.
Solution :
Restrict access to this port. If the X11 client/server facility is not
used, disable TCP entirely.
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:H/Au:R/C:P/A:N/I:N/B:C)
Plugin output :
X11 Version : 11.0
. Information found on port unknown (14534/tcp)
A web server is running on this port
. Information found on port unknown (14534/tcp)
Synopsis :
Remote web server does not reply with 404 error code.
Description :
This web server is [mis]configured in that it does not return
'404 Not Found' error codes when a non-existent file is requested,
perhaps returning a site map, search page or authentication page
instead.
Nessus enabled some counter measures for that, however they might
be insufficient. If a great number of security holes are produced
for this port, they might not all be accurate
Risk factor :
None
. Information found on port unknown (14534/tcp)
The remote web server type is :
Indy/9.00.10
. Warning found on port domain (53/udp)
Synopsis :
The remote name server allows recursive queries to be performed
by the host running nessusd.
Description :
It is possible to query the remote name server for third party names.
If this is your internal nameserver, then forget this warning.
If you are probing a remote nameserver, then it allows anyone
to use it to resolve third parties names (such as www.nessus.org).
This allows hackers to do cache poisoning attacks against this
nameserver.
If the host allows these recursive queries via UDP,
then the host can be used to 'bounce' Denial of Service attacks
against another network or system.
See also :
http://www.cert.org/advisories/CA-1997-22.html
Solution :
Restrict recursive queries to the hosts that should
use this nameserver (such as those of the LAN connected to it).
If you are using bind 8, you can do this by using the instruction
'allow-recursion' in the 'options' section of your named.conf
If you are using bind 9, you can define a grouping of internal addresses
using the 'acl' command
Then, within the options block, you can explicitly state:
'allow-recursion { hosts_defined_in_acl }'
For more info on Bind 9 administration (to include recursion), see:
http://www.nominum.com/content/documents/bind9arm.pdf
If you are using another name server, consult its documentation.
Risk factor :
Medium / CVSS Base Score : 4
(AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I)
CVE : CVE-1999-0024
BID : 136, 678
. Information found on port domain (53/udp)
A DNS server is running on this port. If you do not use it, disable it.
Risk factor : Low
. Information found on port domain (53/udp)
The remote name server could be fingerprinted as being : ISC BIND 9.2.3
. Information found on port domain (53/udp)
Synopsis :
Remote DNS server is vulnerable to Cache Snooping attacks.
Description :
The remote DNS server answers to queries for third party domains which do
not have the recursion bit set.
This may allow a remote attacker to determine which domains have recently
been resolved via this name server, and therefore which hosts have been
recently visited.
For instance, if an attacker was interested in whether your company utilizes
the online services of a particular financial institution, they would
be able to use this attack to build a statistical model regarding
company usage of aforementioned financial institution. Of course,
the attack can also be used to find B2B partners, web-surfing patterns,
external mail servers, and more...
For a much more detailed discussion of the potential risks of allowing
DNS cache information to be queried anonymously, please see:
http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdf
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
. Information found on port general/tcp
68.224.169.136 resolves as wsip-68-224-169-136.sd.sd.cox.net.
. Information found on port general/tcp
Information about this scan :
Nessus version : 2.2.8 (Nessus 2.2.9 is available - consider upgrading)
Plugin feed version : 200612231215
Type of plugin feed : Registered (7 days delay)
Scanner IP : 192.168.2.28
Port scanner(s) : nessus_tcp_scanner
Port range : 1-15000
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report Verbosity : 1
Safe checks : yes
Max hosts : 20
Max checks : 4
Scan Start Date : 2006/12/24 20:16
Scan duration : 808 sec
. Information found on port general/tcp
The following ports were open at the beginning of the scan but are now
closed:
Port 14534 was detected as being open but is now closed.
This might be an availability problem related which might be due to the
following reasons :
- The remote host is now down, either because a user turned it off during
the scan
- A network outage has been experienced during the scan, and the remote
network cannot be reached from the Vulnerability Scanner any more
- This Vulnerability Scanner has been blacklisted by the system
administrator
or by automatic intrusion detection/prevention systems which have detected
the
vulnerability assessment.
In any case, the audit of the remote host might be incomplete and may need
to
be done again
. Information found on port general/udp
For your information, here is the traceroute from 192.168.2.28 to
68.224.169.136 :
192.168.2.28
192.168.2.1
192.168.254.254
151.213.32.46
151.213.31.50
151.213.30.238
151.213.31.63
12.118.224.21
12.123.210.17
12.122.10.46
12.122.10.14
12.122.12.2
12.123.145.189
12.118.229.14
68.6.8.7
68.6.11.45
68.224.169.136
------------------------------------------------------
This file was generated by the Nessus Security Scanner