Tenable Nessus Security Report Start Time: Sat May 05 17:31:40 2007 Finish Time: Sat May 05 18:29:37 2007 70.87.45.130 70.87.45.130 21 Open Ports, 99 Notes, 8 Warnings, 13 Holes. 70.87.45.130 [Return to top] pop3s (995/tcp) The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!Plugin ID : 15901 Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 A pop3 server is running on this portPlugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 Synopsis :A POP server is listening on the remote portDescription :The remote host is running a POP server. Solution: Disable this service if you do not use it.Risk Factor : NonePlugin output :Remote POP server banner :+OK POP3 vanity [cppop 20.0] at [70.87.45.130]Plugin ID : 10185 Synopsis :The remote service supports the use of weak SSL ciphers.Description :The remote host supports the use of SSL ciphers thatoffer either weak encryption or no encryption at all.See Also :http://www.openssl.org/docs/apps/ciphers.htmlSolution:Reconfigure the affected application if possible to avoid use of weak ciphers.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Here is a list of the SSL ciphers supported by the remote server :Export CiphersSSLv2EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export Low Strength Ciphers (excluding export, < 128-bit key)SSLv2DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key)SSLv2RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key)SSLv2DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are :{OpenSSL ciphername}Kx={key exchange}Au={authentication}Enc={symmetric encryption method}Mac={message authentication code}{export flag}Plugin ID : 21643imaps (993/tcp) The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!Plugin ID : 15901 Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 An IMAP server is running on this port through SSLPlugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 Synopsis :An IMAP server is running on the remote host.Description :An IMAP (Internet Message Access Protocol) server isinstalled and running on the remote host.Risk Factor :NonePlugin output :The remote imap server banner is :* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] localhost IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:32:56 -0500 (EST)Plugin ID : 11414 Synopsis :The remote service supports the use of weak SSL ciphers.Description :The remote host supports the use of SSL ciphers thatoffer either weak encryption or no encryption at all.See Also :http://www.openssl.org/docs/apps/ciphers.htmlSolution:Reconfigure the affected application if possible to avoid use of weak ciphers.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Here is a list of the SSL ciphers supported by the remote server :Export CiphersSSLv2EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export SSLv3EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Low Strength Ciphers (excluding export, < 128-bit key)SSLv2DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key)SSLv2RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key)SSLv2DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are :{OpenSSL ciphername}Kx={key exchange}Au={authentication}Enc={symmetric encryption method}Mac={message authentication code}{export flag}Plugin ID : 21643distinct (9999/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The following CGI have been discovered :Syntax : cginame (arguments [default value])/session.cgi (user [] pass [] app [admin] action [login] )Plugin ID : 10662 The remote web server type is :Apacheand the 'ServerTokens' directive is ProductOnlyApache does not permit to hide the server type.Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.1SSL : noPipelining : yesKeep-Alive : yesOptions allowed : (Not implemented)Headers :Date: Sat, 05 May 2007 21:45:04 GMTServer: ApacheKeep-Alive: timeout=15, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlcharset=utf-8Plugin ID : 24260 Synopsis :The remote web server itself is prone to cross-site scripting attacks. Description :The remote host is running a web server that fails to adequatelysanitize request strings of Javascript. By exploiting this flaw, anattacker may be able to cause arbitrary HTML and script code to beexecuted in a user's browser within the security context of the affectedsite. Solution: Contact the vendor for a patch or upgrade.Risk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :The request string used to detect this flaw was:/?< DEFANGED_script >cross_site_scripting.nasl< /DEFANGED_script >CVE : CVE-2002-1060, CVE-2005-2453, CVE-2006-1681, CVE-2002-1060, CVE-2005-2453, CVE-2006-1681BID : 5305, 7344, 7353, 8037, 14473, 17408, 5305, 7344, 7353, 8037, 14473, 17408Plugin ID : 10815mysql (3306/tcp) Port is openPlugin ID : 11219 Synopsis :A Database server is listening on the remote port.Description :The remote host is running MySQL, an open-source Database server.The remote database access is restricted and configured to rejectaccess from not allowed IPs. Therefor it was not possible to extractits version number.Risk Factor :NonePlugin ID : 10719imap (143/tcp) Port is openPlugin ID : 11219 An IMAP server is running on this portPlugin ID : 10330 Synopsis :An IMAP server is running on the remote host.Description :An IMAP (Internet Message Access Protocol) server isinstalled and running on the remote host.Risk Factor :NonePlugin output :The remote imap server banner is :* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] vanity.twisted-delusions.net IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:33:04 -0500 (EST)Plugin ID : 11414sunrpc (111/tcp) Port is openPlugin ID : 11219pop3 (110/tcp) The remote pop3 server is vulnerable to the followingbuffer overflow :USER testPASS This *may* allow an attacker to execute arbitrary commandsas root on the remote POP3 server.Solution: contact your vendor, inform it of thisvulnerability, and ask for a patchRisk Factor : HighCVE : CVE-1999-1511BID : 791Plugin ID : 10325 Port is openPlugin ID : 11219 A pop3 server is running on this portPlugin ID : 10330 Synopsis :A POP server is listening on the remote portDescription :The remote host is running a POP server. Solution: Disable this service if you do not use it.Risk Factor : NonePlugin output :Remote POP server banner :+OK AVG POP3 Proxy Server 7.5.460/7.5.467 [269.6.4/790]Plugin ID : 10185http (80/tcp) The remote host is using a version of OpenSSL which isolder than 0.9.6m or 0.9.7dThere are several bug in this version of OpenSSL which may allowan attacker to cause a denial of service against the remote host.Nessus solely relied on the banner of the remote hostto issue this warningSolution: Upgrade to version 0.9.6m (0.9.7d) or newerRisk Factor : HighCVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112BID : 9899, 9899Other references : IAVA:2004-B-0006Plugin ID : 12110 It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 The remote host is using a version of OpenSSL which isolder than 0.9.6j or 0.9.7bThis version is vulnerable to a timing based attack which mayallow an attacker to guess the content of fixed data blocks andmay eventually be able to guess the value of the private RSA keyof the server.An attacker may use this implementation flaw to sniff thedata going to this host and decrypt some parts of it, as wellas impersonate your server and perform man in the middle attacks.Nessus solely relied on the banner of the remote hostto issue this warningSee Also : http://www.openssl.org/news/secadv_20030219.txthttp://lasecwww.epfl.ch/memo_ssl.shtmlhttp://eprint.iacr.org/2003/052/Solution: Upgrade to version 0.9.6j (0.9.7b) or newerRisk Factor : MediumCVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147BID : 6884, 7148, 6884, 7148Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024Plugin ID : 11267 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The remote web server type is :Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7aSolution: You can set the directive 'ServerTokens Prod' to limitthe information emanating from the server in its response headers.Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.1SSL : noPipelining : yesKeep-Alive : yesOptions allowed : GET, HEAD, OPTIONS, TRACEHeaders :Date: Sat, 05 May 2007 21:45:10 GMTServer: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7aLast-Modified: Fri, 13 Oct 2006 08:48:45 GMTETag: "c9c06a-b2c-452f52ed"Accept-Ranges: bytesContent-Length: 2860Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlcharset=iso-8859-5Plugin ID : 24260 Synopsis :The remote Apache server can be used to guess the presence of a given username on the remote host.Description :When configured with the 'UserDir' option, requests to URLs containing a tildefollowed by a username will redirect the user to a given subdirectory in theuser home.For instance, by default, requesting /~root/ displays the HTML contents from/root/public_html/.If the username requested does not exist, then Apache will reply with a different error code. Therefore, an attacker may exploit this vulnerabilityto guess the presence of a given user name on the remote host.Solution: In httpd.conf, set the 'UserDir' to 'disabled'.Risk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)CVE : CVE-2001-1013, CVE-2001-1013BID : 3335, 3335Plugin ID : 10766 Synopsis :Debugging functions are enabled on the remote HTTP server.Description :The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACKare HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject tocross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", whenused in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to givehim their credentials. Solution:Disable these methods.See Also :http://www.kb.cert.org/vuls/id/867593Risk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Solution: Add the following lines for each virtual host in your configuration file :RewriteEngine onRewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)RewriteRule .* - [F]CVE : CVE-2004-2320, CVE-2004-2320BID : 9506, 9561, 11604, 9506, 9561, 11604Plugin ID : 11213nbx-ser (2095/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : noPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="WebMail"Connection: closeSet-Cookie: webmailrelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260eli (2087/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!Plugin ID : 15901 Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 A web server is running on this port through SSLPlugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : yesPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="Web Host Manager"Connection: closeSet-Cookie: whostmgrrelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260gnunet (2086/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : noPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="Web Host Manager"Connection: closeSet-Cookie: whostmgrrelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260radsec (2083/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!Plugin ID : 15901 Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 A web server is running on this port through SSLPlugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : yesPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="cPanel"Connection: closeSet-Cookie: cprelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260infowave (2082/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : noPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="cPanel"Connection: closeSet-Cookie: cprelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260domain (53/tcp) Port is openPlugin ID : 11219 A DNS server is running on this port. If you do not use it, disable it.Risk Factor : LowPlugin ID : 11002 Synopsis :It is possible to obtain the version number of the remote DNS server.Description :The remote host is running BIND, an open-source DNS server. It is possibleto extract the version number of the remote installation by sendinga special DNS request for the text 'version.bind' in the domain 'chaos'.Solution:It is possible to hide the version number of bind by using the 'version'directive in the 'options' section in named.confRisk Factor : NonePlugin output:The version of the remote BIND server is : 9.2.4Plugin ID : 10028nbx-dir (2096/tcp) It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!Plugin ID : 15901 Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 A web server is running on this port through SSLPlugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 Synopsis :The remote service supports the use of weak SSL ciphers.Description :The remote host supports the use of SSL ciphers thatoffer either weak encryption or no encryption at all.See Also :http://www.openssl.org/docs/apps/ciphers.htmlSolution:Reconfigure the affected application if possible to avoid use of weak ciphers.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Here is a list of the SSL ciphers supported by the remote server :Export CiphersSSLv2EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export Low Strength Ciphers (excluding export, < 128-bit key)SSLv2DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key)SSLv2RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key)SSLv2DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are :{OpenSSL ciphername}Kx={key exchange}Au={authentication}Enc={symmetric encryption method}Mac={message authentication code}{export flag}Plugin ID : 21643 The remote web server type is :cpsrvd/10.9.6Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.0SSL : yesPipelining : noKeep-Alive : noOptions allowed : (Not implemented)Headers :WWW-Authenticate: Basic realm="WebMail"Connection: closeSet-Cookie: webmailrelogin=nopath=/Server: cpsrvd/10.9.6Content-type: text/htmlPlugin ID : 24260tcpmux (1/tcp) Port is openPlugin ID : 11219 The service closed the connection after 0 seconds without sending any dataIt might be protected by some TCP wrapperPlugin ID : 10330ssh (22/tcp) Port is openPlugin ID : 11219 An ssh server is running on this portPlugin ID : 10330 Remote SSH version : SSH-1.99-OpenSSH_3.6.1p2Remote SSH supported authentication : publickey,password,keyboard-interactivePlugin ID : 10267 The remote SSH daemon supports the following versions of theSSH protocol :. 1.33. 1.5. 1.99. 2.0SSHv1 host key fingerprint : 9e:0d:8f:a7:31:0c:49:83:f3:ae:c4:4d:45:d3:80:c7SSHv2 host key fingerprint : 9c:7a:99:c5:9f:09:b1:cc:d9:de:d1:56:a8:cc:48:91Plugin ID : 10881 Synopsis :The remote service offers an insecure cryptographic protocolDescription :The remote SSH daemon supports connections madeusing the version 1.33 and/or 1.5 of the SSH protocol.These protocols are not completely cryptographicallysafe so they should not be used.Solution: Disable compatiblity with version 1 of the protocol.Risk Factor :Low / CVSS Base Score : 3 (AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C)CVE : CVE-2001-0361, CVE-2001-0361BID : 2344, 2344Plugin ID : 10882ftp (21/tcp) The FTP server does not filter arguments to the ls command. It is possible to consume all available memory on the machine by sending ls "-w 1000000 -C"See http://www.guninski.com/binls.htmlSolution: Contact your vendor for a fixRisk Factor : HighCVE : CVE-2003-0853, CVE-2003-0854, CVE-2003-0853, CVE-2003-0854BID : 8875, 8875Other references : CONECTIVA:CLA-2003:768, zone-h:3299Plugin ID : 11912 Port is openPlugin ID : 11219 An FTP server is running on this port.Here is its banner : 220---------- Welcome to Pure-FTPd [TLS] ----------Plugin ID : 10330 Synopsis :An FTP server is listening on this portDescription :It is possible to obtain the banner of the remote FTP serverby connecting to the remote port.Risk Factor : NonePlugin output :The remote FTP banner is :220---------- Welcome to Pure-FTPd [TLS] ----------Plugin ID : 10092 Synopsis :Anonymous logins are allowed on the remote FTP server.Description :This FTP service allows anonymous logins. If you do not want to share data with anyone you do not know, then you should deactivate the anonymous account, since it can only cause troubles.Risk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :The content of the remote FTP root is :drwxr-xr-x 3 0 0 4096 Feb 24 2006 .drwxr-xr-x 3 0 0 4096 Feb 24 2006 ..drwxr-xr-x 2 0 0 4096 Feb 24 2006 pubCVE : CVE-1999-0497, CVE-1999-0497Plugin ID : 10079urd (465/tcp) Port is openPlugin ID : 11219 A SSLv2 server answered on this portPlugin ID : 10330 An SMTP server is running on this port through SSLHere is its banner : 220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Sat, 05 May 2007 16:32:56 -0500 Plugin ID : 10330 Synopsis :The remote service encrypts traffic using a protocol with knownweaknesses. Description :The remote service accepts connections encrypted using SSL 2.0, whichreportedly suffers from several cryptographic flaws and has beendeprecated for several years. An attacker may be able to exploit theseissues to conduct man-in-the-middle attacks or decrypt communicationsbetween the affected service and clients. See Also :http://www.schneier.com/paper-ssl.pdfSolution: Consult the application's documentation to disable SSL 2.0 and use SSL3.0 or TLS 1.0 instead.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 20007 Here is the SSLv2 server certificate:Certificate:Data:Version: 3 (0x2)Serial Number: 0 (0x0)Signature Algorithm: md5WithRSAEncryptionIssuer: C=US, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown, CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.netValidityNot Before: Dec 29 18:48:07 2006 GMTNot After : May 15 18:48:07 2034 GMTSubject: C=US, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown, CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.netSubject Public Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (1024 bit)Modulus (1024 bit):00:e2:64:d2:85:71:99:21:76:11:0b:b4:14:b5:2c:70:09:97:cc:4c:7d:84:8e:0b:f9:de:fe:73:87:ba:b1:b6:42:15:26:92:f8:be:b5:b5:a9:bf:91:3e:e9:9b:35:09:ee:19:69:93:ce:d3:da:2d:4b:1e:a9:51:50:36:87:d4:9c:30:25:3e:00:df:1d:2a:cf:89:c8:a4:23:2a:10:a5:d9:eb:c3:0e:6d:64:d3:7b:3a:0f:62:9b:79:98:6d:7d:78:f4:0f:35:3c:c7:0c:83:32:5a:ca:f7:eb:ff:6b:e4:04:c9:8f:ea:41:30:30:d2:17:0a:ea:c3:63:4d:de:53:e3Exponent: 65537 (0x10001)X509v3 extensions:X509v3 Subject Key Identifier: FA:E5:84:70:4B:BA:E4:7E:F1:2C:7C:41:36:C4:10:DD:8C:75:60:E4X509v3 Authority Key Identifier: keyid:FA:E5:84:70:4B:BA:E4:7E:F1:2C:7C:41:36:C4:10:DD:8C:75:60:E4DirName:/C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.netserial:00X509v3 Basic Constraints: CA:TRUESignature Algorithm: md5WithRSAEncryptionb6:4c:b4:8d:dd:80:f2:77:9c:e9:7c:a2:93:4d:7b:cd:6c:aa:e4:fd:00:db:05:86:01:4c:79:77:7d:dd:97:c7:67:55:09:fa:06:67:9e:04:36:55:a2:5e:24:6a:cb:4d:9e:a1:85:1a:d7:6e:b7:39:17:31:12:ff:85:e7:c5:22:66:ed:47:6e:33:1d:1e:53:b4:07:af:ce:7e:48:7d:b2:f5:9a:ec:79:a0:31:18:02:f8:24:21:7f:f4:f0:76:23:23:af:af:41:a1:0c:a2:2d:36:b1:c4:a1:0c:6f:7c:53:ec:1c:fa:d4:06:b9:70:b3:f7:24:62:fa:d2:f6:83:f0This SSLv2 server also accepts SSLv3 connections.This SSLv2 server also accepts TLSv1 connections.Plugin ID : 10863 Synopsis :The remote service supports the use of weak SSL ciphers.Description :The remote host supports the use of SSL ciphers thatoffer either weak encryption or no encryption at all.See Also :http://www.openssl.org/docs/apps/ciphers.htmlSolution:Reconfigure the affected application if possible to avoid use of weak ciphers.Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Here is a list of the SSL ciphers supported by the remote server :Export CiphersSSLv2EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export SSLv3EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Low Strength Ciphers (excluding export, < 128-bit key)SSLv2DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key)SSLv2RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key)SSLv2DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are :{OpenSSL ciphername}Kx={key exchange}Au={authentication}Enc={symmetric encryption method}Mac={message authentication code}{export flag}Plugin ID : 21643 Synopsis :An SMTP server is listening on the remote port.Description :The remote host is running a mail (SMTP) server on this port.Since SMTP servers are the targets of spammers, it is recommended you disable it if you do not use it.Solution: Disable this service if you do not use it, or filter incoming traffic to this port.Risk Factor : NonePlugin output :Remote SMTP server banner :220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Sat, 05 May 2007 16:32:56 -0500 Plugin ID : 10263 For some reason, we could not send the 42.zip file to this MTABID : 3027, 3027Plugin ID : 11036https (443/tcp) The remote host is using a version of OpenSSL which isolder than 0.9.6m or 0.9.7dThere are several bug in this version of OpenSSL which may allowan attacker to cause a denial of service against the remote host.Nessus solely relied on the banner of the remote hostto issue this warningSolution: Upgrade to version 0.9.6m (0.9.7d) or newerRisk Factor : HighCVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112BID : 9899, 9899Other references : IAVA:2004-B-0006Plugin ID : 12110 It was possible to make the remote switch reboot by requesting :GET /cgi-bin/view-source?/An attacker may use this flaw to prevent your network from workingproperly.Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtmlRisk Factor : HighCVE : CVE-2000-0984, CVE-2000-0984BID : 1838, 1838Plugin ID : 10682 The remote host is using a version of OpenSSL which isolder than 0.9.6j or 0.9.7bThis version is vulnerable to a timing based attack which mayallow an attacker to guess the content of fixed data blocks andmay eventually be able to guess the value of the private RSA keyof the server.An attacker may use this implementation flaw to sniff thedata going to this host and decrypt some parts of it, as wellas impersonate your server and perform man in the middle attacks.Nessus solely relied on the banner of the remote hostto issue this warningSee Also : http://www.openssl.org/news/secadv_20030219.txthttp://lasecwww.epfl.ch/memo_ssl.shtmlhttp://eprint.iacr.org/2003/052/Solution: Upgrade to version 0.9.6j (0.9.7b) or newerRisk Factor : MediumCVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147BID : 6884, 7148, 6884, 7148Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024Plugin ID : 11267 Port is openPlugin ID : 11219 A web server is running on this portPlugin ID : 10330 The remote web server type is :Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7aSolution: You can set the directive 'ServerTokens Prod' to limitthe information emanating from the server in its response headers.Plugin ID : 10107 Synopsis :Some information about the remote HTTP configuration can beextracted.Description :This test gives some information about the remote HTTP protocol - the versionused, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...This test is informational only and does not denote any security problemSolution:None.Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :Protocol version : HTTP/1.1SSL : noPipelining : yesKeep-Alive : yesOptions allowed : GET, HEAD, OPTIONS, TRACEHeaders :Date: Sat, 05 May 2007 21:45:07 GMTServer: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7aLast-Modified: Fri, 13 Oct 2006 08:48:45 GMTETag: "c9c06a-b2c-452f52ed"Accept-Ranges: bytesContent-Length: 2860Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlcharset=iso-8859-5Plugin ID : 24260 Synopsis :Debugging functions are enabled on the remote HTTP server.Description :The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACKare HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject tocross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", whenused in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to givehim their credentials. Solution:Disable these methods.See Also :http://www.kb.cert.org/vuls/id/867593Risk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin output :Solution: Add the following lines for each virtual host in your configuration file :RewriteEngine onRewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)RewriteRule .* - [F]CVE : CVE-2004-2320, CVE-2004-2320BID : 9506, 9561, 11604, 9506, 9561, 11604Plugin ID : 11213domain (53/udp) Synopsis :The remote name server allows recursive queries to be performedby the host running nessusd.Description :It is possible to query the remote name server for third party names.If this is your internal nameserver, then forget this warning.If you are probing a remote nameserver, then it allows anyoneto use it to resolve third parties names (such as www.nessus.org).This allows hackers to do cache poisoning attacks against thisnameserver.If the host allows these recursive queries via UDP,then the host can be used to 'bounce' Denial of Service attacksagainst another network or system.See Also : http://www.cert.org/advisories/CA-1997-22.htmlSolution: Restrict recursive queries to the hosts that shoulduse this nameserver (such as those of the LAN connected to it).If you are using bind 8, you can do this by using the instruction'allow-recursion' in the 'options' section of your named.confIf you are using bind 9, you can define a grouping of internal addressesusing the 'acl' commandThen, within the options block, you can explicitly state:'allow-recursion { hosts_defined_in_acl }'For more info on Bind 9 administration (to include recursion), see: http://www.nominum.com/content/documents/bind9arm.pdfIf you are using another name server, consult its documentation.Risk Factor :Medium / CVSS Base Score : 4 (AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I)CVE : CVE-1999-0024, CVE-1999-0024BID : 136, 678, 136, 678Plugin ID : 10539 Synopsis :Remote DNS server is vulnerable to Cache Snooping attacks.Description :The remote DNS server answers to queries for third party domains which do not have the recursion bit set. This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have beenrecently visited.For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they wouldbe able to use this attack to build a statistical model regardingcompany usage of aforementioned financial institution. Of course,the attack can also be used to find B2B partners, web-surfing patterns,external mail servers, and more...For a much more detailed discussion of the potential risks of allowing DNS cache information to be queried anonymously, please see:http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdfRisk Factor :Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)Plugin ID : 12217 A DNS server is running on this port. If you do not use it, disable it.Risk Factor : LowPlugin ID : 11002 The remote name server could be fingerprinted as being : ISC BIND 9.2.3Plugin ID : 11951general/icmp Synopsis :It is possible to determine the exact time set on the remote host.Description :The remote host answers to an ICMP timestamp request. This allows an attacker to know the date which is set on your machine. This may help him to defeat all your time based authentication protocols.Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).Risk Factor :None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)Plugin output :The difference between the local and remote clocks is -7 secondsCVE : CVE-1999-0524, CVE-1999-0524Plugin ID : 10114general/udp For your information, here is the traceroute from 68.37.220.199 to 70.87.45.130 : 68.37.220.199?68.86.219.19368.86.209.17768.86.208.568.86.90.374.71.172.1214.68.97.624.69.132.934.69.132.294.69.132.854.69.134.214.68.122.484.71.122.270.87.253.1470.87.253.7467.18.116.6970.87.45.130Plugin ID : 10287general/tcp The remote host, when queried on open ports, replies with differing TTL values. This could be an indicator that a transparent proxy is on the way, or that this host is a forwarding router, honeypot, etc...An attacker may use this information to find critical systems on your network Solution Contact vendor for information on closing up this information leak. Risk Factor : LowPlugin ID : 11858 70.87.45.130 resolves as 82.2d.5746.static.theplanet.com.Plugin ID : 12053 The remote host is running one of these operating systems : Linux Kernel 2.4Linux Kernel 2.6Plugin ID : 11936