Tenable Nessus Security Report
Start Time: Mon May 07 16:14:20 2007 Finish Time: Mon May 07 16:51:38 2007
64.182.111.11
64.182.111.11 19 Open Ports, 75 Notes, 2 Warnings, 5 Holes.
64.182.111.11 [Return to top]
cddbp-alt (8880/tcp)
Port is open
Plugin ID : 11219
A web server is running on this port
Plugin ID : 10330
The following directories were discovered:
/backup, /cgi-bin, /login, /cert, /docs, /filemanager, /help, /icons, /images, /javascript, /styles
While this is not, in and of itself, a bug, you should manually inspect
these directories to ensure that they are in compliance with company
security standards
Plugin ID : 11032
The remote web server type is :
Apache/1.3.33 (FreeBSD) mod_ssl/2.8.22 OpenSSL/0.9.7e-p1 PHP/5.0.5
Solution: You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Plugin ID : 10107
pop3s (995/tcp)
Port is open
Plugin ID : 11219
A SSLv2 server answered on this port
Plugin ID : 10330
A pop3 server is running on this port
Plugin ID : 10330
Synopsis :
The remote service encrypts traffic using a protocol with known
weaknesses.
Description :
The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.
See Also :
http://www.schneier.com/paper-ssl.pdf
Solution:
Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007
Synopsis :
A POP server is listening on the remote port
Description :
The remote host is running a POP server.
Solution:
Disable this service if you do not use it.
Risk Factor :
None
Plugin output :
Remote POP server banner :
+OK Hello there. <84163.1178569381@localhost.localdomain>
Plugin ID : 10185
imaps (993/tcp)
Port is open
Plugin ID : 11219
A SSLv2 server answered on this port
Plugin ID : 10330
An IMAP server is running on this port through SSL
Plugin ID : 10330
Synopsis :
The remote service encrypts traffic using a protocol with known
weaknesses.
Description :
The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.
See Also :
http://www.schneier.com/paper-ssl.pdf
Solution:
Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007
Synopsis :
An IMAP server is running on the remote host.
Description :
An IMAP (Internet Message Access Protocol) server is
installed and running on the remote host.
Risk Factor :
None
Plugin output :
The remote imap server banner is :
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information.
Plugin ID : 11414
glrpc (9080/tcp)
Port is open
Plugin ID : 11219
A web server is running on this port
Plugin ID : 10330
The remote web server type is :
Apache-Coyote/1.1
and the 'ServerTokens' directive is ProductOnly
Apache does not permit to hide the server type.
Plugin ID : 10107
Synopsis :
Some information about the remote HTTP configuration can be
extracted.
Description :
This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...
This test is informational only and does not denote any security problem
Solution:
None.
Risk Factor :
None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
Plugin output :
Protocol version : HTTP/1.1
SSL : no
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :
Server: Apache-Coyote/1.1
Transfer-Encoding: chunked
Date: Mon, 07 May 2007 20:31:37 GMT
Connection: close
Plugin ID : 24260
ajp13 (8009/tcp)
Port is open
Plugin ID : 11219
Synopsis :
There is an AJP connector listening on the remote host.
Description :
The remote host is running an AJP (Apache JServ Protocol) connector, a
service by which a standalone web server such as Apache communicates
over TCP with a Java servlet container such as Tomcat.
See Also :
http://tomcat.apache.org/connectors-doc/
http://tomcat.apache.org/connectors-doc/common/ajpv13a.html
Risk Factor :
None
Plugin output :
The connector listing on this port supports the ajp13 protocol.
Plugin ID : 21186
distinct (9999/tcp)
Port is open
Plugin ID : 11219
ndmp (10000/tcp)
Port is open
Plugin ID : 11219
mysql (3306/tcp)
Port is open
Plugin ID : 11219
Synopsis :
A Database server is listening on the remote port.
Description :
The remote host is running MySQL, an open-source Database server. It
is possible to extract the version number of the remote installation
by receiving the server greeting.
Solution:
Restrict access to the database to allowed IPs only.
Risk Factor :
None
Plugin output :
The remote MySQL version is 4.1.22
Plugin ID : 10719
pcsync-https (8443/tcp)
Port is open
Plugin ID : 11219
A SSLv2 server answered on this port
Plugin ID : 10330
A web server is running on this port through SSL
Plugin ID : 10330
Synopsis :
The remote service encrypts traffic using a protocol with known
weaknesses.
Description :
The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.
See Also :
http://www.schneier.com/paper-ssl.pdf
Solution:
Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007
Synopsis :
The remote web server is affected by a denial of service flaw.
Description :
The installed version of Apache with mod_ssl on the remote host
appears susceptible to a remote denial of service flaw under certain
atypical configurations. A remote attacker may be able to exploit
this issue to crash individual child processes or even the entire
server, thereby denying service to legitimate users.
See Also :
http://issues.apache.org/bugzilla/show_bug.cgi?id=37791
Solution:
Update the Apache configuration to use ''SSLRequire' whenever
'SSLCipherSuite' is used.
Risk Factor :
Low / CVSS Base Score : 3
(AV:R/AC:H/Au:NR/C:N/A:P/I:N/B:A)
CVE : CVE-2005-3357, CVE-2005-3357
BID : 16152, 16152
Plugin ID : 20386
imap (143/tcp)
Port is open
Plugin ID : 11219
An IMAP server is running on this port
Plugin ID : 10330
Synopsis :
An IMAP server is running on the remote host.
Description :
An IMAP (Internet Message Access Protocol) server is
installed and running on the remote host.
Risk Factor :
None
Plugin output :
The remote imap server banner is :
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information.
Plugin ID : 11414
pop3 (110/tcp)
The remote pop3 server is vulnerable to the following
buffer overflow :
USER test
PASS
This *may* allow an attacker to execute arbitrary commands
as root on the remote POP3 server.
Solution: contact your vendor, inform it of this
vulnerability, and ask for a patch
Risk Factor : High
CVE : CVE-1999-1511
BID : 791
Plugin ID : 10325
The remote POP3 server might be vulnerable to a buffer overflow
bug when it is issued at least one of these commands, with a too long
argument :
auth
user
pass
If confirmed, this problem might allow an attacker to execute
arbitrary code on the remote system, thus giving him an interactive
session on this host.
Solution: If you do not use POP3, disable this service in /etc/inetd.conf
and restart the inetd process. Otherwise, upgrade to a newer version.
See Also : http://online.securityfocus.com/archive/1/27197
Risk Factor : High
CVE : CVE-2002-0799, CVE-1999-0822
BID : 2781, 2811, 4055, 4295, 4614, 4789, 790, 830, 894, 942
Plugin ID : 10184
Port is open
Plugin ID : 11219
A pop3 server is running on this port
Plugin ID : 10330
Synopsis :
A POP server is listening on the remote port
Description :
The remote host is running a POP server.
Solution:
Disable this service if you do not use it.
Risk Factor :
None
Plugin output :
Remote POP server banner :
+OK AVG POP3 Proxy Server <84164.1178569382@localhost.localdomain> 7.5.460/7.5.467 [269.6.5/791]
Plugin ID : 10185
http (80/tcp)
It was possible to kill the HTTP proxy by
sending an invalid request with a too long header
A cracker may exploit this vulnerability to make your proxy server
crash continually or even execute arbitrary code on your system.
Solution: upgrade your software
Risk Factor : High
CVE : CVE-2002-0133, CVE-2002-0133
BID : 3904, 3905, 3904, 3905
Plugin ID : 11715
Requesting the URI /server-status gives information about
the currently running Apache.
Risk Factor : Low
Solution:
If you don't use this feature, comment the appropriate section in
your httpd.conf file. If you really need it, limit its access to
the administrator's machine.
Plugin ID : 10677
Port is open
Plugin ID : 11219
A web server is running on this port
Plugin ID : 10330
The remote web server type is :
Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8
Solution: You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Plugin ID : 10107
Synopsis :
Some information about the remote HTTP configuration can be
extracted.
Description :
This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...
This test is informational only and does not denote any security problem
Solution:
None.
Risk Factor :
None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
Plugin output :
Protocol version : HTTP/1.1
SSL : no
Pipelining : yes
Keep-Alive : yes
Options allowed : GET,HEAD,POST,OPTIONS,TRACE
Headers :
Date: Mon, 07 May 2007 20:31:38 GMT
Server: Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8
Last-Modified: Wed, 10 Jan 2007 19:43:09 GMT
ETag: "b3d4c-dc3-df4a4d40"
Accept-Ranges: bytes
Content-Length: 3523
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=2
Connection: Keep-Alive
Content-Type: text/html
Plugin ID : 24260
Synopsis :
Debugging functions are enabled on the remote HTTP server.
Description :
The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.
It has been shown that servers supporting this method are subject to
cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when
used in conjunction with various weaknesses in browsers.
An attacker may use this flaw to trick your legitimate web users to give
him their credentials.
Solution:
Disable these methods.
See Also :
http://www.kb.cert.org/vuls/id/867593
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin output :
Solution:
Add the following lines for each virtual host in your configuration file :
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
CVE : CVE-2004-2320, CVE-2004-2320
BID : 9506, 9561, 11604, 9506, 9561, 11604
Plugin ID : 11213
domain (53/tcp)
Port is open
Plugin ID : 11219
A DNS server is running on this port. If you do not use it, disable it.
Risk Factor : Low
Plugin ID : 11002
Synopsis :
It is possible to obtain the version number of the remote DNS server.
Description :
The remote host is running BIND, an open-source DNS server. It is possible
to extract the version number of the remote installation by sending
a special DNS request for the text 'version.bind' in the domain 'chaos'.
Solution:
It is possible to hide the version number of bind by using the 'version'
directive in the 'options' section in named.conf
Risk Factor :
None
Plugin output:
The version of the remote BIND server is : 9.3.2
Plugin ID : 10028
ssh (22/tcp)
Port is open
Plugin ID : 11219
An ssh server is running on this port
Plugin ID : 10330
Remote SSH version : SSH-2.0-OpenSSH_4.2p1 FreeBSD-20060930
Remote SSH supported authentication : publickey,password,keyboard-interactive
Plugin ID : 10267
The remote SSH daemon supports the following versions of the
SSH protocol :
. 1.99
. 2.0
SSHv2 host key fingerprint : d1:96:62:28:2a:96:a3:af:df:4b:bd:d3:18:64:d2:5b
Plugin ID : 10881
ftp (21/tcp)
It was possible to freeze or reboot Windows by
reading a MS/DOS device through FTP, using
a file name like CON\CON, AUX.htm or AUX.
A cracker may use this flaw to make your
system crash continuously, preventing
you from working properly.
Solution: upgrade your system or use a
FTP server that filters those names out.
Reference : http://support.microsoft.com/default.aspx?scid=KB
en-us
Q256015
Reference : http://online.securityfocus.com/archive/1/195054
Risk Factor : High
Plugin ID : 10929
Port is open
Plugin ID : 11219
An FTP server is running on this port.
Here is its banner :
220 ProFTPD 1.3.0 Server (ProFTPD) [64.182.111.11]
Plugin ID : 10330
Synopsis :
An FTP server is listening on this port
Description :
It is possible to obtain the banner of the remote FTP server
by connecting to the remote port.
Risk Factor :
None
Plugin output :
The remote FTP banner is :
220 ProFTPD 1.3.0 Server (ProFTPD) [64.182.111.11]
Plugin ID : 10092
urd (465/tcp)
Port is open
Plugin ID : 11219
A SSLv2 server answered on this port
Plugin ID : 10330
An SMTP server is running on this port through SSL
Here is its banner :
220 ksdhost.com ESMTP
Plugin ID : 10330
Synopsis :
The remote service encrypts traffic using a protocol with known
weaknesses.
Description :
The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.
See Also :
http://www.schneier.com/paper-ssl.pdf
Solution:
Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007
Synopsis :
An SMTP server is listening on the remote port.
Description :
The remote host is running a mail (SMTP) server on this port.
Since SMTP servers are the targets of spammers, it is recommended you
disable it if you do not use it.
Solution:
Disable this service if you do not use it, or filter incoming traffic
to this port.
Risk Factor :
None
Plugin output :
Remote SMTP server banner :
220 ksdhost.com ESMTP
Plugin ID : 10263
For some reason, we could not send the 42.zip file to this MTA
BID : 3027, 3027
Plugin ID : 11036
https (443/tcp)
There is a buffer overflow in the remote IIS web server.
It is possible to overflow the remote Web server and execute
commands as the SYSTEM user.
At attacker may make use of this vulnerability and use it to
gain access to confidential data and/or escalate their privileges
on the Web server.
See http://www.eeye.com/html/Research/Advisories/AD20010501.html
for more details.
Solution See http://www.microsoft.com/technet/security/bulletin/ms01-023.mspx
Risk Factor : High
CVE : CVE-2001-0241, CVE-2001-0241
BID : 2674, 2674
Other references : IAVA:2001-a-0005
Plugin ID : 10657
Requesting the URI /server-status gives information about
the currently running Apache.
Risk Factor : Low
Solution:
If you don't use this feature, comment the appropriate section in
your httpd.conf file. If you really need it, limit its access to
the administrator's machine.
Plugin ID : 10677
Port is open
Plugin ID : 11219
A SSLv2 server answered on this port
Plugin ID : 10330
A web server is running on this port through SSL
Plugin ID : 10330
Synopsis :
The remote service encrypts traffic using a protocol with known
weaknesses.
Description :
The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.
See Also :
http://www.schneier.com/paper-ssl.pdf
Solution:
Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007
Synopsis :
The remote service supports the use of weak SSL ciphers.
Description :
The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.
See Also :
http://www.openssl.org/docs/apps/ciphers.html
Solution:
Reconfigure the affected application if possible to avoid use of
weak ciphers.
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin output :
Here is a list of the SSL ciphers supported by the remote server :
Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
SSLv3
EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
TLSv1
EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
SSLv3
EDH-RSA-DES-CBC-SHA Kx=DH Au=RSA Enc=DES(56) Mac=SHA1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
TLSv1
EDH-RSA-DES-CBC-SHA Kx=DH Au=RSA Enc=DES(56) Mac=SHA1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5
SSLv3
EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
TLSv1
EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1
DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-AES256-SHA Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
The fields above are :
{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}
Plugin ID : 21643
Here is the SSLv2 server certificate:
Certificate:
Data:
Version: 1 (0x0)
Serial Number: 1168330910 (0x45a3509e)
Signature Algorithm: md5WithRSAEncryption
Issuer: C=US, ST=Virginia, L=Herndon, O=SWsoft, Inc., OU=Plesk, CN=plesk/emailAddress=info@plesk.com
Validity
Not Before: Jan 9 08:21:54 2007 GMT
Not After : Jan 9 08:21:54 2008 GMT
Subject: C=US, ST=Virginia, L=Herndon, O=SWsoft, Inc., OU=Plesk, CN=plesk/emailAddress=info@plesk.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:ba:ac:4c:fc:8c:c1:30:96:ab:75:85:67:62:d2:
0a:45:1c:79:ae:84:8b:c6:50:5c:a2:88:fb:99:a4:
61:f6:b3:23:b3:5b:90:ef:00:45:be:7e:cf:1b:0d:
ef:b9:60:c5:b6:23:77:42:55:11:fc:d6:c2:c1:ce:
8a:41:05:bd:b7:29:1b:8e:35:b0:03:74:e2:3a:c4:
05:b6:91:08:50:55:7d:ee:a3:7a:c6:13:11:45:47:
be:1a:9b:13:d8:e3:c4:a3:b7:d6:e1:cb:ee:f2:a2:
be:34:ff:1b:49:4d:53:f7:88:28:c3:81:97:b5:5b:
f0:b6:ab:89:5d:50:0c:b7:e5:fc:2f:6a:26:fd:c6:
d7:5d:df:e1:02:02:9b:a4:80:43:48:da:65:46:4f:
71:1d:78:42:94:b5:31:c8:34:f4:83:06:1a:9e:b0:
4d:1e:fd:af:4d:97:e0:17:a7:b8:50:03:d0:b3:38:
11:a9:f1:14:6c:fb:91:5a:1a:e7:29:25:15:59:9b:
60:64:28:c7:44:4c:b1:80:c8:62:6c:c2:a5:b8:cd:
e6:51:d9:6e:0f:17:74:60:b6:e9:6b:8e:14:1d:87:
29:f6:79:c0:2e:41:d5:e7:a5:14:de:d1:0c:09:48:
44:66:d8:fb:1a:db:1b:d9:69:df:6e:cc:df:ce:bd:
dc:e3
Exponent: 65537 (0x10001)
Signature Algorithm: md5WithRSAEncryption
b1:de:9c:19:1f:ea:bc:08:12:1e:c1:b8:54:51:9b:fc:7e:6d:
e6:dd:8e:78:7b:45:32:06:0b:d3:e4:a6:6d:16:f7:33:9b:46:
27:dc:4b:b4:eb:8b:93:45:63:82:25:4e:e5:b3:43:7a:cd:3e:
30:59:82:25:e3:14:98:a3:82:13:77:74:e7:54:0d:9d:7a:49:
53:4e:83:99:de:0a:c8:87:2a:94:3d:76:19:ea:20:71:f1:01:
c6:33:69:e4:48:30:e8:52:b1:a0:7e:72:55:fa:e0:38:59:ba:
1d:6a:0f:b7:d4:85:eb:70:7a:5f:5b:82:81:64:b7:b6:05:f0:
df:90:22:93:67:1b:30:7c:f2:e3:d6:36:62:86:2b:70:ef:0f:
5b:94:23:87:fd:c3:a8:ae:15:66:86:5e:40:54:ca:23:3b:45:
c6:c1:b0:c6:bb:92:3d:11:ad:d6:9f:0d:18:43:18:59:cb:dc:
90:83:69:fe:78:75:26:f5:cf:6b:92:04:6d:99:3e:c9:23:01:
4d:92:90:97:21:5f:98:6a:1e:9e:1b:c5:d0:4b:3d:60:30:cc:
de:00:58:48:65:d0:e5:22:f1:75:5d:42:57:19:25:c6:3c:01:
c8:ff:bd:8d:02:f6:6c:e8:8e:a5:eb:93:9c:06:da:c5:3c:cc:
bf:6c:01:74
This SSLv2 server also accepts SSLv3 connections.
This SSLv2 server also accepts TLSv1 connections.
Plugin ID : 10863
The following directories were discovered:
/cgi-bin, /css, /icons, /img, /manual, /server-status
While this is not, in and of itself, a bug, you should manually inspect
these directories to ensure that they are in compliance with company
security standards
Plugin ID : 11032
The remote web server type is :
Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8
Solution: You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Plugin ID : 10107
Synopsis :
Some information about the remote HTTP configuration can be
extracted.
Description :
This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...
This test is informational only and does not denote any security problem
Solution:
None.
Risk Factor :
None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
Plugin output :
Protocol version : HTTP/1.1
SSL : yes
Pipelining : yes
Keep-Alive : yes
Options allowed : GET,HEAD,POST,OPTIONS,TRACE
Headers :
Date: Mon, 07 May 2007 20:31:37 GMT
Server: Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8
Last-Modified: Wed, 10 Jan 2007 19:43:09 GMT
ETag: "b3e0d-dc3-df4a4d40"
Accept-Ranges: bytes
Content-Length: 3523
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=2
Connection: Keep-Alive
Content-Type: text/html
Plugin ID : 24260
Synopsis :
Debugging functions are enabled on the remote HTTP server.
Description :
The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.
It has been shown that servers supporting this method are subject to
cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when
used in conjunction with various weaknesses in browsers.
An attacker may use this flaw to trick your legitimate web users to give
him their credentials.
Solution:
Disable these methods.
See Also :
http://www.kb.cert.org/vuls/id/867593
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin output :
Solution:
Add the following lines for each virtual host in your configuration file :
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
CVE : CVE-2004-2320, CVE-2004-2320
BID : 9506, 9561, 11604, 9506, 9561, 11604
Plugin ID : 11213
Synopsis :
The remote web server is affected by a denial of service flaw.
Description :
The installed version of Apache with mod_ssl on the remote host
appears susceptible to a remote denial of service flaw under certain
atypical configurations. A remote attacker may be able to exploit
this issue to crash individual child processes or even the entire
server, thereby denying service to legitimate users.
See Also :
http://issues.apache.org/bugzilla/show_bug.cgi?id=37791
Solution:
Update the Apache configuration to use ''SSLRequire' whenever
'SSLCipherSuite' is used.
Risk Factor :
Low / CVSS Base Score : 3
(AV:R/AC:H/Au:NR/C:N/A:P/I:N/B:A)
CVE : CVE-2005-3357, CVE-2005-3357
BID : 16152, 16152
Plugin ID : 20386
domain (53/udp)
Synopsis :
Remote DNS server is vulnerable to Cache Snooping attacks.
Description :
The remote DNS server answers to queries for third party domains which do
not have the recursion bit set.
This may allow a remote attacker to determine which domains have recently
been resolved via this name server, and therefore which hosts have been
recently visited.
For instance, if an attacker was interested in whether your company utilizes
the online services of a particular financial institution, they would
be able to use this attack to build a statistical model regarding
company usage of aforementioned financial institution. Of course,
the attack can also be used to find B2B partners, web-surfing patterns,
external mail servers, and more...
For a much more detailed discussion of the potential risks of allowing
DNS cache information to be queried anonymously, please see:
http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdf
Risk Factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 12217
A DNS server is running on this port. If you do not use it, disable it.
Risk Factor : Low
Plugin ID : 11002
The remote name server could be fingerprinted as being : ISC BIND 9.2.3
Plugin ID : 11951
general/icmp
Synopsis :
It is possible to determine the exact time set on the remote host.
Description :
The remote host answers to an ICMP timestamp request. This allows an attacker
to know the date which is set on your machine.
This may help him to defeat all your time based authentication protocols.
Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP
timestamp replies (14).
Risk Factor :
None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
Plugin output :
The difference between the local and remote clocks is -2 seconds
CVE : CVE-1999-0524, CVE-1999-0524
Plugin ID : 10114
Here is the route recorded between 68.37.220.199 and 64.182.111.11 :
68.86.209.178.
68.86.208.6.
68.86.211.1.
12.119.12.18.
12.123.219.185.
12.122.80.238.
192.205.32.197.
206.24.194.103.
208.172.2.99.
Plugin ID : 12264
general/udp
For your information, here is the traceroute from 68.37.220.199 to 64.182.111.11 :
68.37.220.199
?
68.86.219.193
68.86.209.177
68.86.208.5
68.86.211.2
12.118.149.9
12.123.3.14
12.123.0.101
192.205.32.198
204.70.192.101
208.175.10.254
204.70.196.26
204.70.194.241
208.174.226.42
208.174.226.42
64.182.111.11
Plugin ID : 10287
ntp (123/udp)
It is possible to determine a lot of information about the remote host
by querying the NTP (Network Time Protocol) variables - these include
OS descriptor, and time settings.
It was possible to gather the following information from the remote NTP host :
version='ntpd 4.2.0-a Tue Dec 26 20:32:40 UTC 2006 (1)',
processor='i386', system='FreeBSD/6.1-RELEASE-p11', leap=0, stratum=2,
precision=-19, rootdelay=46.470, rootdispersion=106.542, peer=4697,
refid=128.10.252.7, reftime=0xc9ea0814.ec4b47eb, poll=10,
clock=0xc9ea083c.9d61dbf0, state=4, offset=-22.295, frequency=-107.946,
jitter=53.423, stability=2.527
Quickfix: Set NTP to restrict default access to ignore all info packets:
restrict default ignore
Risk Factor : Low
Plugin ID : 10884
general/tcp
The remote host is running FreeBSD /6.1-RELEASE-p11 (i386)
Plugin ID : 11936