| Security Issues and Fixes: 10.163.156.10 |
| Type |
Port |
Issue and Fix |
| Warning |
echo (7/tcp) |
The 'echo' port is open. This port is
not of any use nowadays, and may be a source of problems,
since it can be used along with other ports to perform a denial
of service. You should really disable this service.
Risk factor : Low
Solution : comment out 'echo' in /etc/inetd.conf
CVE : CVE-1999-0103
Nessus ID : 10061 |
| Informational |
echo (7/tcp) |
An echo server is running on this port
Nessus ID : 10330 |
| Vulnerability |
telnet (23/tcp) |
The Telnet server does not return an expected number of replies
when it receives a long sequence of 'Are You There' commands.
This probably means it overflows one of its internal buffers and
crashes. It is likely an attacker could abuse this bug to gain
control over the remote host's superuser.
For more information, see:
http://www.team-teso.net/advisories/teso-advisory-011.tar.gz
Solution: Comment out the 'telnet' line in /etc/inetd.conf.
Risk factor : High
CVE : CVE-2001-0554
BID : 3064
Nessus ID : 10709 |
| Vulnerability |
telnet (23/tcp) |
It is possible to reboot the remote host by connecting to the telnet
port and providing a bad username and password.
This vulnerability is documented as Cisco Bug ID CSCdw81244.
An attacker may use this flaw to prevent your access point from
working properly.
Solution : http://www.cisco.com/warp/public/707/Aironet-Telnet.shtml
Risk factor : High
CVE : CAN-2002-0545
BID : 4461
Nessus ID : 11014 |
| Warning |
telnet (23/tcp) |
The Telnet service is running.
This service is dangerous in the sense that
it is not ciphered - that is, everyone can sniff
the data that passes between the telnet client
and the telnet server. This includes logins
and passwords.
You should disable this service and use OpenSSH instead.
(www.openssh.com)
Solution : Comment out the 'telnet' line in /etc/inetd.conf.
Risk factor : Low
CVE : CAN-1999-0619
Nessus ID : 10280 |
| Informational |
telnet (23/tcp) |
A telnet server seems to be running on this port
Nessus ID : 10330 |
| Informational |
telnet (23/tcp) |
Remote telnet banner :
SunOS 5.8
Nessus ID : 10281 |
| Vulnerability |
ssh (22/tcp) |
You are running a version of OpenSSH which is older than 3.4
There is a flaw in this version that can be exploited remotely to
give an attacker a shell on this host.
Note that several distribution patched this hole without changing
the version number of OpenSSH. Since Nessus solely relied on the
banner of the remote SSH server to perform this check, this might
be a false positive.
If you are running a RedHat host, make sure that the command :
rpm -q openssh-server
Returns :
openssh-server-3.1p1-6
Solution : Upgrade to OpenSSH 3.4 or contact your vendor for a patch
Risk factor : High
CVE : CAN-2002-0639, CAN-2002-0640
BID : 5093
Nessus ID : 11031 |
| Vulnerability |
ssh (22/tcp) |
You are running a version of OpenSSH which is older than 3.0.2.
Versions prior than 3.0.2 are vulnerable to an environment
variables export that can allow a local user to execute
command with root privileges.
This problem affect only versions prior than 3.0.2, and when
the UseLogin feature is enabled (usually disabled by default)
Solution : Upgrade to OpenSSH 3.0.2 or apply the patch for prior
versions. (Available at: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH)
Risk factor : High (If UseLogin is enabled, and locally)
CVE : CVE-2001-0872
BID : 3614
Nessus ID : 10823 |
| Vulnerability |
ssh (22/tcp) |
You are running a version of OpenSSH which is older than 3.0.1.
Versions older than 3.0.1 are vulnerable to a flaw in which
an attacker may authenticate, provided that Kerberos V support
has been enabled (which is not the case by default).
It is also vulnerable as an excessive memory clearing bug,
believed to be unexploitable.
*** You may ignore this warning if this host is not using
*** Kerberos V
Solution : Upgrade to OpenSSH 3.0.1
Risk factor : Low (if you are not using Kerberos) or High (if kerberos is enabled)
CVE : CVE-2002-0083
BID : 3560, 4560, 4241
Nessus ID : 10802 |
| Vulnerability |
ssh (22/tcp) |
You are running a version of OpenSSH older than OpenSSH 3.2.1
A buffer overflow exists in the daemon if AFS is enabled on
your system, or if the options KerberosTgtPassing or
AFSTokenPassing are enabled. Even in this scenario, the
vulnerability may be avoided by enabling UsePrivilegeSeparation.
Versions prior to 2.9.9 are vulnerable to a remote root
exploit. Versions prior to 3.2.1 are vulnerable to a local
root exploit.
Solution :
Upgrade to the latest version of OpenSSH
Risk factor : High
CVE : CAN-2002-0575
BID : 4560
Nessus ID : 10954 |
| Warning |
ssh (22/tcp) |
The remote SSH daemon supports connections made
using the version 1.33 and/or 1.5 of the SSH protocol.
These protocols are not completely cryptographically
safe so they should not be used.
Solution :
If you use OpenSSH, set the option 'Protocol' to '2'
If you use SSH.com's set the option 'Ssh1Compatibility' to 'no'
Risk factor : Low
Nessus ID : 10882 |
| Informational |
ssh (22/tcp) |
An ssh server is running on this port
Nessus ID : 10330 |
| Informational |
ssh (22/tcp) |
The remote SSH daemon supports the following versions of the
SSH protocol :
. 1.33
. 1.5
. 1.99
. 2.0
Nessus ID : 10881 |
| Informational |
ssh (22/tcp) |
Remote SSH version : SSH-1.99-OpenSSH_2.3.0p1
Nessus ID : 10267 |
| Vulnerability |
ftp (21/tcp) |
The remote FTP server seems to be vulnerable to an exhaustion
attack which may makes it consume all available memory on the remote
host when it receives the command :
NLST /../*/../*/../*/../*/../*/../*/../*/../*/../*/../
Solution : upgrade to ProFTPd 1.2.2 if the remote server is proftpd,
or contact your vendor for a patch.
Reference : http://online.securityfocus.com/archive/1/169069
Risk factor : High
Nessus ID : 10634 |
| Vulnerability |
ftp (21/tcp) |
You seem to be running an FTP server which is vulnerable to the 'glob heap corruption'
flaw, which is known to be exploitable remotely against this server. An attacker may use
this flaw to execute arbitrary commands on this host.
Solution: Upgrade your ftp server software to the latest version.
Risk factor : High
CVE : CVE-2001-0550
BID : 3581
Nessus ID : 10821 |
| Warning |
ftp (21/tcp) |
This FTP service allows anonymous logins. If you do not
want to share data with anyone you do not know, then you should deactivate
the anonymous account, since it can only cause troubles.
Under most Unix system, doing :
echo ftp >> /etc/ftpusers
will correct this.
Risk factor : Low
CVE : CAN-1999-0497
Nessus ID : 10079 |
| Warning |
ftp (21/tcp) |
It is possible to gather the
real path of the public area of the ftp server
(like /home/ftp) by issuing the following
command :
CWD
This problem may help an attacker to find where
to put a .rhost file using other security
flaws.
Risk factor : Low
CVE : CVE-1999-0201
Nessus ID : 10087 |
| Warning |
ftp (21/tcp) |
The remote FTP server allows users to make any amount
of PASV commands, thus blocking the free ports for legitimate services and
consuming file descriptors.
Solution: upgrade your FTP server to a version which solves this problem.
Risk factor : Medium
CVE : CVE-1999-0079
BID : 271
Nessus ID : 10085 |
| Informational |
ftp (21/tcp) |
An FTP server is running on this port.
Here is its banner :
220 unknown FTP server (SunOS 5.8) ready.
Nessus ID : 10330 |
| Informational |
ftp (21/tcp) |
Remote FTP server banner :
220 unknown FTP server (SunOS 5.8) ready.
Nessus ID : 10092 |
| Warning |
chargen (19/tcp) |
The chargen service is running.
The 'chargen' service should only be enabled when testing the machine.
When contacted, chargen responds with some random characters (something
like all the characters in the alphabet in a row). When contacted via UDP, it
will respond with a single UDP packet. When contacted via TCP, it will
continue spewing characters until the client closes the connection.
An easy attack is 'pingpong' in which an attacker spoofs a packet between two
machines running chargen. This will cause them to spew characters at each
other, slowing the machines down and saturating the network.
Solution : disable this service in /etc/inetd.conf.
Risk factor : Low
CVE : CVE-1999-0103
Nessus ID : 10043 |
| Informational |
chargen (19/tcp) |
Chargen is running on this port
Nessus ID : 10330 |
| Warning |
daytime (13/tcp) |
The daytime service is running.
The date format issued by this service
may sometimes help an attacker to guess
the operating system type.
In addition to that, when the UDP version of
daytime is running, an attacker may link it
to the echo port using spoofing, thus creating
a possible denial of service.
Solution : disable this service in /etc/inetd.conf.
Risk factor : Low
CVE : CVE-1999-0103
Nessus ID : 10052 |
| Vulnerability |
smtp (25/tcp) |
The remote sendmail server, according to its version number,
may be vulnerable to the -bt overflow attack which
allows any local user to execute arbitrary commands as root.
Solution : upgrade to the latest version of Sendmail
Risk factor : High
Note : This vulnerability is _local_ only
Nessus ID : 10809 |
| Vulnerability |
smtp (25/tcp) |
The remote sendmail server, according to its version number,
may be vulnerable to a buffer overflow its DNS handling code.
The owner of a malicious name server could use this flaw
to execute arbitrary code on this host.
Solution : Upgrade to Sendmail 8.12.5
Risk factor : High
CVE : CAN-2002-0906
BID : 5122
Nessus ID : 11232 |
| Warning |
smtp (25/tcp) |
The remote SMTP server
answers to the EXPN and/or VRFY commands.
The EXPN command can be used to find
the delivery address of mail aliases, or
even the full name of the recipients, and
the VRFY command may be used to check the
validity of an account.
Your mailer should not allow remote users to
use any of these commands, because it gives
them too much information.
Solution : if you are using Sendmail, add the
option
O PrivacyOptions=goaway
in /etc/sendmail.cf.
Risk factor : Low
CVE : CAN-1999-0531
Nessus ID : 10249 |
| Warning |
smtp (25/tcp) |
The remote SMTP server is vulnerable to a redirection
attack. That is, if a mail is sent to :
user@hostname1@victim
Then the remote SMTP server (victim) will happily send the
mail to :
user@hostname1
Using this flaw, an attacker may route a message
through your firewall, in order to exploit other
SMTP servers that can not be reached from the
outside.
*** THIS WARNING MAY BE A FALSE POSITIVE, SINCE
SOME SMTP SERVERS LIKE POSTFIX WILL NOT
COMPLAIN BUT DROP THIS MESSAGE ***
Solution : if you are using sendmail, then at the top
of ruleset 98, in /etc/sendmail.cf, insert :
R$*@$*@$* $#error $@ 5.7.1 $: '551 Sorry, no redirections.'
Risk factor : Low
Nessus ID : 10250 |
| Warning |
smtp (25/tcp) |
The remote SMTP server allows the relaying. This means that
it allows spammers to use your mail server to send their mails to
the world, thus wasting your network bandwidth.
Risk factor : Low/Medium
Solution : configure your SMTP server so that it can't be used as a relay
any more.
CVE : CAN-1999-0512
Nessus ID : 10262 |
| Warning |
smtp (25/tcp) |
The remote SMTP server allows anyone to
use it as a mail relay, provided that the source address
is set to '<>'.
This problem allows any spammer to use your mail server
to spam the world, thus blacklisting your mailserver, and
using your network resources.
Risk factor : Medium
Solution : reconfigure this server properly
CVE : CVE-1999-0819
Nessus ID : 10167 |
| Warning |
smtp (25/tcp) |
The remote sendmail server, according to its version number,
might be vulnerable to a queue destruction when a local user
runs
sendmail -q -h1000
If you system does not allow users to process the queue (which
is the default), you are not vulnerable.
Solution : upgrade to the latest version of Sendmail or
do not allow users to process the queue (RestrictQRun option)
Risk factor : Low
Note : This vulnerability is _local_ only
CVE : CAN-2001-0714
BID : 3378
Nessus ID : 11087 |
| Warning |
smtp (25/tcp) |
According to the version number of the remote mail server,
a local user may be able to obtain the complete mail configuration
and other interesting information about the mail queue even if
he is not allowed to access those information directly, by running
sendmail -q -d0-nnnn.xxx
where nnnn & xxx are debugging levels.
If users are not allowed to process the queue (which is the default)
then you are not vulnerable.
Solution : upgrade to the latest version of Sendmail or
do not allow users to process the queue (RestrictQRun option)
Risk factor : Very low / none
Note : This vulnerability is _local_ only
CVE : CAN-2001-0715
BID : 3898
Nessus ID : 11088 |
| Informational |
smtp (25/tcp) |
An SMTP server is running on this port
Here is its banner :
220 sparky.fr.nessus.org ESMTP Sendmail 8.9.3+Sun/8.9.3; Fri, 21 Feb 2003 15:53:28 GMT
Nessus ID : 10330 |
| Informational |
smtp (25/tcp) |
Remote SMTP server banner :
220 sparky.fr.nessus.org ESMTP Sendmail 8.9.3+Sun/8.9.3; Fri, 21 Feb 2003 15:54:20 GMT
Nessus ID : 10263 |
| Informational |
time (37/tcp) |
A time server seems to be running on this port
Nessus ID : 10330 |
| Warning |
finger (79/tcp) |
The 'finger' service provides useful information
to attackers, since it allow them to gain usernames, check if a machine
is being used, and so on...
Risk factor : Low
Solution : comment out the 'finger' line in /etc/inetd.conf
CVE : CVE-1999-0612
Nessus ID : 10068 |
| Warning |
finger (79/tcp) |
The remote finger daemon accepts
to redirect requests. That is, users can perform
requests like :
finger user@host@victim
This allows an attacker to use your computer
as a relay to gather information on another
network, making the other network think you
are making the requests.
Solution: disable your finger daemon (comment out
the finger line in /etc/inetd.conf) or
install a more secure one.
Risk factor : Low
CVE : CAN-1999-0105
Nessus ID : 10073 |
| Warning |
finger (79/tcp) |
There is a bug in the finger service
which will make it display the list of the accounts that
have never been used, when anyone issues the request :
finger 'a b c d e f g h'@target
This list will help an attacker to guess the operating
system type. It will also tell him which accounts have
never been used, which will often make him focus his
attacks on these accounts.
Solution : disable the finger service in /etc/inetd.conf, or
apply the patches from Sun.
Risk factor : Medium
BID : 3457
Nessus ID : 10788 |
| Informational |
finger (79/tcp) |
A finger server seems to be running on this port
Nessus ID : 10330 |
| Informational |
sunrpc (111/tcp) |
RPC program #100000 version 4 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Informational |
sunrpc (111/tcp) |
RPC program #100000 version 3 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Informational |
sunrpc (111/tcp) |
RPC program #100000 version 2 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Warning |
login (513/tcp) |
The rlogin service is running.
This service is dangerous in the sense that
it is not ciphered - that is, everyone can sniff
the data that passes between the rlogin client
and the rlogin server. This includes logins
and passwords.
You should disable this service and use openssh instead
(www.openssh.com)
Solution : Comment out the 'rlogin' line in /etc/inetd.conf.
Risk factor : Low
CVE : CAN-1999-0651
Nessus ID : 10205 |
| Warning |
exec (512/tcp) |
The rexecd service is open.
Because rexecd does not provide any good
means of authentication, it can be
used by an attacker to scan a third party
host, giving you troubles or bypassing
your firewall.
Solution : comment out the 'exec' line
in /etc/inetd.conf.
Risk factor : Medium
CVE : CAN-1999-0618
Nessus ID : 10203 |
| Informational |
printer (515/tcp) |
A LPD server seems to be running on this port
Nessus ID : 10330 |
| Warning |
shell (514/tcp) |
The rsh service is running.
This service is dangerous in the sense that
it is not ciphered - that is, everyone can sniff
the data that passes between the rsh client
and the rsh server. This includes logins
and passwords.
You should disable this service and use ssh instead.
Solution : Comment out the 'rsh' line in /etc/inetd.conf.
Risk factor : Low
CVE : CAN-1999-0651
Nessus ID : 10245 |
| Informational |
uucp (540/tcp) |
An UUCP server seems to be running on this port
Nessus ID : 10330 |
| Warning |
sometimes-rpc16 (32776/udp) |
The sprayd RPC service is running.
If you do not use this service, then
disable it as it may become a security
threat in the future, if a vulnerability
is discovered.
Risk factor : Low
CVE : CAN-1999-0613
Nessus ID : 10234 |
| Informational |
sometimes-rpc16 (32776/udp) |
RPC program #100012 version 1 'sprayd' (spray) is running on this port
Nessus ID : 11111 |
| Warning |
sometimes-rpc14 (32775/udp) |
The rusersd RPC service is running.
It provides an attacker interesting
information such as how often the
system is being used, the names of
the users, and so on.
It usually not a good idea to leave this
service open.
Risk factor : Low
CVE : CVE-1999-0626
Nessus ID : 10228 |
| Informational |
sometimes-rpc14 (32775/udp) |
RPC program #100002 version 2 'rusersd' (rusers) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc14 (32775/udp) |
RPC program #100002 version 3 'rusersd' (rusers) is running on this port
Nessus ID : 11111 |
| Vulnerability |
sometimes-rpc10 (32773/udp) |
The sadmin RPC service is running.
There is a bug in Solaris versions of
this service that allow an intruder to
execute arbitrary commands on your system.
Solution : disable this service
Risk factor : High
CVE : CVE-1999-0977
BID : 866
Nessus ID : 10229 |
| Informational |
sometimes-rpc10 (32773/udp) |
RPC program #100232 version 10 'sadmind' is running on this port
Nessus ID : 11111 |
| Warning |
lockd (4045/udp) |
The nlockmgr RPC service is running.
If you do not use this service, then
disable it as it may become a security
threat in the future, if a vulnerability
is discovered.
Risk factor : Low
CVE : CVE-2000-0508
BID : 1372
Nessus ID : 10220 |
| Informational |
lockd (4045/udp) |
RPC program #100021 version 1 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/udp) |
RPC program #100021 version 2 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/udp) |
RPC program #100021 version 3 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/udp) |
RPC program #100021 version 4 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Vulnerability |
snmp (161/udp) |
The device answered to more than 4 community strings.
This may be a false positive or a community-less SNMP server
HP printers answer to all community strings.
SNMP Agent responded as expected with community name: public
SNMP Agent responded as expected with community name: private
SNMP Agent responded as expected with community name: write
SNMP Agent responded as expected with community name: all
SNMP Agent responded as expected with community name: monitor
SNMP Agent responded as expected with community name: agent
SNMP Agent responded as expected with community name: manager
SNMP Agent responded as expected with community name: OrigEquipMfr
SNMP Agent responded as expected with community name: admin
SNMP Agent responded as expected with community name: default
SNMP Agent responded as expected with community name: password
SNMP Agent responded as expected with community name: tivoli
SNMP Agent responded as expected with community name: openview
SNMP Agent responded as expected with community name: community
SNMP Agent responded as expected with community name: snmp
SNMP Agent responded as expected with community name: snmpd
SNMP Agent responded as expected with community name: Secret C0de
SNMP Agent responded as expected with community name: security
SNMP Agent responded as expected with community name: all private
SNMP Agent responded as expected with community name: rmon
SNMP Agent responded as expected with community name: rmon_admin
SNMP Agent responded as expected with community name: hp_admin
SNMP Agent responded as expected with community name: NoGaH$@!
SNMP Agent responded as expected with community name: 0392a0
SNMP Agent responded as expected with community name: xyzzy
SNMP Agent responded as expected with community name: agent_steal
SNMP Agent responded as expected with community name: freekevin
SNMP Agent responded as expected with community name: fubar
SNMP Agent responded as expected with community name: secret
SNMP Agent responded as expected with community name: cisco
SNMP Agent responded as expected with community name: apc
SNMP Agent responded as expected with community name: ANYCOM
SNMP Agent responded as expected with community name: cable-docsis
SNMP Agent responded as expected with community name: c
SNMP Agent responded as expected with community name: cc
SNMP Agent responded as expected with community name: Cisco router
SNMP Agent responded as expected with community name: cascade
SNMP Agent responded as expected with community name: comcomcom
CVE : CAN-1999-0186
BID : 177
Nessus ID : 10264 |
| Vulnerability |
snmp (161/udp) |
It was possible to disable the remote SNMP daemon by sending
a malformed packet advertising bogus length fields.
An attacker may use this flaw to prevent you from using
SNMP to administer your network (or use other flaws
to execute arbitrary code with the privileges of the
SNMP daemon)
Solution : see www.cert.org/advisories/CA-2002-03.html
Risk factor : High
CVE : CAN-2002-0013
Nessus ID : 10857 |
| Warning |
snmp (161/udp) |
A SNMP server is running on this host
Nessus ID : 10265 |
| Informational |
snmp (161/udp) |
Using SNMP, we could determine that the remote operating system is :
Sun SNMP Agent, Ultra-1
Nessus ID : 10800 |
| Vulnerability |
sometimes-rpc22 (32779/udp) |
The cmsd RPC service is running.
This service has a long history of
security holes, so you should really
know what you are doing if you decide
to let it run.
* NO SECURITY HOLE REGARDING THIS
PROGRAM HAS BEEN TESTED, SO
THIS MIGHT BE A FALSE POSITIVE *
We suggest that you disable this
service.
Risk factor : High
CVE : CVE-1999-0320, CVE-1999-0696
BID : 428
Nessus ID : 10213 |
| Informational |
sometimes-rpc22 (32779/udp) |
RPC program #100068 version 2 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc22 (32779/udp) |
RPC program #100068 version 3 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc22 (32779/udp) |
RPC program #100068 version 4 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc22 (32779/udp) |
RPC program #100068 version 5 is running on this port
Nessus ID : 11111 |
| Informational |
general/tcp |
QueSO has found out that the remote host OS is
* Standard: Solaris 2.x, Linux 2.1.???, Linux 2.2, MacOS
CVE : CAN-1999-0454
Nessus ID : 10337 |
| Vulnerability |
sometimes-rpc18 (32777/udp) |
The rpc.walld RPC service is running.
Some versions of this server allow an attacker to gain
root access remotely, by consuming the resources of the
remote host then sending a specially formed packet with
format strings to this host.
Solaris 2.5.1, 2.6, 7 and 8 are vulnerable to this
issue. Other operating systems might be affected as well.
*** Nessus did not check for this vulnerability,
*** so this might be a false positive
Solution : Deactivate this service.
Risk factor : High
CVE : CAN-2002-0573
BID : 4639
Nessus ID : 10950 |
| Warning |
sometimes-rpc18 (32777/udp) |
The walld RPC service is running.
It is usually used by the administrator
to tell something to the users of a
network by making a message appear
on their screen.
Since this service lacks any kind
of authentication, an attacker
may use it to trick users into
doing something (change their password,
leave the console, or worse), by sending
a message which would appear to be
written by the administrator.
It can also be used as a denial of service
attack, by continually sending garbage
to the users screens, preventing them
from working properly.
Solution : Deactivate this service.
Risk factor : Medium
CVE : CVE-1999-0181
Nessus ID : 10240 |
| Informational |
sometimes-rpc18 (32777/udp) |
RPC program #100008 version 1 'walld' (rwall shutdown) is running on this port
Nessus ID : 11111 |
| Warning |
sometimes-rpc20 (32778/udp) |
The rstatd RPC service is running.
It provides an attacker interesting
information such as :
- the CPU usage
- the system uptime
- its network usage
- and more
Usually, it is not a good idea to let this
service open
Risk factor : Low
CVE : CAN-1999-0624
Nessus ID : 10227 |
| Informational |
sometimes-rpc20 (32778/udp) |
RPC program #100001 version 2 'rstatd' (rstat rup perfmeter rstat_svc) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc20 (32778/udp) |
RPC program #100001 version 3 'rstatd' (rstat rup perfmeter rstat_svc) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc20 (32778/udp) |
RPC program #100001 version 4 'rstatd' (rstat rup perfmeter rstat_svc) is running on this port
Nessus ID : 11111 |
| Vulnerability |
dtspc (6112/tcp) |
The 'dtspcd' service is running.
Some versions of this daemon are vulnerable to
a buffer overflow attack which allows an attacker
to gain root privileges
*** This warning might be a false positive,
*** as no real overflow was performed
Solution : See http://www.cert.org/advisories/CA-2001-31.html
to determine if you are vulnerable or deactivate
this service (comment out the line 'dtspc' in /etc/inetd.conf)
Risk factor : High
CVE : CVE-2001-0803
BID : 3517
Nessus ID : 10833 |
| Vulnerability |
sometimes-rpc13 (32775/tcp) |
The cachefsd RPC service is running.
Some versions of this server allow an attacker to gain
root access remotely, by consuming the resources of the
remote host then sending a specially formed packet with
format strings to this host.
Solaris 2.5.1, 2.6, 7 and 8 are vulnerable to this
issue. Other operating systems might be affected as well.
*** Nessus did not check for this vulnerability,
*** so this might be a false positive
Solution : Deactivate this service - there is no patch at this time
/etc/init.d/cachefs.daemon stop
Risk factor : High
CVE : CAN-2002-0084, CAN-2002-0033
BID : 4631
Nessus ID : 10951 |
| Informational |
sometimes-rpc13 (32775/tcp) |
RPC program #100235 version 1 is running on this port
Nessus ID : 11111 |
| Vulnerability |
sometimes-rpc9 (32773/tcp) |
The tooltalk RPC service is running.
There is a format string bug in many versions
of this service, which allow an attacker to gain
root remotely.
In addition to this, several versions of this service
allow remote attackers to overwrite abitrary memory
locations with a zero and possibly gain privileges
via a file descriptor argument in an AUTH_UNIX
procedure call which is used as a table index by the
_TT_ISCLOSE procedure.
*** This warning may be a false positive since the presence
*** of the bug was not verified locally.
Solution : Disable this service or patch it
See also : CERT Advisories CA-2001-27 and CA-2002-20
Risk factor : High
CVE : CAN-2002-0677, CVE-2001-0717, CVE-2002-0679
BID : 3382
Nessus ID : 10787 |
| Informational |
sometimes-rpc9 (32773/tcp) |
RPC program #100083 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
sunrpc (111/udp) |
RPC program #100000 version 4 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Informational |
sunrpc (111/udp) |
RPC program #100000 version 3 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Informational |
sunrpc (111/udp) |
RPC program #100000 version 2 'portmapper' (portmap sunrpc rpcbind) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc8 (32772/udp) |
RPC program #100300 version 3 'nisd' (rpc.nisd) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc5 (32771/tcp) |
RPC program #100300 version 3 'nisd' (rpc.nisd) is running on this port
Nessus ID : 11111 |
| Warning |
sometimes-rpc12 (32774/udp) |
The rquotad RPC service is running.
If you do not use this service, then
disable it as it may become a security
threat in the future, if a vulnerability
is discovered.
Risk factor : Low
CVE : CAN-1999-0625
Nessus ID : 10226 |
| Informational |
sometimes-rpc12 (32774/udp) |
RPC program #100011 version 1 'rquotad' (rquotaprog quota rquota) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc7 (32772/tcp) |
RPC program #100002 version 2 'rusersd' (rusers) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc7 (32772/tcp) |
RPC program #100002 version 3 'rusersd' (rusers) is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc11 (32774/tcp) |
RPC program #100221 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/tcp) |
RPC program #100021 version 1 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/tcp) |
RPC program #100021 version 2 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/tcp) |
RPC program #100021 version 3 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Informational |
lockd (4045/tcp) |
RPC program #100021 version 4 'nlockmgr' is running on this port
Nessus ID : 11111 |
| Warning |
sometimes-rpc24 (32780/udp) |
The statd RPC service is running.
This service has a long history of
security holes, so you should really
know what you are doing if you decide
to let it run.
* NO SECURITY HOLES REGARDING THIS
PROGRAM HAVE BEEN TESTED, SO
THIS MIGHT BE A FALSE POSITIVE *
We suggest that you disable this
service.
Risk factor : High
CVE : CVE-1999-0493
BID : 450
Nessus ID : 10235 |
| Informational |
sometimes-rpc24 (32780/udp) |
RPC program #100024 version 1 'status' is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc24 (32780/udp) |
RPC program #100133 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc15 (32776/tcp) |
RPC program #100024 version 1 'status' is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc15 (32776/tcp) |
RPC program #100133 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
unknown (32785/udp) |
RPC program #100249 version 1 is running on this port
Nessus ID : 11111 |
| Vulnerability |
sometimes-rpc19 (32778/tcp) |
The remote RPC service 100249 (snmpXdmid) is vulnerable
to a heap overflow which allows any user to obtain a root
shell on this host.
Solution : disable this service (/etc/init.d/init.dmi stop) if you don't use
it, or contact Sun for a patch
Risk factor : High
CVE : CVE-2001-0236
BID : 2417
Nessus ID : 10659 |
| Informational |
sometimes-rpc19 (32778/tcp) |
RPC program #100249 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
unknown (32788/udp) |
RPC program #300598 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
unknown (32788/udp) |
RPC program #805306368 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc21 (32779/tcp) |
RPC program #300598 version 1 is running on this port
Nessus ID : 11111 |
| Informational |
sometimes-rpc21 (32779/tcp) |
RPC program #805306368 version 1 is running on this port
Nessus ID : 11111 |
| Warning |
xdmcp (177/udp) |
The remote host is running XDMCP.
This protocol is used to provide X display connections for
X terminals. XDMCP is completely insecure, since the traffic and
passwords are not encrypted.
An attacker may use this flaw to capture all the keystrokes of
the users using this host through their X terminal, including
passwords.
Risk factor : Medium
Solution : Disable XDMCP
Nessus ID : 10891 |
| Vulnerability |
font-service (7100/tcp) |
The remote X Font Service (xfs) might be vulnerable to a buffer
overflow.
An attacker may use this flaw to gain root on this host
remotely.
*** Note that Nessus did not actually check for the flaw
*** as details about this vulnerability are still unknown
Solution : See CERT Advisory CA-2002-34
Risk factor : High
CVE : CAN-2002-1317
Nessus ID : 11188 |
| Warning |
echo (7/udp) |
The 'echo' port is open. This port is
not of any use nowadays, and may be a source of problems,
since it can be used along with other ports to perform a denial
of service. You should really disable this service.
Risk factor : Low
Solution : comment out 'echo' in /etc/inetd.conf
CVE : CVE-1999-0103
Nessus ID : 10061 |
| Warning |
daytime (13/udp) |
The daytime service is running.
The date format issued by this service
may sometimes help an attacker to guess
the operating system type.
In addition to that, when the UDP version of
daytime is running, an attacker may link it
to the echo port using spoofing, thus creating
a possible denial of service.
Solution : disable this service in /etc/inetd.conf.
Risk factor : Low
CVE : CVE-1999-0103
Nessus ID : 10052 |