Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

A POP server is listening on the remote port

Description :

The remote host is running a POP server.

Solution:

Disable this service if you do not use it.

Risk Factor :

None

Plugin output :

Remote POP server banner :
+OK POP3 vanity [cppop 20.0] at [70.87.45.130]

Plugin ID : 10185

Synopsis :

The remote service supports the use of weak SSL ciphers.

Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.

See Also :

http://www.openssl.org/docs/apps/ciphers.html

Solution:

Reconfigure the affected application if possible to avoid use of
weak ciphers.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
TLSv1
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
SSLv3
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
TLSv1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1

High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5
SSLv3
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
TLSv1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643

Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

An IMAP server is running on the remote host.

Description :

An IMAP (Internet Message Access Protocol) server is
installed and running on the remote host.

Risk Factor :

None

Plugin output :

The remote imap server banner is :
* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] localhost IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:32:56 -0500 (EST)
Plugin ID : 11414

Synopsis :

The remote service supports the use of weak SSL ciphers.

Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.

See Also :

http://www.openssl.org/docs/apps/ciphers.html

Solution:

Reconfigure the affected application if possible to avoid use of
weak ciphers.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
SSLv3
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
TLSv1
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
SSLv3
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
TLSv1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1

High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5
SSLv3
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
TLSv1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.1
SSL : no
Pipelining : yes
Keep-Alive : yes
Options allowed : (Not implemented)
Headers :

Date: Sat, 05 May 2007 21:45:04 GMT
Server: Apache
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
charset=utf-8


Plugin ID : 24260

Synopsis :

The remote web server itself is prone to cross-site scripting attacks.

Description :

The remote host is running a web server that fails to adequately
sanitize request strings of Javascript. By exploiting this flaw, an
attacker may be able to cause arbitrary HTML and script code to be
executed in a user's browser within the security context of the affected
site.

Solution:

Contact the vendor for a patch or upgrade.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

The request string used to detect this flaw was:

/?< DEFANGED_script >cross_site_scripting.nasl< /DEFANGED_script >

CVE : CVE-2002-1060, CVE-2005-2453, CVE-2006-1681, CVE-2002-1060, CVE-2005-2453, CVE-2006-1681
BID : 5305, 7344, 7353, 8037, 14473, 17408, 5305, 7344, 7353, 8037, 14473, 17408
Plugin ID : 10815

Synopsis :

A Database server is listening on the remote port.

Description :

The remote host is running MySQL, an open-source Database server.
The remote database access is restricted and configured to reject
access from not allowed IPs. Therefor it was not possible to extract
its version number.

Risk Factor :

None
Plugin ID : 10719

Synopsis :

An IMAP server is running on the remote host.

Description :

An IMAP (Internet Message Access Protocol) server is
installed and running on the remote host.

Risk Factor :

None

Plugin output :

The remote imap server banner is :
* OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] vanity.twisted-delusions.net IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:33:04 -0500 (EST)
Plugin ID : 11414

Synopsis :

A POP server is listening on the remote port

Description :

The remote host is running a POP server.

Solution:

Disable this service if you do not use it.

Risk Factor :

None

Plugin output :

Remote POP server banner :
+OK AVG POP3 Proxy Server 7.5.460/7.5.467 [269.6.4/790]

Plugin ID : 10185

Solution: Upgrade to version 0.9.6m (0.9.7d) or newer

Risk Factor : High
CVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112
BID : 9899, 9899
Other references : IAVA:2004-B-0006
Plugin ID : 12110

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

See Also : http://www.openssl.org/news/secadv_20030219.txt
http://lasecwww.epfl.ch/memo_ssl.shtml
http://eprint.iacr.org/2003/052/

Solution: Upgrade to version 0.9.6j (0.9.7b) or newer

Risk Factor : Medium
CVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147
BID : 6884, 7148, 6884, 7148
Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024
Plugin ID : 11267

Solution: You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Plugin ID : 10107

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.1
SSL : no
Pipelining : yes
Keep-Alive : yes
Options allowed : GET, HEAD, OPTIONS, TRACE
Headers :

Date: Sat, 05 May 2007 21:45:10 GMT
Server: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a
Last-Modified: Fri, 13 Oct 2006 08:48:45 GMT
ETag: "c9c06a-b2c-452f52ed"
Accept-Ranges: bytes
Content-Length: 2860
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
charset=iso-8859-5


Plugin ID : 24260

Synopsis :

The remote Apache server can be used to guess the presence of a given user
name on the remote host.

Description :

When configured with the 'UserDir' option, requests to URLs containing a tilde
followed by a username will redirect the user to a given subdirectory in the
user home.

For instance, by default, requesting /~root/ displays the HTML contents from
/root/public_html/.

If the username requested does not exist, then Apache will reply with a
different error code. Therefore, an attacker may exploit this vulnerability
to guess the presence of a given user name on the remote host.

Solution:

In httpd.conf, set the 'UserDir' to 'disabled'.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
CVE : CVE-2001-1013, CVE-2001-1013
BID : 3335, 3335
Plugin ID : 10766

Synopsis :

Debugging functions are enabled on the remote HTTP server.

Description :

The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.

It has been shown that servers supporting this method are subject to
cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when
used in conjunction with various weaknesses in browsers.

An attacker may use this flaw to trick your legitimate web users to give
him their credentials.

Solution:

Disable these methods.

See Also :

http://www.kb.cert.org/vuls/id/867593

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Solution:
Add the following lines for each virtual host in your configuration file :

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]


CVE : CVE-2004-2320, CVE-2004-2320
BID : 9506, 9561, 11604, 9506, 9561, 11604
Plugin ID : 11213

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : no
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="WebMail"
Connection: close
Set-Cookie: webmailrelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : yes
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="Web Host Manager"
Connection: close
Set-Cookie: whostmgrrelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : no
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="Web Host Manager"
Connection: close
Set-Cookie: whostmgrrelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : yes
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="cPanel"
Connection: close
Set-Cookie: cprelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : no
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="cPanel"
Connection: close
Set-Cookie: cprelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Risk Factor : Low
Plugin ID : 11002

Synopsis :

It is possible to obtain the version number of the remote DNS server.

Description :

The remote host is running BIND, an open-source DNS server. It is possible
to extract the version number of the remote installation by sending
a special DNS request for the text 'version.bind' in the domain 'chaos'.

Solution:

It is possible to hide the version number of bind by using the 'version'
directive in the 'options' section in named.conf

Risk Factor :

None

Plugin output:

The version of the remote BIND server is : 9.2.4
Plugin ID : 10028

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

The remote service supports the use of weak SSL ciphers.

Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.

See Also :

http://www.openssl.org/docs/apps/ciphers.html

Solution:

Reconfigure the affected application if possible to avoid use of
weak ciphers.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
TLSv1
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
SSLv3
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
TLSv1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1

High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5
SSLv3
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
TLSv1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.0
SSL : yes
Pipelining : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :

WWW-Authenticate: Basic realm="WebMail"
Connection: close
Set-Cookie: webmailrelogin=no
path=/
Server: cpsrvd/10.9.6
Content-type: text/html


Plugin ID : 24260

Synopsis :

The remote service offers an insecure cryptographic protocol

Description :

The remote SSH daemon supports connections made
using the version 1.33 and/or 1.5 of the SSH protocol.

These protocols are not completely cryptographically
safe so they should not be used.

Solution:

Disable compatiblity with version 1 of the protocol.

Risk Factor :

Low / CVSS Base Score : 3
(AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C)
CVE : CVE-2001-0361, CVE-2001-0361
BID : 2344, 2344
Plugin ID : 10882

Solution: Contact your vendor for a fix

Risk Factor : High
CVE : CVE-2003-0853, CVE-2003-0854, CVE-2003-0853, CVE-2003-0854
BID : 8875, 8875
Other references : CONECTIVA:CLA-2003:768, zone-h:3299
Plugin ID : 11912

Synopsis :

An FTP server is listening on this port

Description :

It is possible to obtain the banner of the remote FTP server
by connecting to the remote port.

Risk Factor :

None

Plugin output :

The remote FTP banner is :
220---------- Welcome to Pure-FTPd [TLS] ----------
Plugin ID : 10092

Synopsis :

Anonymous logins are allowed on the remote FTP server.

Description :

This FTP service allows anonymous logins. If you do not want to share data
with anyone you do not know, then you should deactivate the anonymous account,
since it can only cause troubles.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

The content of the remote FTP root is :
drwxr-xr-x 3 0 0 4096 Feb 24 2006 .
drwxr-xr-x 3 0 0 4096 Feb 24 2006 ..
drwxr-xr-x 2 0 0 4096 Feb 24 2006 pub

CVE : CVE-1999-0497, CVE-1999-0497
Plugin ID : 10079

Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses.

Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients.

See Also :

http://www.schneier.com/paper-ssl.pdf

Solution:

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007

Synopsis :

The remote service supports the use of weak SSL ciphers.

Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.

See Also :

http://www.openssl.org/docs/apps/ciphers.html

Solution:

Reconfigure the affected application if possible to avoid use of
weak ciphers.

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
SSLv3
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
TLSv1
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export
EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
SSLv3
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
TLSv1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1

High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5
SSLv3
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
TLSv1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643

Synopsis :

An SMTP server is listening on the remote port.

Description :

The remote host is running a mail (SMTP) server on this port.

Since SMTP servers are the targets of spammers, it is recommended you
disable it if you do not use it.

Solution:

Disable this service if you do not use it, or filter incoming traffic
to this port.

Risk Factor :

None

Plugin output :

Remote SMTP server banner :
220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Sat, 05 May 2007 16:32:56 -0500
Plugin ID : 10263

Solution: Upgrade to version 0.9.6m (0.9.7d) or newer

Risk Factor : High
CVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112
BID : 9899, 9899
Other references : IAVA:2004-B-0006
Plugin ID : 12110

Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml

Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682

See Also : http://www.openssl.org/news/secadv_20030219.txt
http://lasecwww.epfl.ch/memo_ssl.shtml
http://eprint.iacr.org/2003/052/

Solution: Upgrade to version 0.9.6j (0.9.7b) or newer

Risk Factor : Medium
CVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147
BID : 6884, 7148, 6884, 7148
Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024
Plugin ID : 11267

Solution: You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Plugin ID : 10107

Synopsis :

Some information about the remote HTTP configuration can be
extracted.

Description :

This test gives some information about the remote HTTP protocol - the version
used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc...

This test is informational only and does not denote any security problem

Solution:

None.

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

Protocol version : HTTP/1.1
SSL : no
Pipelining : yes
Keep-Alive : yes
Options allowed : GET, HEAD, OPTIONS, TRACE
Headers :

Date: Sat, 05 May 2007 21:45:07 GMT
Server: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a
Last-Modified: Fri, 13 Oct 2006 08:48:45 GMT
ETag: "c9c06a-b2c-452f52ed"
Accept-Ranges: bytes
Content-Length: 2860
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
charset=iso-8859-5


Plugin ID : 24260

Synopsis :

Debugging functions are enabled on the remote HTTP server.

Description :

The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.

It has been shown that servers supporting this method are subject to
cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when
used in conjunction with various weaknesses in browsers.

An attacker may use this flaw to trick your legitimate web users to give
him their credentials.

Solution:

Disable these methods.

See Also :

http://www.kb.cert.org/vuls/id/867593

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

Plugin output :

Solution:
Add the following lines for each virtual host in your configuration file :

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]


CVE : CVE-2004-2320, CVE-2004-2320
BID : 9506, 9561, 11604, 9506, 9561, 11604
Plugin ID : 11213

Synopsis :

The remote name server allows recursive queries to be performed
by the host running nessusd.

Description :

It is possible to query the remote name server for third party names.

If this is your internal nameserver, then forget this warning.

If you are probing a remote nameserver, then it allows anyone
to use it to resolve third parties names (such as www.nessus.org).
This allows hackers to do cache poisoning attacks against this
nameserver.

If the host allows these recursive queries via UDP,
then the host can be used to 'bounce' Denial of Service attacks
against another network or system.

See Also :

http://www.cert.org/advisories/CA-1997-22.html

Solution:

Restrict recursive queries to the hosts that should
use this nameserver (such as those of the LAN connected to it).

If you are using bind 8, you can do this by using the instruction
'allow-recursion' in the 'options' section of your named.conf

If you are using bind 9, you can define a grouping of internal addresses
using the 'acl' command

Then, within the options block, you can explicitly state:
'allow-recursion { hosts_defined_in_acl }'

For more info on Bind 9 administration (to include recursion), see:
http://www.nominum.com/content/documents/bind9arm.pdf

If you are using another name server, consult its documentation.

Risk Factor :

Medium / CVSS Base Score : 4
(AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I)
CVE : CVE-1999-0024, CVE-1999-0024
BID : 136, 678, 136, 678
Plugin ID : 10539

Synopsis :

Remote DNS server is vulnerable to Cache Snooping attacks.

Description :

The remote DNS server answers to queries for third party domains which do
not have the recursion bit set.

This may allow a remote attacker to determine which domains have recently
been resolved via this name server, and therefore which hosts have been
recently visited.

For instance, if an attacker was interested in whether your company utilizes
the online services of a particular financial institution, they would
be able to use this attack to build a statistical model regarding
company usage of aforementioned financial institution. Of course,
the attack can also be used to find B2B partners, web-surfing patterns,
external mail servers, and more...

For a much more detailed discussion of the potential risks of allowing
DNS cache information to be queried anonymously, please see:
http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdf

Risk Factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 12217

Risk Factor : Low
Plugin ID : 11002

Synopsis :

It is possible to determine the exact time set on the remote host.

Description :

The remote host answers to an ICMP timestamp request. This allows an attacker
to know the date which is set on your machine.

This may help him to defeat all your time based authentication protocols.

Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP
timestamp replies (14).

Risk Factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

The difference between the local and remote clocks is -7 seconds

CVE : CVE-1999-0524, CVE-1999-0524
Plugin ID : 10114

Solution Contact vendor for information on closing up this information leak.

Risk Factor : Low
Plugin ID : 11858