Tenable Nessus Security Report Start Time: Sat May 05 17:31:40 2007 Finish Time: Sat May 05 18:29:37 2007 70.87.45.130 70.87.45.130 21 Open Ports, 99 Notes, 8 Warnings, 13 Holes. 70.87.45.130 [Return to top] pop3s (995/tcp) The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT! Plugin ID : 15901 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A pop3 server is running on this port Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : A POP server is listening on the remote port Description : The remote host is running a POP server. Solution: Disable this service if you do not use it. Risk Factor : None Plugin output : Remote POP server banner : +OK POP3 vanity [cppop 20.0] at [70.87.45.130] Plugin ID : 10185 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See Also : http://www.openssl.org/docs/apps/ciphers.html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Here is a list of the SSL ciphers supported by the remote server : Export Ciphers SSLv2 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1 EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export Low Strength Ciphers (excluding export, < 128-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key) SSLv2 RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key) SSLv2 DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin ID : 21643 imaps (993/tcp) The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT! Plugin ID : 15901 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 An IMAP server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : An IMAP server is running on the remote host. Description : An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. Risk Factor : None Plugin output : The remote imap server banner is : * OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] localhost IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:32:56 -0500 (EST) Plugin ID : 11414 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See Also : http://www.openssl.org/docs/apps/ciphers.html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Here is a list of the SSL ciphers supported by the remote server : Export Ciphers SSLv2 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export SSLv3 EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1 EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Low Strength Ciphers (excluding export, < 128-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key) SSLv2 RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key) SSLv2 DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin ID : 21643 distinct (9999/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The following CGI have been discovered : Syntax : cginame (arguments [default value]) /session.cgi (user [] pass [] app [admin] action [login] ) Plugin ID : 10662 The remote web server type is : Apache and the 'ServerTokens' directive is ProductOnly Apache does not permit to hide the server type. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : no Pipelining : yes Keep-Alive : yes Options allowed : (Not implemented) Headers : Date: Sat, 05 May 2007 21:45:04 GMT Server: Apache Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html charset=utf-8 Plugin ID : 24260 Synopsis : The remote web server itself is prone to cross-site scripting attacks. Description : The remote host is running a web server that fails to adequately sanitize request strings of Javascript. By exploiting this flaw, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. Solution: Contact the vendor for a patch or upgrade. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : The request string used to detect this flaw was: /?< DEFANGED_script >cross_site_scripting.nasl< /DEFANGED_script > CVE : CVE-2002-1060, CVE-2005-2453, CVE-2006-1681, CVE-2002-1060, CVE-2005-2453, CVE-2006-1681 BID : 5305, 7344, 7353, 8037, 14473, 17408, 5305, 7344, 7353, 8037, 14473, 17408 Plugin ID : 10815 mysql (3306/tcp) Port is open Plugin ID : 11219 Synopsis : A Database server is listening on the remote port. Description : The remote host is running MySQL, an open-source Database server. The remote database access is restricted and configured to reject access from not allowed IPs. Therefor it was not possible to extract its version number. Risk Factor : None Plugin ID : 10719 imap (143/tcp) Port is open Plugin ID : 11219 An IMAP server is running on this port Plugin ID : 10330 Synopsis : An IMAP server is running on the remote host. Description : An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. Risk Factor : None Plugin output : The remote imap server banner is : * OK [CAPABILITY IMAP4REV1 LITERAL+ SASL-IR LOGIN-REFERRALS AUTH=LOGIN] vanity.twisted-delusions.net IMAP4rev1 2004.357-cpanel at Sat, 5 May 2007 16:33:04 -0500 (EST) Plugin ID : 11414 sunrpc (111/tcp) Port is open Plugin ID : 11219 pop3 (110/tcp) The remote pop3 server is vulnerable to the following buffer overflow : USER test PASS This *may* allow an attacker to execute arbitrary commands as root on the remote POP3 server. Solution: contact your vendor, inform it of this vulnerability, and ask for a patch Risk Factor : High CVE : CVE-1999-1511 BID : 791 Plugin ID : 10325 Port is open Plugin ID : 11219 A pop3 server is running on this port Plugin ID : 10330 Synopsis : A POP server is listening on the remote port Description : The remote host is running a POP server. Solution: Disable this service if you do not use it. Risk Factor : None Plugin output : Remote POP server banner : +OK AVG POP3 Proxy Server 7.5.460/7.5.467 [269.6.4/790] Plugin ID : 10185 http (80/tcp) The remote host is using a version of OpenSSL which is older than 0.9.6m or 0.9.7d There are several bug in this version of OpenSSL which may allow an attacker to cause a denial of service against the remote host. Nessus solely relied on the banner of the remote host to issue this warning Solution: Upgrade to version 0.9.6m (0.9.7d) or newer Risk Factor : High CVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112 BID : 9899, 9899 Other references : IAVA:2004-B-0006 Plugin ID : 12110 It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 The remote host is using a version of OpenSSL which is older than 0.9.6j or 0.9.7b This version is vulnerable to a timing based attack which may allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of the server. An attacker may use this implementation flaw to sniff the data going to this host and decrypt some parts of it, as well as impersonate your server and perform man in the middle attacks. Nessus solely relied on the banner of the remote host to issue this warning See Also : http://www.openssl.org/news/secadv_20030219.txt http://lasecwww.epfl.ch/memo_ssl.shtml http://eprint.iacr.org/2003/052/ Solution: Upgrade to version 0.9.6j (0.9.7b) or newer Risk Factor : Medium CVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147 BID : 6884, 7148, 6884, 7148 Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024 Plugin ID : 11267 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a Solution: You can set the directive 'ServerTokens Prod' to limit the information emanating from the server in its response headers. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : no Pipelining : yes Keep-Alive : yes Options allowed : GET, HEAD, OPTIONS, TRACE Headers : Date: Sat, 05 May 2007 21:45:10 GMT Server: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a Last-Modified: Fri, 13 Oct 2006 08:48:45 GMT ETag: "c9c06a-b2c-452f52ed" Accept-Ranges: bytes Content-Length: 2860 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html charset=iso-8859-5 Plugin ID : 24260 Synopsis : The remote Apache server can be used to guess the presence of a given user name on the remote host. Description : When configured with the 'UserDir' option, requests to URLs containing a tilde followed by a username will redirect the user to a given subdirectory in the user home. For instance, by default, requesting /~root/ displays the HTML contents from /root/public_html/. If the username requested does not exist, then Apache will reply with a different error code. Therefore, an attacker may exploit this vulnerability to guess the presence of a given user name on the remote host. Solution: In httpd.conf, set the 'UserDir' to 'disabled'. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) CVE : CVE-2001-1013, CVE-2001-1013 BID : 3335, 3335 Plugin ID : 10766 Synopsis : Debugging functions are enabled on the remote HTTP server. Description : The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. See Also : http://www.kb.cert.org/vuls/id/867593 Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Solution: Add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] CVE : CVE-2004-2320, CVE-2004-2320 BID : 9506, 9561, 11604, 9506, 9561, 11604 Plugin ID : 11213 nbx-ser (2095/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : no Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="WebMail" Connection: close Set-Cookie: webmailrelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 eli (2087/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT! Plugin ID : 15901 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A web server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : yes Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="Web Host Manager" Connection: close Set-Cookie: whostmgrrelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 gnunet (2086/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : no Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="Web Host Manager" Connection: close Set-Cookie: whostmgrrelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 radsec (2083/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT! Plugin ID : 15901 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A web server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : yes Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="cPanel" Connection: close Set-Cookie: cprelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 infowave (2082/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : no Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="cPanel" Connection: close Set-Cookie: cprelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 domain (53/tcp) Port is open Plugin ID : 11219 A DNS server is running on this port. If you do not use it, disable it. Risk Factor : Low Plugin ID : 11002 Synopsis : It is possible to obtain the version number of the remote DNS server. Description : The remote host is running BIND, an open-source DNS server. It is possible to extract the version number of the remote installation by sending a special DNS request for the text 'version.bind' in the domain 'chaos'. Solution: It is possible to hide the version number of bind by using the 'version' directive in the 'options' section in named.conf Risk Factor : None Plugin output: The version of the remote BIND server is : 9.2.4 Plugin ID : 10028 nbx-dir (2096/tcp) It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT! Plugin ID : 15901 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A web server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See Also : http://www.openssl.org/docs/apps/ciphers.html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Here is a list of the SSL ciphers supported by the remote server : Export Ciphers SSLv2 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1 EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export Low Strength Ciphers (excluding export, < 128-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key) SSLv2 RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key) SSLv2 DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin ID : 21643 The remote web server type is : cpsrvd/10.9.6 Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.0 SSL : yes Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : WWW-Authenticate: Basic realm="WebMail" Connection: close Set-Cookie: webmailrelogin=no path=/ Server: cpsrvd/10.9.6 Content-type: text/html Plugin ID : 24260 tcpmux (1/tcp) Port is open Plugin ID : 11219 The service closed the connection after 0 seconds without sending any data It might be protected by some TCP wrapper Plugin ID : 10330 ssh (22/tcp) Port is open Plugin ID : 11219 An ssh server is running on this port Plugin ID : 10330 Remote SSH version : SSH-1.99-OpenSSH_3.6.1p2 Remote SSH supported authentication : publickey,password,keyboard-interactive Plugin ID : 10267 The remote SSH daemon supports the following versions of the SSH protocol : . 1.33 . 1.5 . 1.99 . 2.0 SSHv1 host key fingerprint : 9e:0d:8f:a7:31:0c:49:83:f3:ae:c4:4d:45:d3:80:c7 SSHv2 host key fingerprint : 9c:7a:99:c5:9f:09:b1:cc:d9:de:d1:56:a8:cc:48:91 Plugin ID : 10881 Synopsis : The remote service offers an insecure cryptographic protocol Description : The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol. These protocols are not completely cryptographically safe so they should not be used. Solution: Disable compatiblity with version 1 of the protocol. Risk Factor : Low / CVSS Base Score : 3 (AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C) CVE : CVE-2001-0361, CVE-2001-0361 BID : 2344, 2344 Plugin ID : 10882 ftp (21/tcp) The FTP server does not filter arguments to the ls command. It is possible to consume all available memory on the machine by sending ls "-w 1000000 -C" See http://www.guninski.com/binls.html Solution: Contact your vendor for a fix Risk Factor : High CVE : CVE-2003-0853, CVE-2003-0854, CVE-2003-0853, CVE-2003-0854 BID : 8875, 8875 Other references : CONECTIVA:CLA-2003:768, zone-h:3299 Plugin ID : 11912 Port is open Plugin ID : 11219 An FTP server is running on this port. Here is its banner : 220---------- Welcome to Pure-FTPd [TLS] ---------- Plugin ID : 10330 Synopsis : An FTP server is listening on this port Description : It is possible to obtain the banner of the remote FTP server by connecting to the remote port. Risk Factor : None Plugin output : The remote FTP banner is : 220---------- Welcome to Pure-FTPd [TLS] ---------- Plugin ID : 10092 Synopsis : Anonymous logins are allowed on the remote FTP server. Description : This FTP service allows anonymous logins. If you do not want to share data with anyone you do not know, then you should deactivate the anonymous account, since it can only cause troubles. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : The content of the remote FTP root is : drwxr-xr-x 3 0 0 4096 Feb 24 2006 . drwxr-xr-x 3 0 0 4096 Feb 24 2006 .. drwxr-xr-x 2 0 0 4096 Feb 24 2006 pub CVE : CVE-1999-0497, CVE-1999-0497 Plugin ID : 10079 urd (465/tcp) Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 An SMTP server is running on this port through SSL Here is its banner : 220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Sat, 05 May 2007 16:32:56 -0500 Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Here is the SSLv2 server certificate: Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown, CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.net Validity Not Before: Dec 29 18:48:07 2006 GMT Not After : May 15 18:48:07 2034 GMT Subject: C=US, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown, CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.net Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:e2:64:d2:85:71:99:21:76:11:0b:b4:14:b5:2c: 70:09:97:cc:4c:7d:84:8e:0b:f9:de:fe:73:87:ba: b1:b6:42:15:26:92:f8:be:b5:b5:a9:bf:91:3e:e9: 9b:35:09:ee:19:69:93:ce:d3:da:2d:4b:1e:a9:51: 50:36:87:d4:9c:30:25:3e:00:df:1d:2a:cf:89:c8: a4:23:2a:10:a5:d9:eb:c3:0e:6d:64:d3:7b:3a:0f: 62:9b:79:98:6d:7d:78:f4:0f:35:3c:c7:0c:83:32: 5a:ca:f7:eb:ff:6b:e4:04:c9:8f:ea:41:30:30:d2: 17:0a:ea:c3:63:4d:de:53:e3 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: FA:E5:84:70:4B:BA:E4:7E:F1:2C:7C:41:36:C4:10:DD:8C:75:60:E4 X509v3 Authority Key Identifier: keyid:FA:E5:84:70:4B:BA:E4:7E:F1:2C:7C:41:36:C4:10:DD:8C:75:60:E4 DirName:/C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=vanity.twisted-delusions.net/emailAddress=ssl@cpanel.net serial:00 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: md5WithRSAEncryption b6:4c:b4:8d:dd:80:f2:77:9c:e9:7c:a2:93:4d:7b:cd:6c:aa: e4:fd:00:db:05:86:01:4c:79:77:7d:dd:97:c7:67:55:09:fa: 06:67:9e:04:36:55:a2:5e:24:6a:cb:4d:9e:a1:85:1a:d7:6e: b7:39:17:31:12:ff:85:e7:c5:22:66:ed:47:6e:33:1d:1e:53: b4:07:af:ce:7e:48:7d:b2:f5:9a:ec:79:a0:31:18:02:f8:24: 21:7f:f4:f0:76:23:23:af:af:41:a1:0c:a2:2d:36:b1:c4:a1: 0c:6f:7c:53:ec:1c:fa:d4:06:b9:70:b3:f7:24:62:fa:d2:f6: 83:f0 This SSLv2 server also accepts SSLv3 connections. This SSLv2 server also accepts TLSv1 connections. Plugin ID : 10863 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See Also : http://www.openssl.org/docs/apps/ciphers.html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Here is a list of the SSL ciphers supported by the remote server : Export Ciphers SSLv2 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export SSLv3 EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1 EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Low Strength Ciphers (excluding export, < 128-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key) SSLv2 RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key) SSLv2 DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin ID : 21643 Synopsis : An SMTP server is listening on the remote port. Description : The remote host is running a mail (SMTP) server on this port. Since SMTP servers are the targets of spammers, it is recommended you disable it if you do not use it. Solution: Disable this service if you do not use it, or filter incoming traffic to this port. Risk Factor : None Plugin output : Remote SMTP server banner : 220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Sat, 05 May 2007 16:32:56 -0500 Plugin ID : 10263 For some reason, we could not send the 42.zip file to this MTA BID : 3027, 3027 Plugin ID : 11036 https (443/tcp) The remote host is using a version of OpenSSL which is older than 0.9.6m or 0.9.7d There are several bug in this version of OpenSSL which may allow an attacker to cause a denial of service against the remote host. Nessus solely relied on the banner of the remote host to issue this warning Solution: Upgrade to version 0.9.6m (0.9.7d) or newer Risk Factor : High CVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112 BID : 9899, 9899 Other references : IAVA:2004-B-0006 Plugin ID : 12110 It was possible to make the remote switch reboot by requesting : GET /cgi-bin/view-source?/ An attacker may use this flaw to prevent your network from working properly. Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml Risk Factor : High CVE : CVE-2000-0984, CVE-2000-0984 BID : 1838, 1838 Plugin ID : 10682 The remote host is using a version of OpenSSL which is older than 0.9.6j or 0.9.7b This version is vulnerable to a timing based attack which may allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of the server. An attacker may use this implementation flaw to sniff the data going to this host and decrypt some parts of it, as well as impersonate your server and perform man in the middle attacks. Nessus solely relied on the banner of the remote host to issue this warning See Also : http://www.openssl.org/news/secadv_20030219.txt http://lasecwww.epfl.ch/memo_ssl.shtml http://eprint.iacr.org/2003/052/ Solution: Upgrade to version 0.9.6j (0.9.7b) or newer Risk Factor : Medium CVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147 BID : 6884, 7148, 6884, 7148 Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024 Plugin ID : 11267 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a Solution: You can set the directive 'ServerTokens Prod' to limit the information emanating from the server in its response headers. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : no Pipelining : yes Keep-Alive : yes Options allowed : GET, HEAD, OPTIONS, TRACE Headers : Date: Sat, 05 May 2007 21:45:07 GMT Server: Apache/1.3.37 (Unix) mod_gzip/1.3.26.1a PHP/5.1.6 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.28 OpenSSL/0.9.7a Last-Modified: Fri, 13 Oct 2006 08:48:45 GMT ETag: "c9c06a-b2c-452f52ed" Accept-Ranges: bytes Content-Length: 2860 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html charset=iso-8859-5 Plugin ID : 24260 Synopsis : Debugging functions are enabled on the remote HTTP server. Description : The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. See Also : http://www.kb.cert.org/vuls/id/867593 Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Solution: Add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] CVE : CVE-2004-2320, CVE-2004-2320 BID : 9506, 9561, 11604, 9506, 9561, 11604 Plugin ID : 11213 domain (53/udp) Synopsis : The remote name server allows recursive queries to be performed by the host running nessusd. Description : It is possible to query the remote name server for third party names. If this is your internal nameserver, then forget this warning. If you are probing a remote nameserver, then it allows anyone to use it to resolve third parties names (such as www.nessus.org). This allows hackers to do cache poisoning attacks against this nameserver. If the host allows these recursive queries via UDP, then the host can be used to 'bounce' Denial of Service attacks against another network or system. See Also : http://www.cert.org/advisories/CA-1997-22.html Solution: Restrict recursive queries to the hosts that should use this nameserver (such as those of the LAN connected to it). If you are using bind 8, you can do this by using the instruction 'allow-recursion' in the 'options' section of your named.conf If you are using bind 9, you can define a grouping of internal addresses using the 'acl' command Then, within the options block, you can explicitly state: 'allow-recursion { hosts_defined_in_acl }' For more info on Bind 9 administration (to include recursion), see: http://www.nominum.com/content/documents/bind9arm.pdf If you are using another name server, consult its documentation. Risk Factor : Medium / CVSS Base Score : 4 (AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I) CVE : CVE-1999-0024, CVE-1999-0024 BID : 136, 678, 136, 678 Plugin ID : 10539 Synopsis : Remote DNS server is vulnerable to Cache Snooping attacks. Description : The remote DNS server answers to queries for third party domains which do not have the recursion bit set. This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have been recently visited. For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of aforementioned financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more... For a much more detailed discussion of the potential risks of allowing DNS cache information to be queried anonymously, please see: http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdf Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 12217 A DNS server is running on this port. If you do not use it, disable it. Risk Factor : Low Plugin ID : 11002 The remote name server could be fingerprinted as being : ISC BIND 9.2.3 Plugin ID : 11951 general/icmp Synopsis : It is possible to determine the exact time set on the remote host. Description : The remote host answers to an ICMP timestamp request. This allows an attacker to know the date which is set on your machine. This may help him to defeat all your time based authentication protocols. Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14). Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : The difference between the local and remote clocks is -7 seconds CVE : CVE-1999-0524, CVE-1999-0524 Plugin ID : 10114 general/udp For your information, here is the traceroute from 68.37.220.199 to 70.87.45.130 : 68.37.220.199 ? 68.86.219.193 68.86.209.177 68.86.208.5 68.86.90.37 4.71.172.121 4.68.97.62 4.69.132.93 4.69.132.29 4.69.132.85 4.69.134.21 4.68.122.48 4.71.122.2 70.87.253.14 70.87.253.74 67.18.116.69 70.87.45.130 Plugin ID : 10287 general/tcp The remote host, when queried on open ports, replies with differing TTL values. This could be an indicator that a transparent proxy is on the way, or that this host is a forwarding router, honeypot, etc... An attacker may use this information to find critical systems on your network Solution Contact vendor for information on closing up this information leak. Risk Factor : Low Plugin ID : 11858 70.87.45.130 resolves as 82.2d.5746.static.theplanet.com. Plugin ID : 12053 The remote host is running one of these operating systems : Linux Kernel 2.4 Linux Kernel 2.6 Plugin ID : 11936