Tenable Nessus Security Report  
 
 
Start Time: Mon May 07 15:26:52 2007  Finish Time: Mon May 07 16:06:10 2007  
 
 
 
70.87.45.130 
 
 
70.87.45.130 21 Open Ports, 51 Notes, 4 Warnings, 4 Holes.  
 
 
 
 
70.87.45.130 [Return to top] 
 
pop3s (995/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
imaps (993/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 A TLSv1 server answered on this port

Plugin ID : 10330

 
 
 
 
 
distinct (9999/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
mysql (3306/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 Synopsis :

A Database server is listening on the remote port.



Description :

The remote host is running MySQL, an open-source Database server.
The remote database access is restricted and configured to reject
access from not allowed IPs. Therefor it was not possible to extract
its version number.



Risk Factor :

None
Plugin ID : 10719


 
 
 
 
 
imap (143/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
sunrpc (111/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
pop3 (110/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
http (80/tcp) 
 
  
 The remote host is using a version of OpenSSL which is
older than 0.9.6m or 0.9.7d

There are several bug in this version of OpenSSL which may allow
an attacker to cause a denial of service against the remote host.

Nessus solely relied on the banner of the remote host
to issue this warning


Solution: Upgrade to version 0.9.6m (0.9.7d) or newer


Risk Factor : High
CVE : CVE-2004-0079, CVE-2004-0081, CVE-2004-0112, CVE-2004-0079, CVE-2004-0081, CVE-2004-0112
BID : 9899, 9899
Other references : IAVA:2004-B-0006
Plugin ID : 12110


 
 
 
 The remote host is using a version of OpenSSL which is
older than 0.9.6j or 0.9.7b

This version is vulnerable to a timing based attack which may
allow an attacker to guess the content of fixed data blocks and
may eventually be able to guess the value of the private RSA key
of the server.

An attacker may use this implementation flaw to sniff the
data going to this host and decrypt some parts of it, as well
as impersonate your server and perform man in the middle attacks.

Nessus solely relied on the banner of the remote host
to issue this warning


See Also : http://www.openssl.org/news/secadv_20030219.txt
http://lasecwww.epfl.ch/memo_ssl.shtml
http://eprint.iacr.org/2003/052/



Solution: Upgrade to version 0.9.6j (0.9.7b) or newer


Risk Factor : Medium
CVE : CVE-2003-0078, CVE-2003-0131, CVE-2003-0147, CVE-2003-0078, CVE-2003-0131, CVE-2003-0147
BID : 6884, 7148, 6884, 7148
Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024
Plugin ID : 11267


 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A web server is running on this port
Plugin ID : 10330

 
 
 
 
 
nbx-ser (2095/tcp) 
 
  
 It was possible to make the remote switch reboot by requesting :

GET /cgi-bin/view-source?/


An attacker may use this flaw to prevent your network from working
properly.


Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml


Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682


 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A web server is running on this port
Plugin ID : 10330

 
 
 
 
 
eli (2087/tcp) 
 
  
 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!
Plugin ID : 15901

 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A SSLv2 server answered on this port

Plugin ID : 10330

 
 
 
 Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses. 



Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients. 



See Also :

http://www.schneier.com/paper-ssl.pdf



Solution: 

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007


 
 
 
 
 
gnunet (2086/tcp) 
 
  
 It was possible to make the remote switch reboot by requesting :

GET /cgi-bin/view-source?/


An attacker may use this flaw to prevent your network from working
properly.


Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml


Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682


 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A web server is running on this port
Plugin ID : 10330

 
 
 
 
 
radsec (2083/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 A SSLv2 server answered on this port

Plugin ID : 10330

 
 
 
 Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses. 



Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients. 



See Also :

http://www.schneier.com/paper-ssl.pdf



Solution: 

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007


 
 
 
 
 
infowave (2082/tcp) 
 
  
 It was possible to make the remote switch reboot by requesting :

GET /cgi-bin/view-source?/


An attacker may use this flaw to prevent your network from working
properly.


Solution: see http://www.cisco.com/warp/public/707/httpserverquery-pub.shtml


Risk Factor : High
CVE : CVE-2000-0984, CVE-2000-0984
BID : 1838, 1838
Plugin ID : 10682


 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A web server is running on this port
Plugin ID : 10330

 
 
 
 
 
domain (53/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 A DNS server is running on this port. If you do not use it, disable it.


Risk Factor : Low
Plugin ID : 11002


 
 
 
 Synopsis :

It is possible to obtain the version number of the remote DNS server.



Description :

The remote host is running BIND, an open-source DNS server. It is possible
to extract the version number of the remote installation by sending
a special DNS request for the text 'version.bind' in the domain 'chaos'.



Solution:

It is possible to hide the version number of bind by using the 'version'
directive in the 'options' section in named.conf



Risk Factor : 

None



Plugin output:

The version of the remote BIND server is : 9.2.4
Plugin ID : 10028


 
 
 
 
 
nbx-dir (2096/tcp) 
 
  
 The SSL certificate of the remote service expired Apr 22 23:16:50 2007 GMT!
Plugin ID : 15901

 
 
 
 Port is open
Plugin ID : 11219

 
 
 
 A SSLv2 server answered on this port

Plugin ID : 10330

 
 
 
 Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses. 



Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients. 



See Also :

http://www.schneier.com/paper-ssl.pdf



Solution: 

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007


 
 
 
 Synopsis :

The remote service supports the use of weak SSL ciphers.



Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.



See Also :

http://www.openssl.org/docs/apps/ciphers.html



Solution:

Reconfigure the affected application if possible to avoid use of 
weak ciphers.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)



Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export 
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export 
TLSv1
EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export 
EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export 
EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export 
EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export 

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 
SSLv3
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 
TLSv1
DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 
SSLv3
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 
TLSv1
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 
RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 

High Strength Ciphers (> 128-bit key)
SSLv3
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 
TLSv1
DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 
AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 
AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643


 
 
 
 
 
tcpmux (1/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 The service closed the connection after 0 seconds without sending any data
It might be protected by some TCP wrapper

Plugin ID : 10330

 
 
 
 
 
ssh (22/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 An ssh server is running on this port
Plugin ID : 10330

 
 
 
 
 
ftp (21/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 
 
urd (465/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 A SSLv3 server answered on this port

Plugin ID : 10330

 
 
 
 An SMTP server is running on this port through SSL
Here is its banner : 
220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Mon, 07 May 2007 14:28:40 -0500 
Plugin ID : 10330

 
 
 
 Synopsis :

The remote service supports the use of weak SSL ciphers.



Description :

The remote host supports the use of SSL ciphers that
offer either weak encryption or no encryption at all.



See Also :

http://www.openssl.org/docs/apps/ciphers.html



Solution:

Reconfigure the affected application if possible to avoid use of 
weak ciphers.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)



Plugin output :

Here is a list of the SSL ciphers supported by the remote server :

Export Ciphers
SSLv2
EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export 
EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export 

Low Strength Ciphers (excluding export, < 128-bit key)
SSLv2
DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 
RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 

Medium Strength Ciphers (128-bit key)
SSLv2
RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 
RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 

High Strength Ciphers (> 128-bit key)
SSLv2
DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Plugin ID : 21643


 
 
 
 Synopsis :

The remote service encrypts traffic using a protocol with known
weaknesses. 



Description :

The remote service accepts connections encrypted using SSL 2.0, which
reportedly suffers from several cryptographic flaws and has been
deprecated for several years. An attacker may be able to exploit these
issues to conduct man-in-the-middle attacks or decrypt communications
between the affected service and clients. 



See Also :

http://www.schneier.com/paper-ssl.pdf



Solution: 

Consult the application's documentation to disable SSL 2.0 and use SSL
3.0 or TLS 1.0 instead.



Risk Factor : 

Low / CVSS Base Score : 2 
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin ID : 20007


 
 
 
 Synopsis :

An SMTP server is listening on the remote port.



Description :

The remote host is running a mail (SMTP) server on this port.

Since SMTP servers are the targets of spammers, it is recommended you 
disable it if you do not use it.



Solution: 

Disable this service if you do not use it, or filter incoming traffic 
to this port.



Risk Factor : 

None



Plugin output :

Remote SMTP server banner :
220-vanity.twisted-delusions.net ESMTP Exim 4.63 #1 Mon, 07 May 2007 14:28:40 -0500 
Plugin ID : 10263


 
 
 
 For some reason, we could not send the 42.zip file to this MTA
BID : 3027, 3027
Plugin ID : 11036

 
 
 
 
 
https (443/tcp) 
 
  
 Port is open
Plugin ID : 11219

 
 
 
 A web server is running on this port
Plugin ID : 10330

 
 
 
 
 
general/icmp 
 
  
 Synopsis :

It is possible to determine the exact time set on the remote host.



Description :

The remote host answers to an ICMP timestamp request. This allows an attacker 
to know the date which is set on your machine. 

This may help him to defeat all your time based authentication protocols.



Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP 
timestamp replies (14).



Risk Factor :

None / CVSS Base Score : 0 
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)



Plugin output :

The difference between the local and remote clocks is -5 seconds

CVE : CVE-1999-0524, CVE-1999-0524
Plugin ID : 10114


 
 
 
 
 
domain (53/udp) 
 
  
 Synopsis :

The remote name server allows recursive queries to be performed
by the host running nessusd.




Description :

It is possible to query the remote name server for third party names.

If this is your internal nameserver, then forget this warning.

If you are probing a remote nameserver, then it allows anyone
to use it to resolve third parties names (such as www.nessus.org).
This allows hackers to do cache poisoning attacks against this
nameserver.

If the host allows these recursive queries via UDP,
then the host can be used to 'bounce' Denial of Service attacks
against another network or system.



See Also : 

http://www.cert.org/advisories/CA-1997-22.html



Solution: 

Restrict recursive queries to the hosts that should
use this nameserver (such as those of the LAN connected to it).

If you are using bind 8, you can do this by using the instruction
'allow-recursion' in the 'options' section of your named.conf

If you are using bind 9, you can define a grouping of internal addresses
using the 'acl' command

Then, within the options block, you can explicitly state:
'allow-recursion { hosts_defined_in_acl }'

For more info on Bind 9 administration (to include recursion), see: 
http://www.nominum.com/content/documents/bind9arm.pdf

If you are using another name server, consult its documentation.



Risk Factor :

Medium / CVSS Base Score : 4 
(AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I)
CVE : CVE-1999-0024, CVE-1999-0024
BID : 136, 678, 136, 678
Plugin ID : 10539


 
 
 
 A DNS server is running on this port. If you do not use it, disable it.


Risk Factor : Low
Plugin ID : 11002


 
 
 
 Nessus was not able to reliable identify the remote DNS server type.
It might be :
ISC BIND 9.2.2
The fingerprint differs from these known signatures on 2 points.
If you know which DNS server this host is actually running, please send this signature to 
dns-signatures@nessus.org : 
4q:5:t:1q:1:1q:1q:1q:1q:0X:0AAXD:0X:0X:0X:0X:0X:4q:4q:4q:0X:0X:5:0AAXD:
Plugin ID : 11951

 
 
 
 
 
general/udp 
 
  
 For your information, here is the traceroute from 68.37.220.199 to 70.87.45.130 : 
68.37.220.199
?
68.86.219.193
68.86.209.177
68.86.208.5
68.86.90.37
4.71.172.121
4.68.97.62
4.69.132.93
4.69.132.29
4.69.132.85
4.69.134.21
4.71.122.2
70.87.253.30
70.87.253.74
67.18.116.69
70.87.45.130

Plugin ID : 10287

 
 
 
 
 
general/tcp 
 
  
 The remote host, when queried on open ports, replies with differing TTL values. This could be an 
indicator that a transparent proxy is on the way, or that this host is a forwarding router, 
honeypot, etc...

An attacker may use this information to find critical systems on your network 

Solution Contact vendor for information on closing up this information leak. 



Risk Factor : Low
Plugin ID : 11858


 
 
 
 70.87.45.130 resolves as 82.2d.5746.static.theplanet.com.
Plugin ID : 12053

 
 
 
 The remote host is running one of these operating systems : 
Linux Kernel 2.4
Linux Kernel 2.6
Plugin ID : 11936