Tenable Nessus Security Report Start Time: Mon May 07 16:14:20 2007 Finish Time: Mon May 07 16:51:38 2007 64.182.111.11 64.182.111.11 19 Open Ports, 75 Notes, 2 Warnings, 5 Holes. 64.182.111.11 [Return to top] cddbp-alt (8880/tcp) Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The following directories were discovered: /backup, /cgi-bin, /login, /cert, /docs, /filemanager, /help, /icons, /images, /javascript, /styles While this is not, in and of itself, a bug, you should manually inspect these directories to ensure that they are in compliance with company security standards Plugin ID : 11032 The remote web server type is : Apache/1.3.33 (FreeBSD) mod_ssl/2.8.22 OpenSSL/0.9.7e-p1 PHP/5.0.5 Solution: You can set the directive 'ServerTokens Prod' to limit the information emanating from the server in its response headers. Plugin ID : 10107 pop3s (995/tcp) Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A pop3 server is running on this port Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : A POP server is listening on the remote port Description : The remote host is running a POP server. Solution: Disable this service if you do not use it. Risk Factor : None Plugin output : Remote POP server banner : +OK Hello there. <84163.1178569381@localhost.localdomain> Plugin ID : 10185 imaps (993/tcp) Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 An IMAP server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : An IMAP server is running on the remote host. Description : An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. Risk Factor : None Plugin output : The remote imap server banner is : * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE AUTH=PLAIN ACL ACL2=UNION] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information. Plugin ID : 11414 glrpc (9080/tcp) Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : Apache-Coyote/1.1 and the 'ServerTokens' directive is ProductOnly Apache does not permit to hide the server type. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : no Pipelining : no Keep-Alive : no Options allowed : (Not implemented) Headers : Server: Apache-Coyote/1.1 Transfer-Encoding: chunked Date: Mon, 07 May 2007 20:31:37 GMT Connection: close Plugin ID : 24260 ajp13 (8009/tcp) Port is open Plugin ID : 11219 Synopsis : There is an AJP connector listening on the remote host. Description : The remote host is running an AJP (Apache JServ Protocol) connector, a service by which a standalone web server such as Apache communicates over TCP with a Java servlet container such as Tomcat. See Also : http://tomcat.apache.org/connectors-doc/ http://tomcat.apache.org/connectors-doc/common/ajpv13a.html Risk Factor : None Plugin output : The connector listing on this port supports the ajp13 protocol. Plugin ID : 21186 distinct (9999/tcp) Port is open Plugin ID : 11219 ndmp (10000/tcp) Port is open Plugin ID : 11219 mysql (3306/tcp) Port is open Plugin ID : 11219 Synopsis : A Database server is listening on the remote port. Description : The remote host is running MySQL, an open-source Database server. It is possible to extract the version number of the remote installation by receiving the server greeting. Solution: Restrict access to the database to allowed IPs only. Risk Factor : None Plugin output : The remote MySQL version is 4.1.22 Plugin ID : 10719 pcsync-https (8443/tcp) Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A web server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : The remote web server is affected by a denial of service flaw. Description : The installed version of Apache with mod_ssl on the remote host appears susceptible to a remote denial of service flaw under certain atypical configurations. A remote attacker may be able to exploit this issue to crash individual child processes or even the entire server, thereby denying service to legitimate users. See Also : http://issues.apache.org/bugzilla/show_bug.cgi?id=37791 Solution: Update the Apache configuration to use ''SSLRequire' whenever 'SSLCipherSuite' is used. Risk Factor : Low / CVSS Base Score : 3 (AV:R/AC:H/Au:NR/C:N/A:P/I:N/B:A) CVE : CVE-2005-3357, CVE-2005-3357 BID : 16152, 16152 Plugin ID : 20386 imap (143/tcp) Port is open Plugin ID : 11219 An IMAP server is running on this port Plugin ID : 10330 Synopsis : An IMAP server is running on the remote host. Description : An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. Risk Factor : None Plugin output : The remote imap server banner is : * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information. Plugin ID : 11414 pop3 (110/tcp) The remote pop3 server is vulnerable to the following buffer overflow : USER test PASS This *may* allow an attacker to execute arbitrary commands as root on the remote POP3 server. Solution: contact your vendor, inform it of this vulnerability, and ask for a patch Risk Factor : High CVE : CVE-1999-1511 BID : 791 Plugin ID : 10325 The remote POP3 server might be vulnerable to a buffer overflow bug when it is issued at least one of these commands, with a too long argument : auth user pass If confirmed, this problem might allow an attacker to execute arbitrary code on the remote system, thus giving him an interactive session on this host. Solution: If you do not use POP3, disable this service in /etc/inetd.conf and restart the inetd process. Otherwise, upgrade to a newer version. See Also : http://online.securityfocus.com/archive/1/27197 Risk Factor : High CVE : CVE-2002-0799, CVE-1999-0822 BID : 2781, 2811, 4055, 4295, 4614, 4789, 790, 830, 894, 942 Plugin ID : 10184 Port is open Plugin ID : 11219 A pop3 server is running on this port Plugin ID : 10330 Synopsis : A POP server is listening on the remote port Description : The remote host is running a POP server. Solution: Disable this service if you do not use it. Risk Factor : None Plugin output : Remote POP server banner : +OK AVG POP3 Proxy Server <84164.1178569382@localhost.localdomain> 7.5.460/7.5.467 [269.6.5/791] Plugin ID : 10185 http (80/tcp) It was possible to kill the HTTP proxy by sending an invalid request with a too long header A cracker may exploit this vulnerability to make your proxy server crash continually or even execute arbitrary code on your system. Solution: upgrade your software Risk Factor : High CVE : CVE-2002-0133, CVE-2002-0133 BID : 3904, 3905, 3904, 3905 Plugin ID : 11715 Requesting the URI /server-status gives information about the currently running Apache. Risk Factor : Low Solution: If you don't use this feature, comment the appropriate section in your httpd.conf file. If you really need it, limit its access to the administrator's machine. Plugin ID : 10677 Port is open Plugin ID : 11219 A web server is running on this port Plugin ID : 10330 The remote web server type is : Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8 Solution: You can set the directive 'ServerTokens Prod' to limit the information emanating from the server in its response headers. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : no Pipelining : yes Keep-Alive : yes Options allowed : GET,HEAD,POST,OPTIONS,TRACE Headers : Date: Mon, 07 May 2007 20:31:38 GMT Server: Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8 Last-Modified: Wed, 10 Jan 2007 19:43:09 GMT ETag: "b3d4c-dc3-df4a4d40" Accept-Ranges: bytes Content-Length: 3523 Vary: Accept-Encoding,User-Agent Keep-Alive: timeout=2 Connection: Keep-Alive Content-Type: text/html Plugin ID : 24260 Synopsis : Debugging functions are enabled on the remote HTTP server. Description : The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. See Also : http://www.kb.cert.org/vuls/id/867593 Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Solution: Add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] CVE : CVE-2004-2320, CVE-2004-2320 BID : 9506, 9561, 11604, 9506, 9561, 11604 Plugin ID : 11213 domain (53/tcp) Port is open Plugin ID : 11219 A DNS server is running on this port. If you do not use it, disable it. Risk Factor : Low Plugin ID : 11002 Synopsis : It is possible to obtain the version number of the remote DNS server. Description : The remote host is running BIND, an open-source DNS server. It is possible to extract the version number of the remote installation by sending a special DNS request for the text 'version.bind' in the domain 'chaos'. Solution: It is possible to hide the version number of bind by using the 'version' directive in the 'options' section in named.conf Risk Factor : None Plugin output: The version of the remote BIND server is : 9.3.2 Plugin ID : 10028 ssh (22/tcp) Port is open Plugin ID : 11219 An ssh server is running on this port Plugin ID : 10330 Remote SSH version : SSH-2.0-OpenSSH_4.2p1 FreeBSD-20060930 Remote SSH supported authentication : publickey,password,keyboard-interactive Plugin ID : 10267 The remote SSH daemon supports the following versions of the SSH protocol : . 1.99 . 2.0 SSHv2 host key fingerprint : d1:96:62:28:2a:96:a3:af:df:4b:bd:d3:18:64:d2:5b Plugin ID : 10881 ftp (21/tcp) It was possible to freeze or reboot Windows by reading a MS/DOS device through FTP, using a file name like CON\CON, AUX.htm or AUX. A cracker may use this flaw to make your system crash continuously, preventing you from working properly. Solution: upgrade your system or use a FTP server that filters those names out. Reference : http://support.microsoft.com/default.aspx?scid=KB en-us Q256015 Reference : http://online.securityfocus.com/archive/1/195054 Risk Factor : High Plugin ID : 10929 Port is open Plugin ID : 11219 An FTP server is running on this port. Here is its banner : 220 ProFTPD 1.3.0 Server (ProFTPD) [64.182.111.11] Plugin ID : 10330 Synopsis : An FTP server is listening on this port Description : It is possible to obtain the banner of the remote FTP server by connecting to the remote port. Risk Factor : None Plugin output : The remote FTP banner is : 220 ProFTPD 1.3.0 Server (ProFTPD) [64.182.111.11] Plugin ID : 10092 urd (465/tcp) Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 An SMTP server is running on this port through SSL Here is its banner : 220 ksdhost.com ESMTP Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : An SMTP server is listening on the remote port. Description : The remote host is running a mail (SMTP) server on this port. Since SMTP servers are the targets of spammers, it is recommended you disable it if you do not use it. Solution: Disable this service if you do not use it, or filter incoming traffic to this port. Risk Factor : None Plugin output : Remote SMTP server banner : 220 ksdhost.com ESMTP Plugin ID : 10263 For some reason, we could not send the 42.zip file to this MTA BID : 3027, 3027 Plugin ID : 11036 https (443/tcp) There is a buffer overflow in the remote IIS web server. It is possible to overflow the remote Web server and execute commands as the SYSTEM user. At attacker may make use of this vulnerability and use it to gain access to confidential data and/or escalate their privileges on the Web server. See http://www.eeye.com/html/Research/Advisories/AD20010501.html for more details. Solution See http://www.microsoft.com/technet/security/bulletin/ms01-023.mspx Risk Factor : High CVE : CVE-2001-0241, CVE-2001-0241 BID : 2674, 2674 Other references : IAVA:2001-a-0005 Plugin ID : 10657 Requesting the URI /server-status gives information about the currently running Apache. Risk Factor : Low Solution: If you don't use this feature, comment the appropriate section in your httpd.conf file. If you really need it, limit its access to the administrator's machine. Plugin ID : 10677 Port is open Plugin ID : 11219 A SSLv2 server answered on this port Plugin ID : 10330 A web server is running on this port through SSL Plugin ID : 10330 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See Also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 20007 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See Also : http://www.openssl.org/docs/apps/ciphers.html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Here is a list of the SSL ciphers supported by the remote server : Export Ciphers SSLv2 EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export SSLv3 EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export TLSv1 EXP-EDH-RSA-DES-CBC-SHA Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP1024-DES-CBC-SHA Kx=RSA(1024) Au=RSA Enc=DES(56) Mac=SHA1 export EXP1024-RC2-CBC-MD5 Kx=RSA(1024) Au=RSA Enc=RC2(56) Mac=MD5 export EXP1024-RC4-MD5 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=MD5 export EXP1024-RC4-SHA Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export EXP-DES-CBC-SHA Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export Low Strength Ciphers (excluding export, < 128-bit key) SSLv2 DES-CBC-MD5 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 RC4-64-MD5 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 SSLv3 EDH-RSA-DES-CBC-SHA Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 TLSv1 EDH-RSA-DES-CBC-SHA Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-SHA Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 Medium Strength Ciphers (128-bit key) SSLv2 RC2-CBC-MD5 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 SSLv3 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 TLSv1 RC4-MD5 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-SHA Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 High Strength Ciphers (> 128-bit key) SSLv2 DES-CBC3-MD5 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 SSLv3 EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 TLSv1 EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES256-SHA Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DES-CBC3-SHA Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 AES128-SHA Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 The fields above are : {OpenSSL ciphername} Kx={key exchange} Au={authentication} Enc={symmetric encryption method} Mac={message authentication code} {export flag} Plugin ID : 21643 Here is the SSLv2 server certificate: Certificate: Data: Version: 1 (0x0) Serial Number: 1168330910 (0x45a3509e) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Virginia, L=Herndon, O=SWsoft, Inc., OU=Plesk, CN=plesk/emailAddress=info@plesk.com Validity Not Before: Jan 9 08:21:54 2007 GMT Not After : Jan 9 08:21:54 2008 GMT Subject: C=US, ST=Virginia, L=Herndon, O=SWsoft, Inc., OU=Plesk, CN=plesk/emailAddress=info@plesk.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:ba:ac:4c:fc:8c:c1:30:96:ab:75:85:67:62:d2: 0a:45:1c:79:ae:84:8b:c6:50:5c:a2:88:fb:99:a4: 61:f6:b3:23:b3:5b:90:ef:00:45:be:7e:cf:1b:0d: ef:b9:60:c5:b6:23:77:42:55:11:fc:d6:c2:c1:ce: 8a:41:05:bd:b7:29:1b:8e:35:b0:03:74:e2:3a:c4: 05:b6:91:08:50:55:7d:ee:a3:7a:c6:13:11:45:47: be:1a:9b:13:d8:e3:c4:a3:b7:d6:e1:cb:ee:f2:a2: be:34:ff:1b:49:4d:53:f7:88:28:c3:81:97:b5:5b: f0:b6:ab:89:5d:50:0c:b7:e5:fc:2f:6a:26:fd:c6: d7:5d:df:e1:02:02:9b:a4:80:43:48:da:65:46:4f: 71:1d:78:42:94:b5:31:c8:34:f4:83:06:1a:9e:b0: 4d:1e:fd:af:4d:97:e0:17:a7:b8:50:03:d0:b3:38: 11:a9:f1:14:6c:fb:91:5a:1a:e7:29:25:15:59:9b: 60:64:28:c7:44:4c:b1:80:c8:62:6c:c2:a5:b8:cd: e6:51:d9:6e:0f:17:74:60:b6:e9:6b:8e:14:1d:87: 29:f6:79:c0:2e:41:d5:e7:a5:14:de:d1:0c:09:48: 44:66:d8:fb:1a:db:1b:d9:69:df:6e:cc:df:ce:bd: dc:e3 Exponent: 65537 (0x10001) Signature Algorithm: md5WithRSAEncryption b1:de:9c:19:1f:ea:bc:08:12:1e:c1:b8:54:51:9b:fc:7e:6d: e6:dd:8e:78:7b:45:32:06:0b:d3:e4:a6:6d:16:f7:33:9b:46: 27:dc:4b:b4:eb:8b:93:45:63:82:25:4e:e5:b3:43:7a:cd:3e: 30:59:82:25:e3:14:98:a3:82:13:77:74:e7:54:0d:9d:7a:49: 53:4e:83:99:de:0a:c8:87:2a:94:3d:76:19:ea:20:71:f1:01: c6:33:69:e4:48:30:e8:52:b1:a0:7e:72:55:fa:e0:38:59:ba: 1d:6a:0f:b7:d4:85:eb:70:7a:5f:5b:82:81:64:b7:b6:05:f0: df:90:22:93:67:1b:30:7c:f2:e3:d6:36:62:86:2b:70:ef:0f: 5b:94:23:87:fd:c3:a8:ae:15:66:86:5e:40:54:ca:23:3b:45: c6:c1:b0:c6:bb:92:3d:11:ad:d6:9f:0d:18:43:18:59:cb:dc: 90:83:69:fe:78:75:26:f5:cf:6b:92:04:6d:99:3e:c9:23:01: 4d:92:90:97:21:5f:98:6a:1e:9e:1b:c5:d0:4b:3d:60:30:cc: de:00:58:48:65:d0:e5:22:f1:75:5d:42:57:19:25:c6:3c:01: c8:ff:bd:8d:02:f6:6c:e8:8e:a5:eb:93:9c:06:da:c5:3c:cc: bf:6c:01:74 This SSLv2 server also accepts SSLv3 connections. This SSLv2 server also accepts TLSv1 connections. Plugin ID : 10863 The following directories were discovered: /cgi-bin, /css, /icons, /img, /manual, /server-status While this is not, in and of itself, a bug, you should manually inspect these directories to ensure that they are in compliance with company security standards Plugin ID : 11032 The remote web server type is : Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8 Solution: You can set the directive 'ServerTokens Prod' to limit the information emanating from the server in its response headers. Plugin ID : 10107 Synopsis : Some information about the remote HTTP configuration can be extracted. Description : This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are enabled, etc... This test is informational only and does not denote any security problem Solution: None. Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : Protocol version : HTTP/1.1 SSL : yes Pipelining : yes Keep-Alive : yes Options allowed : GET,HEAD,POST,OPTIONS,TRACE Headers : Date: Mon, 07 May 2007 20:31:37 GMT Server: Apache/2.0.59 (FreeBSD) PHP/5.2.0 with Suhosin-Patch mod_jk/1.2.19 mod_ssl/2.0.59 OpenSSL/0.9.7e-p1 mod_perl/2.0.3 Perl/v5.8.8 Last-Modified: Wed, 10 Jan 2007 19:43:09 GMT ETag: "b3e0d-dc3-df4a4d40" Accept-Ranges: bytes Content-Length: 3523 Vary: Accept-Encoding,User-Agent Keep-Alive: timeout=2 Connection: Keep-Alive Content-Type: text/html Plugin ID : 24260 Synopsis : Debugging functions are enabled on the remote HTTP server. Description : The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. See Also : http://www.kb.cert.org/vuls/id/867593 Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin output : Solution: Add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] CVE : CVE-2004-2320, CVE-2004-2320 BID : 9506, 9561, 11604, 9506, 9561, 11604 Plugin ID : 11213 Synopsis : The remote web server is affected by a denial of service flaw. Description : The installed version of Apache with mod_ssl on the remote host appears susceptible to a remote denial of service flaw under certain atypical configurations. A remote attacker may be able to exploit this issue to crash individual child processes or even the entire server, thereby denying service to legitimate users. See Also : http://issues.apache.org/bugzilla/show_bug.cgi?id=37791 Solution: Update the Apache configuration to use ''SSLRequire' whenever 'SSLCipherSuite' is used. Risk Factor : Low / CVSS Base Score : 3 (AV:R/AC:H/Au:NR/C:N/A:P/I:N/B:A) CVE : CVE-2005-3357, CVE-2005-3357 BID : 16152, 16152 Plugin ID : 20386 domain (53/udp) Synopsis : Remote DNS server is vulnerable to Cache Snooping attacks. Description : The remote DNS server answers to queries for third party domains which do not have the recursion bit set. This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have been recently visited. For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of aforementioned financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more... For a much more detailed discussion of the potential risks of allowing DNS cache information to be queried anonymously, please see: http://community.sidestep.pt/~luis/DNS-Cache-Snooping/DNS_Cache_Snooping_1.1.pdf Risk Factor : Low / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) Plugin ID : 12217 A DNS server is running on this port. If you do not use it, disable it. Risk Factor : Low Plugin ID : 11002 The remote name server could be fingerprinted as being : ISC BIND 9.2.3 Plugin ID : 11951 general/icmp Synopsis : It is possible to determine the exact time set on the remote host. Description : The remote host answers to an ICMP timestamp request. This allows an attacker to know the date which is set on your machine. This may help him to defeat all your time based authentication protocols. Solution: filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14). Risk Factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N) Plugin output : The difference between the local and remote clocks is -2 seconds CVE : CVE-1999-0524, CVE-1999-0524 Plugin ID : 10114 Here is the route recorded between 68.37.220.199 and 64.182.111.11 : 68.86.209.178. 68.86.208.6. 68.86.211.1. 12.119.12.18. 12.123.219.185. 12.122.80.238. 192.205.32.197. 206.24.194.103. 208.172.2.99. Plugin ID : 12264 general/udp For your information, here is the traceroute from 68.37.220.199 to 64.182.111.11 : 68.37.220.199 ? 68.86.219.193 68.86.209.177 68.86.208.5 68.86.211.2 12.118.149.9 12.123.3.14 12.123.0.101 192.205.32.198 204.70.192.101 208.175.10.254 204.70.196.26 204.70.194.241 208.174.226.42 208.174.226.42 64.182.111.11 Plugin ID : 10287 ntp (123/udp) It is possible to determine a lot of information about the remote host by querying the NTP (Network Time Protocol) variables - these include OS descriptor, and time settings. It was possible to gather the following information from the remote NTP host : version='ntpd 4.2.0-a Tue Dec 26 20:32:40 UTC 2006 (1)', processor='i386', system='FreeBSD/6.1-RELEASE-p11', leap=0, stratum=2, precision=-19, rootdelay=46.470, rootdispersion=106.542, peer=4697, refid=128.10.252.7, reftime=0xc9ea0814.ec4b47eb, poll=10, clock=0xc9ea083c.9d61dbf0, state=4, offset=-22.295, frequency=-107.946, jitter=53.423, stability=2.527 Quickfix: Set NTP to restrict default access to ignore all info packets: restrict default ignore Risk Factor : Low Plugin ID : 10884 general/tcp The remote host is running FreeBSD /6.1-RELEASE-p11 (i386) Plugin ID : 11936