Environment
Novell ZENworks Linux Management
Novell ZENworks 7 Linux Management - ZLM7
Resolution
The
remote SSH daemon supports connections made
using the version 1.33 and/or 1.5 of the SSH
protocol.
These protocols are not completely
cryptographically
safe so they should not be used.
Solution :
If you use OpenSSH, set the option'Protocol' to '2'
If you use SSH.com's set the option'Ssh1Compatibility' to 'no'
Risk factor : Low
. Information found on port ssh (22/tcp)
An
ssh server is running on this port
. Information found on port ssh (22/tcp)
Remote SSH version : SSH-1.99-OpenSSH_4.1
Remote SSH supported authentication :
publickey,keyboard-interactive
. Information found on port ssh (22/tcp)
The
remote SSH daemon supports the following versions of the
SSH protocol :
. 1.33
. 1.5
. 1.99
. 2.0
SSHv1 host key fingerprint :
31:dc:e3:e0:d0:d0:51:91:49:35:d0:4d:d3:d9:17:6f
SSHv2 host key fingerprint :
12:90:03:0f:47:85:91:9e:90:34:38:4d:3b:fa:59:65
. Warning found on port http (80/tcp)
The remote web server seems to be
vulnerable to the Cross Site Scripting
vulnerability (XSS). The vulnerability is
caused
by the result returned to the user when a
non-existing file is requested
(e.g. the result contains the JavaScript
provided
in the request).
The vulnerability would allow an attacker to
make the server present the
user with the attacker's JavaScript/HTML
code.
Since the content is presented by the server,
the user will give it the
trust
level of the server (for example, the trust
level of banks, shopping
centers, etc. would usually be
high).
Sample url :http://ipaddress:80/>
Risk factor : Medium
Solutions:
. Allaire/Macromedia Jrun:
-http://www.macromedia.com/software/jrun/download/update/
-
http://www.securiteam.com/windowsntfocus/Allaire_fixes_Cross-Site_Scripting_security_vulnerability.html
. Apache:
-http://httpd.apache.org/info/css-security/
CVE :
CVE-2002-1060
BID : 5305, 7344, 7353, 8037, 9245
. Information found on port http (80/tcp)
A
web server is running on this port
. Information found on port http (80/tcp)
The
remote web server type is :
Apache-Coyote/1.1
and the 'ServerTokens' directive is
ProductOnly
Apache does not permit to hide the server
type.
. Information found on port http (80/tcp)
Synopsis :
The remote Apache server can be used to guess
the presence of a given user
name on the remote host.
Description :
When configured with the 'UserDir' option,
requests to URLs containing a
tilde
followed by a username will redirect the user to
a given subdirectory in the
user home.
For instance, by default, requesting /~root/
displays the HTML contents from
/root/public_html/.
If the username requested does not exist, then
Apache will reply with a
different error code. Therefore, an attacker may
exploit this vulnerability
to guess the presence of a given user name on
the remote host.
Solution :
In httpd.conf, set the 'UserDir' to'disabled'.
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
CVE : CVE-2001-1013
BID : 3335
. Information found on port sunrpc (111/tcp)
The RPC portmapper is running on this
port.
An attacker may use it to enumerate your
list
of RPC services. We recommend you filter
traffic
going to this port.
Risk factor : Low
CVE : CAN-1999-0632, CVE-1999-0189
BID : 205
. Information found on port sunrpc (111/tcp)
RPC
program #100000 version 2 'portmapper' (portmap sunrpc rpcbind)
is
running on this port
. Warning found on port https (443/tcp)
The remote web server seems to be
vulnerable to the Cross Site Scripting
vulnerability (XSS). The vulnerability is
caused
by the result returned to the user when a
non-existing file is requested
(e.g. the result contains the JavaScript
provided
in the request).
The vulnerability would allow an attacker to
make the server present the
user with the attacker's JavaScript/HTML
code.
Since the content is presented by the server,
the user will give it the
trust
level of the server (for example, the trust
level of banks, shopping
centers, etc. would usually be
high).
Sample url :http://ipaddress:443/>
Risk factor : Medium
Solutions:
. Allaire/Macromedia Jrun:
-http://www.macromedia.com/software/jrun/download/update/
-
http://www.securiteam.com/windowsntfocus/Allaire_fixes_Cross-Site_Scripting_security_vulnerability.html
. Apache:
-http://httpd.apache.org/info/css-security/
CVE :
CVE-2002-1060
BID : 5305, 7344, 7353, 8037, 9245
. Information found on port https (443/tcp)
A
TLSv1 server answered on this port
. Information found on port https (443/tcp)
A
web server is running on this port through SSL
. Information found on port https (443/tcp)
Here
is the SSLv3 server certificate:
Certificate:
Data:
Version: 1 (0x0)
Serial Number: 1141952909 (0x4410d18d)
Signature Algorithm: md5WithRSAEncryption
Issuer: CN=btinc21.rav.com
Validity
Not Before: Mar 10 01:08:29 2006 GMT
Not After : Mar 10 01:08:29 2007 GMT
Subject: CN=btinc21.rav.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:e8:ca:67:5c:42:70:06:e0:6a:27:f8:cd:61:3a:
bc:b4:1c:2d:12:28:a2:59:74:e8:f8:c5:d5:15:da:
05:b5:6b:dd:c9:45:87:37:3a:96:79:19:d6:31:1c:
9d:99:74:0d:b7:8a:15:5e:12:cb:95:d4:2c:d9:b8:
1e:6f:5f:a0:30:5e:2e:fd:8f:81:04:0d:b8:12:35:
91:0d:cf:68:61:91:80:47:0f:45:ed:a1:45:74:ce:
c9:e2:b7:40:86:63:07:8e:dd:1c:5e:1a:b0:bf:bd:
ae:29:63:09:85:49:96:e8:10:fb:9d:a6:ba:9e:6f:
7d:9e:c4:f0:de:d9:04:ac:19
Exponent: 65537 (0x10001)
Signature Algorithm:
md5WithRSAEncryption
e7:8f:c7:9c:ee:ba:4c:ae:0c:c7:5c:59:e5:96:f3:c6:58:1c:
db:91:b7:2b:d5:d5:51:1d:9a:e9:21:1b:29:25:b3:82:dc:d7:
a5:4f:30:6f:b2:ed:c5:73:e1:b5:18:96:7d:d5:58:13:f3:43:
6e:da:96:79:54:0a:c3:13:c1:8a:fa:a1:99:bc:59:48:6c:e4:
ec:8a:ba:94:3c:27:91:6e:16:cf:8d:d0:6d:79:13:1a:5f:ce:
4c:c3:13:15:95:2b:65:96:41:35:38:7f:da:e9:70:0b:90:21:
7d:5c:f9:26:2e:4b:95:68:99:4b:ad:28:cd:fb:03:7b:16:40:
59:15
This TLSv1 server does not accept SSLv2
connections.
This TLSv1 server also accepts SSLv3
connections.
. Information found on port https (443/tcp)
The
remote web server type is :
Apache-Coyote/1.1
and the 'ServerTokens' directive is
ProductOnly
Apache does not permit to hide the server
type.
. Information found on port https (443/tcp)
Synopsis :
The remote Apache server can be used to guess
the presence of a given user
name on the remote host.
Description :
When configured with the 'UserDir' option,
requests to URLs containing a
tilde
followed by a username will redirect the user to
a given subdirectory in the
user home.
For instance, by default, requesting /~root/
displays the HTML contents from
/root/public_html/.
If the username requested does not exist, then
Apache will reply with a
different error code. Therefore, an attacker may
exploit this vulnerability
to guess the presence of a given user name on
the remote host.
Solution :
In httpd.conf, set the 'UserDir' to'disabled'.
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
CVE : CVE-2001-1013
BID : 3335
. Information found on port ncp (524/tcp)
Synopsis :
Remote directory server leaks information.
Description :
This host is a Novell Netware (eDirectory) server, and has browse
rights on the PUBLIC object.
It is possible to enumerate all NDS objects, including users, with
crafted queries. An attacker can use this to gain information about
this host.
Solution :
The NDS object PUBLIC should not have Browse rights the tree should
be restricted to authenticated users only.
Removing Browse rights from the object will fix this issue. If this
is an external system it is recommended that access
to port 524 be blocked from the Internet.
Risk factor :
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Plugin output :
It was possible to gather the following information about the
remote host :
Server Name:
. Information found on port ipp (631/tcp)
The
service closed the connection after 0 seconds without sending any
data
It might be protected by some TCP wrapper
. Information found on port novell-zen (2544/tcp)
A
web server seems to be running on this port
. Information found on port postgresql (5432/tcp)
An
unknown service is running on this port.
It is usually reserved for Postgres
. Warning found on port http-alt (8008/tcp)
The remote web server seems to be
vulnerable to the Cross Site Scripting
vulnerability (XSS). The vulnerability is
caused
by the result returned to the user when a
non-existing file is requested
(e.g. the result contains the JavaScript
provided
in the request).
The vulnerability would allow an attacker to
make the server present the
user with the attacker's JavaScript/HTML
code.
Since the content is presented by the server,
the user will give it the
trust
level of the server (for example, the trust
level of banks, shopping
centers, etc. would usually be
high).
Sample url :
http://ipaddress:8008/foo.jsp?param=.jsp
Risk factor : Medium
Solutions:
. Allaire/Macromedia Jrun:
-http://www.macromedia.com/software/jrun/download/update/
-
http://www.securiteam.com/windowsntfocus/Allaire_fixes_Cross-Site_Scripting_security_vulnerability.html
CVE :
CVE-2002-1060
BID : 5305, 7344, 7353, 8037, 9245
. Warning found on port http-alt (8008/tcp)
The remote host is running UBB.threads, a
bulletin board system written in
PHP.
There are various cross-site scripting issues in
the remote version of this
software. An attacker may exploit them to use
the remote website to conduct
attacks against third parties.
Solution : Upgrade to the latest version of this
software
Risk factor : Medium
BID : 11900
. Information found on port http-alt (8008/tcp)
A
web server is running on this port
. Information found on port http-alt (8008/tcp)
The
remote web server type is :
DHost/9.0 HttpStk/1.0
. Information found on port sunrpc (111/udp)
RPC
program #100000 version 2 'portmapper' (portmap sunrpc rpcbind)
is
running on this port
. Warning found on port general/tcp
The remote host does not discard TCP SYN packets
which
have the FIN flag set.
Depending on the kind of firewall you are using,
an
attacker may use this flaw to bypass its
rules.
See also :http://archives.neohapsis.com/archives/bugtraq/2002-10/0266.html
http://www.kb.cert.org/vuls/id/464113
Solution : Contact your vendor for a patch
Risk factor : Medium
BID : 7487
. Information found on port general/tcp
The
remote host is running one of these operating systems :
Linux Kernel 2.6
Linux Kernel 2.4
. Information found on port general/tcp
Information about this scan :
Nessus version : Unknown (NASL_LEVEL=2201)
Plugin feed version : 200603171215
Type of plugin feed : GPL only
Scanner IP : 151.155.185.104
Port range : default
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report Verbosity : 1
Safe checks : yes
Max hosts : 20
Max checks : 4
Scan duration : unknown (ping_host.nasl not
launched?)
. Information found on port tftp (69/udp)
The remote host is running a tftpd server.
Solution : If you do not use this service, you
should disable it.
Risk factor : Low
. Warning found on port general/icmp
The remote host answers to an ICMP timestamp
request. This allows an
attacker
to know the date which is set on your
machine.
This may help him to defeat all your time based
authentication protocols.
Solution : filter out the ICMP timestamp
requests (13), and the outgoing
ICMP
timestamp replies (14).
Risk factor : Low
CVE : CAN-1999-0524
. Information found on port unknown (5900/tcp)
The
remote VNC server chose security type #2 (VNC
authentication)
.
Information found on port general/udp