Slashdot Mirror

← Back to Domains

Domain: nessus.org

Stories and comments across the archive that link to nessus.org.

Comments · 102

  1. Re:where they're operating out of... by jehreg · · Score: 5 · on Secretive Company Scanning the Net
    Well, I needed a target to test out my Nessus version, so here goes:

    Nessus Scan Report



    Number of hosts which were alive during the test : 1
    Number of security holes found : 5
    Number of security warnings found : 1
    Number of security notes found : 2

    List of the tested hosts :

    [ Back to the top ] 205.177.226.233 :

    List of open ports :

      • telnet (23/tcp)
      • www (80/tcp) (Security hole found)
      • sunrpc (111/tcp)
      • shell (514/tcp)
      • unknown (2049/tcp)
      • general/udp (Security notes found)

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'perl' cgi is installed and can be launched

    • as a CGI. This is like giving a free shell to anyone, with the
      http server privileges (root or nobody).

      Solution : remove it from /cgi-bin

      Risk factor : Serious
      CVE : CAN-1999-0509

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'jj' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0260

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'glimpse' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Note that we could not actually check for the presence
      of this vulnerability, so you may be using a patched
      version.

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0147

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'Count.cgi' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0021

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • 'cgiwrap' is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious

    [ back to the list of ports ]

    Warning found on port www (80/tcp)

    • The 'finger' cgi is installed. It is usually
      not a good idea to have such a service installed, since
      it usually gives more troubles than anything else.

      Double check that you really want to have this
      service installed.

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CAN-1999-0197

    [ back to the list of ports ]

    Information found on port www (80/tcp)

    • The remote web server type is :
      Apache/1.3.12 (Unix) PHP/4.0.0 FrontPage/4.0.4.3


      We recommend that you configure your web server to return
      bogus versions, so that it makes the cracker job more difficult

    [ back to the list of ports ]

    Information found on port general/udp

    • For your information, here is the traceroute to 205.177.226.233 :
      ?

    This file was generated by Nessus, the open-sourced security scanner.
  2. Re:where they're operating out of... by jehreg · · Score: 5 · on Secretive Company Scanning the Net
    Well, I needed a target to test out my Nessus version, so here goes:

    Nessus Scan Report



    Number of hosts which were alive during the test : 1
    Number of security holes found : 5
    Number of security warnings found : 1
    Number of security notes found : 2

    List of the tested hosts :

    [ Back to the top ] 205.177.226.233 :

    List of open ports :

      • telnet (23/tcp)
      • www (80/tcp) (Security hole found)
      • sunrpc (111/tcp)
      • shell (514/tcp)
      • unknown (2049/tcp)
      • general/udp (Security notes found)

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'perl' cgi is installed and can be launched

    • as a CGI. This is like giving a free shell to anyone, with the
      http server privileges (root or nobody).

      Solution : remove it from /cgi-bin

      Risk factor : Serious
      CVE : CAN-1999-0509

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'jj' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0260

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'glimpse' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Note that we could not actually check for the presence
      of this vulnerability, so you may be using a patched
      version.

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0147

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • The 'Count.cgi' cgi is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CVE-1999-0021

    [ back to the list of ports ]

    Vulnerability found on port www (80/tcp)

    • 'cgiwrap' is installed. This CGI has

    • a well known security flaw that lets anyone execute arbitrary
      commands with the privileges of the http daemon (root or nobody).

      Solution : remove it from /cgi-bin.

      Risk factor : Serious

    [ back to the list of ports ]

    Warning found on port www (80/tcp)

    • The 'finger' cgi is installed. It is usually
      not a good idea to have such a service installed, since
      it usually gives more troubles than anything else.

      Double check that you really want to have this
      service installed.

      Solution : remove it from /cgi-bin.

      Risk factor : Serious
      CVE : CAN-1999-0197

    [ back to the list of ports ]

    Information found on port www (80/tcp)

    • The remote web server type is :
      Apache/1.3.12 (Unix) PHP/4.0.0 FrontPage/4.0.4.3


      We recommend that you configure your web server to return
      bogus versions, so that it makes the cracker job more difficult

    [ back to the list of ports ]

    Information found on port general/udp

    • For your information, here is the traceroute to 205.177.226.233 :
      ?

    This file was generated by Nessus, the open-sourced security scanner.