Return to the 2006 Operating System Vulnerability Summary on OmniNerd
List of hosts
192.168.1.2Low Severity problem(s) found

[^] Back

192.168.1.2


Scan time :
Start time : Mon Feb 26 06:06:10 2007
End time : Mon Feb 26 06:20:36 2007
Number of vulnerabilities :
Open ports : 56
Low : 33
Medium : 0
High : 0
Information about the remote host :

Operating system : Mac OS X 10.4.8
NetBIOS name : TESTING
DNS name : (unknown)

[^] Back to 192.168.1.2

Port ipp (631/tcp)
Services
A web server is running on this port

Nessus ID : 10330
Web mirroring
The following CGI have been discovered :

Syntax : cginame (arguments [default value])

/jobs (which_jobs [completed] )
/admin/ (op [add-class] )


Nessus ID : 10662
Office files list
The following Acrobat files (.pdf) are available on the remote server :
/overview.pdf
/sum.pdf
/sam.pdf
/spm.pdf
/cmp.pdf
/ipp.pdf
/idd.pdf
/sdd.pdf
/sps.pdf
/ssr.pdf
/translation.pdf
/stp.pdf
/svd.pdf


You should make sure that none of these files contain confidential or
otherwise sensitive information.

An attacker may use these files to gain a more intimate knowledge of
your organization and eventually use them do perform social engineering
attacks (abusing the trust of the personnel of your company).

Solution : sensitive files should not be accessible by everyone, but only
by authenticated users.

Nessus ID : 11419
HMAP
This web server was fingerprinted as CUPS/1.1
which is consistent with the displayed banner: CUPS/1.1

Nessus ID : 11919
HTTP Server type and version
The remote web server type is :

CUPS/1.1


Nessus ID : 10107

[^] Back to 192.168.1.2

Port ftp (21/tcp)
Services
An FTP server is running on this port.
Here is its banner :
220 TESTING.local FTP server (tnftpd 20040810) ready.

Nessus ID : 10330
FTP Server Detection

Synopsis :

An FTP server is listening on this port

Description :

It is possible to obtain the banner of the remote FTP server
by connecting to the remote port.

Risk factor :

None

Plugin output :

The remote FTP banner is :
220 TESTING.local FTP server (tnftpd 20040810) ready.

Nessus ID : 10092

[^] Back to 192.168.1.2

Port vnc (5900/tcp)
Identify unknown services with GET
A VNC server is running on this port

Nessus ID : 17975
VNC security types
The remote VNC server supports those security types:
+ 30


Nessus ID : 19288

[^] Back to 192.168.1.2

Port general/udp
Traceroute
For your information, here is the traceroute from 192.168.1.250 to 192.168.1.2 :
192.168.1.250
192.168.1.2


Nessus ID : 10287

[^] Back to 192.168.1.2

Port afpovertcp (548/tcp)
AppleShare IP Server status query

Synopsis :

File sharing service is available.

Description :

The remote host is running an AppleShare IP file service.
By sending DSIGetStatus request on tcp port 548, it was
possible to disclose information about the remote host.

Risk factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)

Plugin output :

This host is running an AppleShare File Services over IP.
Machine type: Macintosh
Server name: TESTING
UAMs: DHCAST128/DHX2/Cleartxt Passwrd/No User Authent
AFP Versions: AFP3.2/AFP3.1/AFPX03/AFP2.2

This AppleShare File Server allows the "guest" user to connect

Nessus ID : 10666

[^] Back to 192.168.1.2

Port eppc (3031/tcp)

[^] Back to 192.168.1.2

Port netbios-ns (137/tcp)
Using NetBIOS to retrieve information from a Windows host

Synopsis :

It is possible to obtain the network name of the remote host.

Description :

The remote host listens on udp port 137 and replies to NetBIOS nbtscan
requests. By sending a wildcard request it is possible to obtain the
name of the remote system and the name of its domain.

Risk factor :

None

Plugin output :

The following 7 NetBIOS names have been gathered :

TESTING = Computer name
TESTING = Messenger Service
TESTING = File Server Service
__MSBROWSE__ = Master Browser
WORKGROUP = Workgroup / Domain name
WORKGROUP = Master Browser
WORKGROUP = Browser Service Elections

This SMB server seems to be a SAMBA server (MAC address is NULL).
CVE : CVE-1999-0621
Other references : OSVDB:13577

Nessus ID : 10150

[^] Back to 192.168.1.2

Port xqosd (31416/tcp)
Services
The service closed the connection after 0 seconds without sending any data
It might be protected by some TCP wrapper


Nessus ID : 10330

[^] Back to 192.168.1.2

Port general/tcp
OS Identification
The remote host is running Mac OS X 10.4.8

Nessus ID : 11936
Information about the scan
Information about this scan :

Nessus version : 3.0.4
Plugin feed version : 200701101815
Type of plugin feed : Registered (7 days delay)
Scanner IP : 192.168.1.250
Port scanner(s) : nessus_tcp_scanner synscan
Port range : default
Thorough tests : yes
Experimental tests : no
Paranoia level : 0
Report Verbosity : 2
Safe checks : no
Max hosts : 40
Max checks : 5
Scan Start Date : 2007/2/26 6:06
Scan duration : 866 sec


Nessus ID : 19506

[^] Back to 192.168.1.2

Port netbios-ssn (139/tcp)
SMB Detection
An SMB server is running on this port

Nessus ID : 11011

[^] Back to 192.168.1.2

Port microsoft-ds (445/tcp)
SMB Detection
A CIFS server is running on this port

Nessus ID : 11011
SMB NativeLanMan

Synopsis :

It is possible to obtain information about the remote operating
system.

Description :

It is possible to get the remote operating system name and
version (Windows and/or Samba) by sending an authentication
request to port 139 or 445.

Risk factor :

None

Plugin output :

The remote Operating System is : Unix
The remote native lan manager is : Samba 3.0.10
The remote SMB Domain Name is : TESTING


Nessus ID : 10785
SMB log in

Synopsis :

It is possible to logon on the remote host.

Description :

The remote host is running one of the Microsoft Windows operating
system. It was possible to logon using one of the following
account :

- NULL session
- Guest account
- Given Credentials

See also :

http://support.microsoft.com/support/kb/articles/Q143/4/74.ASP
http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP

Risk factor :

none

Plugin output :

- NULL sessions are enabled on the remote host

CVE : CVE-1999-0504, CVE-1999-0505, CVE-1999-0506, CVE-2000-0222, CVE-2002-1117, CVE-2005-3595
BID : 494, 990, 11199

Nessus ID : 10394
SMB LanMan Pipe Server browse listing

Synopsis :

It is possible to obtain network information.

Description :

It was possible to obtain the browse list of the remote
Windows system by send a request to the LANMAN pipe.
The browse list is the list of the nearest Windows systems
of the remote host.

Risk factor :

None

Plugin output :

Here is the browse list of the remote host :

TESTING ( os: 0.0 )

Other references : OSVDB:300

Nessus ID : 10397

[^] Back to 192.168.1.2

Port ntp (123/udp)
NTP read variables
It is possible to determine a lot of information about the remote host
by querying the NTP (Network Time Protocol) variables - these include
OS descriptor, and time settings.

It was possible to gather the following information from the remote NTP host :

version='ntpd 4.1.1@1.786 Sun Mar 20 15:40:56 PST 2005 (1)',
processor='Power Macintosh', system='Darwin8.8.0', leap=3, stratum=16,
precision=-17, rootdelay=0.000, rootdispersion=364.800, peer=0,
refid=0.0.0.0, reftime=0x00000000.00000000, poll=4,
clock=0xc98d3dfc.375c7cd8, state=0, offset=0.000, frequency=0.000,
jitter=0.008, stability=0.000



Quickfix: Set NTP to restrict default access to ignore all info packets:
restrict default ignore

Risk factor : Low

Nessus ID : 10884

[^] Back to 192.168.1.2

Port svrloc (427/tcp)
Unknown services banners
An unknown server is running on this port.
If you know what it is, please send this banner to the Nessus team:
Type=get_http
0x00: 02 02 00 00 12 00 00 00 00 00 00 00 00 02 65 6E ..............en
0x10: 00 02 ..


Nessus ID : 11154

[^] Back to 192.168.1.2

Port mdns (5353/udp)
mDNS Detection

The remote host is running the RendezVous (also known as ZeroConf or mDNS)
protocol.

This protocol allows anyone to dig information from the remote host, such
as its operating system type and exact version, its hostname, and the list
of services it is running.

We could extract the following information :

Computer name : TESTING.local.
Ethernet addr : 00:30:65:c1:70:42
Computer Type : PowerMac5,1
Operating System : Mac OS X 10.4.8

Solution : You should filter incoming traffic to this port if you do not use
this protocol.

Risk factor : Low

Nessus ID : 12218

[^] Back to 192.168.1.2

Port http (80/tcp)
Services
A web server is running on this port

Nessus ID : 10330
Unconfigured web server

Synopsis :

The remote web server is not, or is not properly configured.

Description :

The remote web server seems to have its default welcome page set.
It probably means that this server is not used at all.

Solution :

Disable this service, as you do not use it

Risk factor :

None / CVSS Base Score : 0
(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
Other references : OSVDB:2117

Nessus ID : 11422
Directory Scanner
The following directories were discovered:
/cgi-bin, /icons, /manual

While this is not, in and of itself, a bug, you should manually inspect
these directories to ensure that they are in compliance with company
security standards

Other references : OWASP:OWASP-CM-006

Nessus ID : 11032
HMAP
This web server was fingerprinted as Apache/1.3.28-33 (Unix)
which is consistent with the displayed banner: Apache/1.3.33 (Darwin)

Nessus ID : 11919
HTTP Server type and version
The remote web server type is :

Apache/1.3.33 (Darwin)


Solution : You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.

Nessus ID : 10107
Apache Remote Username Enumeration Vulnerability

Synopsis :

The remote Apache server can be used to guess the presence of a given
user name on the remote host.

Description :

When configured with the 'UserDir' option, requests to URLs containing
a tilde followed by a username will redirect the user to a given
subdirectory in the user home.

For instance, by default, requesting /~root/ displays the HTML
contents from /root/public_html/.

If the username requested does not exist, then Apache will reply with
a different error code. Therefore, an attacker may exploit this
vulnerability to guess the presence of a given user name on the remote
host.

Solution :

In httpd.conf, set the 'UserDir' to 'disabled'.

Risk factor :

Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
CVE : CVE-2001-1013
BID : 3335
Other references : OSVDB:637

Nessus ID : 10766

[^] Back to 192.168.1.2

Port general/icmp
Record route
Here is the route recorded between 192.168.1.250 and 192.168.1.2 :
192.168.1.2.


Nessus ID : 12264

[^] Back to 192.168.1.2

Port ssh (22/tcp)
Services
An ssh server is running on this port

Nessus ID : 10330
SSH Server type and version
Remote SSH version : SSH-1.99-OpenSSH_4.2

Remote SSH supported authentication : publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive



Nessus ID : 10267
Portable OpenSSH PAM timing attack

The remote host seem to be running an SSH server which can allow
an attacker to determine the existence of a given login by comparing
the time the remote sshd daemon takes to refuse a bad password for a
non-existent login compared to the time it takes to refuse a bad password
for a valid login.

An attacker may use this flaw to set up a brute force attack against
the remote host.

Solution : Disable PAM support if you do not use it, upgrade to the newest
version of OpenSSH

Risk factor : Low
CVE : CVE-2003-0190
BID : 7342, 7467, 7482, 11781
Other references : OSVDB:2109, OSVDB:2140

Nessus ID : 11574

[^] Back to 192.168.1.2

Port printer (515/tcp)