192.168.0.178
Repartition of the level of the security problems :
[Back to the index]
List of open ports :
Warning found on port ftp (21/tcp)
The FTP service allows anonymous logins. If you do not
want to share data with anyone you do not know, then you should deactivate
the anonymous account, since it can only cause troubles.
Under most Unix system, doing :
echo ftp >> /etc/ftpusers
will correct this.
Risk factor : Low
CVE : CAN-1999-0497
Information found on port ftp (21/tcp)
Vulnerability found on port www (80/tcp)
The CGI /scripts/tools/newdsn.exe is present.
This CGI allows any attacker to create files
anywhere on your system if your NTFS permissions
are not tight enough, and can be used to overwrite
DSNs of existing dabases.
Solution : Remove newdsn.exe
Risk factor : High
CVE : CVE-1999-0191
Vulnerability found on port www (80/tcp)
The web server is probably susceptible to a common IIS vulnerability discovered by
'Rain Forest Puppy'. This vulnerability enables an attacker to execute arbitrary
commands on the server with Administrator Privileges.
See Microsoft security bulletin (MS99-025) for patch information.
Also, BUGTRAQ ID 529 on www.securityfocus.com (http://www.securityfocus.com/bid/529)
Risk factor : High
CVE : CVE-1999-1011
Vulnerability found on port www (80/tcp)
The CGI /scripts/tools/mkilog.exe is present.
This CGI allows an attacker to view and modify SQL database
contents.
Solution : Remove it
Risk factor : Serious
Vulnerability found on port www (80/tcp)
Some of the following IIS sample files are present :
/iissamples/issamples/fastq.idq
/iissamples/issamples/query.idq
/iissamples/exair/search/search.idq
/iissamples/exair/search/query.idq
/iissamples/issamples/oop/qsumrhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qsumrhit.htw&CiRestriction=none&CiHiliteType=Full
/iissamples/issamples/oop/qfullhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qfullhit.htw&CiRestriction=none&CiHiliteType=Full
/scripts/samples/search/author.idq
/scripts/samples/search/filesize.idq
/scripts/samples/search/filetime.idq
/scripts/samples/search/queryhit.idq
/scripts/samples/search/simple.idq
/iissamples/exair/howitworks/codebrws.asp
/iissamples/issamples/query.asp
They all contain various security flaws which could allow
an attacker to execute arbitrary commands, read arbitrary files
or gain valuable information about the remote system.
Solution : Delete the whole /iissamples directory
Risk factor : High
Vulnerability found on port www (80/tcp)
The remote IIS server allows anyone to execute arbitrary commands
by adding a unicode representation for the slash character
in the requested path.
Solution: See MS advisory MS 00-078
Risk factor: High
CVE : CAN-2000-0884
Vulnerability found on port www (80/tcp)
The dll '/_vti_bin/_vti_aut/dvwssr.dll' seems to be present.
This dll contains a bug which allows anyone with
authoring web permissions on this system to alter
the files of other users.
In addition to this, this file is subject to a buffer overflow
which allows anyone to execute arbitrary commands on the
server and/or disable it
Solution : delete /_vti_bin/_vti_aut/dvwssr.dll
Risk factor : High
See also : http://www.wiretrip.net/rfp/p/doc.asp?id=45&iface=1
CVE : CVE-2000-0260
Vulnerability found on port www (80/tcp)
IIS comes with the sample site 'ExAir'.
Unfortunately, one of its pages,
namely /iissamples/exair/search/search.asp,
may be used to make IIS hang, thus preventing
it from answering to legitimate clients.
Solution : Delete the 'ExAir' sample IIS site
Risk factor : Medium
CVE : CVE-1999-0449
Vulnerability found on port www (80/tcp)
IIS comes with the sample site 'ExAir'. Unfortunately, one of its pages,
namely /iissamples/exair/search/query.asp, may be used to make IIS hang,
thus preventing it from answering to legitimate clients.
Solution : Delete the 'ExAir' sample IIS site
Risk factor : Medium.
CVE : CVE-1999-0449
Vulnerability found on port www (80/tcp)
IIS comes with the sample site 'ExAir'. Unfortunately,
one of its pages, namely /iissamples/exair/search/advsearch.asp, may
be used to make II hang, thus preventing it from answering to legitimate
clients.
Risk factor : Medium/High.
Solution : Delete the 'ExAir' sample IIS site
CVE : CVE-1999-0449
Vulnerability found on port www (80/tcp)
Microsoft IIS, running Frontpage extensions, is
vulnerable to a remote DoS attack usually called the 'malformed
web submission' vulnerability.
Solution: See http://www.microsoft.com/technet/security/bulletin/MS00-100.asp
Risk factor : High
Warning found on port www (80/tcp)
The file bdir.htr is a default IIS files which can give
a malicious user a lot of unnecessary information about your file system
Example,
http://target/scripts/iisadmin/bdir.htr??c:\
Solution: If you do not need these files, then delete them, otherwise use
suitable access control lists to ensure that the files are not
world-readable.
Warning found on port www (80/tcp)
It seems that the DELETE method is enabled on your web server
Although we could not exploit this, you'd better disable it
Solution : disable this method
Risk factor : Medium
Warning found on port www (80/tcp)
The remote web server appears to be running with
Frontpage extensions.
You should double check the configuration since
a lot of security problems have been found with
FrontPage when the configuration file is
not well set up.
Risk factor : High if your configuration file is
not well set up
CVE : CVE-1999-0386
Information found on port www (80/tcp)
The remote web server type is :
Microsoft-IIS/4.0
We recommend that you configure your web server to return
bogus versions, so that it makes the cracker job more difficult
Vulnerability found on port netbios-ssn (139/tcp)
. It was possible to log into the remote host using the following
login/password combinations :
'guest'/'guest'
. It was possible to log into the remote host using a NULL session.
The concept of a NULL session is to provide a null username and
a null password, which grants the user the 'guest' access
. All the smb tests will be done as 'guest'/'****'
Vulnerability found on port netbios-ssn (139/tcp)
The registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
is writeable by users who are not in the admin group.
This key contains a value which defines which program should
be run when a user logs on.
As this program runs in the SYSTEM context, the users who
have the right to change the value of this key
can gain more privileges on this host.
Solution : use regedt32 and set the permissions of this
key to :
- admin group : Full Control
- system : Full Control
- everyone : Read
Risk factor : High
CVE : CAN-1999-0589
Vulnerability found on port netbios-ssn (139/tcp)
The following registry keys are writeable by users who are not in
the admin group :
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers
HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Embedding
HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI
HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI Extensions
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Ports
HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW
These keys contain paths to common programs and DLLs. If a user
can change a path, then he may put a trojan program
into another location (say C:/temp) and point to it.
Solution : use regedt32 and set the permissions of this
key to :
- admin group : Full Control
- system : Full Control
- everyone : Read
Risk factor : Serious
CVE : CAN-1999-0589
Vulnerability found on port netbios-ssn (139/tcp)
The following registry keys are writeable by users who are not in
the admin group :
HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
These keys contain the name of the program that shall
be started when the computer starts. The users who
have the right to modify them can easily make the admin
run a trojan program which will give them admin privileges.
Solution : use regedt32 and set the permissions of this
key to :
- admin group : Full Control
- system : Full Control
- everyone : Read
Risk factor : High
CVE : CAN-1999-0589
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'WinSock Mutex'
problem has not been applied.
This vulnerability allows a local user to prevent this host
from communicating with the network
Solution : See http://www.microsoft.com/technet/security/bulletin/ms01-003.asp
Risk factor : Serious
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'incomplete TCP/IP packet'
problem has not been applied.
This vulnerability allows a user to prevent this host
from communicating with the network
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-091.asp
Risk factor : Serious
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the multiple LPC and LPC Ports vulnerabilities
has not been applied on the remote Windows host.
These vulnerabilities allows an attacker gain privileges on the
remote host, or to crash it remotely.
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-070.asp
Risk factor : High
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'Relative Shell Path'
vulnerability has not been applied.
This vulnerability allows a malicious user
who can write to the remote system root
to cause the code of his choice to be executed by
the users who will interactively log into this
host.
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-052.asp
Risk factor : Medium
CVE : CAN-2000-0663
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'NetBIOS Name Server Protocol Spoofing'
problem has not been applied.
This vulnerability allows a malicious user to make this
host think that its name has already been taken on the
network, thus preventing it to function properly as
a SMB server (or client).
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-047.asp
Risk factor : Medium
CVE : CAN-2000-0673
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'ResetBrowser Frame' and the 'HostAnnouncement flood'
has not been applied.
The first of these vulnerabilities allows anyone to shut
down the network browser of this host at will.
The second vulnerability allows an attacker to
add thousands of bogus entries in the master browser,
which will consume most of the network bandwidth as
a side effect.
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-036.asp
Risk factor : Medium
CVE : CVE-2000-0404
Vulnerability found on port netbios-ssn (139/tcp)
The hotfix for the 'IP Fragment Reassembly' vulnerability
has not been applied on the remote Windows host.
This vulnerability allows an attacker to send malformed packets
which will hog this computer CPU to 100%, making
it nearly unuseable for the legitimate users.
Solution : See http://www.microsoft.com/technet/security/bulletin/ms00-029.asp
Risk factor : Serious
CVE : CVE-2000-0305
Vulnerability found on port netbios-ssn (139/tcp)
The following shares can be accessed as guest :
- NETLOGON - (readable)
- tosc - (readable, writeable)
Solution : To restrict their access under WindowsNT, open the explorer, do a right click on each,
go to the 'sharing' tab, and click on 'permissions'
Risk factor : High
CVE : CAN-1999-0519
Warning found on port netbios-ssn (139/tcp)
The remote registry can be accessed remotely
using the login / password combination used
for the SMB tests.
Having the registry accessible to the world is
not a good thing as it gives extra knowledge to
a hacker.
Solution : Apply service pack 3 if not done already,
and set the key HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
to restrict what can be browsed by non administrators.
In addition to this, you should consider filtering incoming packets
to this port.
Risk factor : Low
Warning found on port netbios-ssn (139/tcp)
The remote host seems to be a Primary Domain Controler
or a Backup Domain Controler.
This can be told by the value of the registry
key ProductType under
HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions
This knowledge may be of some use to a cracker and help
him to focus his attack on this host.
Solution : filter the traffic going to this port
Risk factor : Low
CVE : CAN-1999-0659
Warning found on port netbios-ssn (139/tcp)
Here is the browse list of the remote host :
FREEBSD - Samba 2.0.7-ja-1.3
WINNT40SV -
This is potentially dangerous as this may help the attack
of a potential hacker by giving him extra targets to check for
Solution : filter incoming traffic to this port
Risk factor : Low
Warning found on port netbios-ssn (139/tcp)
Here is the list of the SMB shares of this host :
NETLOGON - Logon server share
ADMIN$ - Remote Admin
IPC$ - Remote IPC
C$ - Default share
tosc -
This is potentially dangerous as this may help the attack
of a potential hacker.
Solution : filter incoming traffic to this port
Risk factor : Medium
Warning found on port netbios-ssn (139/tcp)
The host SID can be obtained remotely. Its value is :
NBUG : 5-21-532966891-681013242-1947940980
An attacker can use it to obtain the list of the local users of this host
Solution : filter the ports 137 to 139
Risk factor : Low
Information found on port netbios-ssn (139/tcp)
Nessus could not access the remote registry completely,
because this needs to be logged in as administrator.
If you want the permissions / values of all the sensitive
registry keys to be checked for, we recommand that
you fill the 'SMB Login' options in the
'Prefs.' section of the client by the administrator
login name and password.
** Since the password will be sent in clear text, we
suggest you change its value for something else
during the test, as anyone will be able to eavesdrop
it
*** If you are working in a highly sensitive
environement where a second of insecurity
may be critical to you, then forget this
warning and use other tools to check locally
the security of your NT keys
Vulnerability found on port unknown (3723/tcp)
When the remote web server is
issued with a lower-cased 'get' request it will return
a directory listing even if a default page such as index.html is
present.
Example :
get / HTTP/1.0
Will return a listing of the root directory.
This allows an attacker to gain valuable information about the
directory structure of the remote host and could reveal the
presence of files which are not intended to be visible.
Solution : Upgrade your server to the latest version.
Risk factor : Medium
CVE : CVE-1999-0239
Warning found on port unknown (3723/tcp)
Warning found on port unknown (3723/tcp)
It seems that the DELETE method is enabled on your web server
Although we could not exploit this, you'd better disable it
Solution : disable this method
Risk factor : Medium
Information found on port unknown (3723/tcp)
The remote web server type is :
Microsoft-IIS/4.0
We recommend that you configure your web server to return
bogus versions, so that it makes the cracker job more difficult
Vulnerability found on port general/tcp
The TCP sequence numbers of the remote host
depends on the time, so they can be
guessed rather easily. A cracker may use
this flaw to spoof TCP connections easily.
Solution : contact your vendor for a patch
Risk factor : High
Warning found on port general/tcp
The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host.
An attacker may use this feature to determine if the remote
host sent a packet in reply to another request. This may be
used for portscanning and other things.
Solution : Contact your vendor for a patch
Risk factor : Low
Information found on port general/tcp
Warning found on port netbios-ns (137/udp)
. The following 12 NetBIOS names have been gathered :
WINNT40SV
WINNT40SV = This is the computer name registered for workstation services by a WINS client.
NBUG = Workgroup / Domain name
NBUG
NBUG
NBUG
WINNT40SV = Computer name that is registered for the messenger service on a computer that is a WINS client.
INet~Services
IS~WINNT40SV = This is the computer name registered for workstation services by a WINS client.
NBUG
__MSBROWSE__
ADMINISTRATOR = Computer name that is registered for the messenger service on a computer that is a WINS client.
. The remote host has the following MAC address on its adapter :
0x00 0x90 0x99 0x17 0x35 0x3c
If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.
Risk factor : Medium
Information found on port general/udp
For your information, here is the traceroute to 192.168.0.178 :
192.168.0.178
This file was generated by Nessus, the open-sourced security scanner.