Tenable Blog

Over the past few years, there have been several vulnerabilities disclosed about the Snort network intrusion detection sensor. I recently had a Tenable customer inquire for a strategy of "scanning" to find these Snort systems. This blog discusses some basic and more advanced ideas and issues on how to approach this with Nessus and the Passive Vulnerability Scanner.

Network Scanning of Passive Listening Devices

Tenable's research group has released a set of seven audit policies for the Vista operating system. These polices are based directly off of Microsoft's Windows Vista Security Guide. This blog entry discusses how to obtain these audit policies and how to perform an audit of a Vista  computer system.

Obtaining These Plugins

Tenable's research group recently released plugin ID #24904 which speaks with the Link Layer Topology Discovery protocol. This is an Ethernet "layer 2" scan, so it is something you need to perform against a server within the collision domain of a Nessus scanner. LLTD allows you to enumerate a wide variety of information about the remote host. The current NASL script supports discovery of:

Quoting directly from Microsoft's web site about Teredo:

"Teredo is an IPv6 transition technology that provides address assignment and host-to-host automatic tunneling for unicast IPv6 traffic when IPv6/IPv4 hosts are located behind one or multiple IPv4 network address translators (NATs)."

Today, Tenable's research group released a remote Nessus plugin check (ID #25035) for a new vulnerability in Microsoft DNS servers. Microsoft has released a security advisory with details of the vulnerability and Tenable has confirmed the issue with an exploit in our lab.