The 'commonName' (CN) attribute of the SSL certificate presented for this service is for a different machine.

The service running on the remote host presents an SSL certificate for which the 'commonName' (CN) attribute does not match the hostname on which the service listens.

Although this host was scanned through a private IPv4 or local scope IPv6 address, some network interfaces are configured with global scope IPv6 addresses.  Depending on the configuration of the firewalls and routers, this host may be reachable from Internet.

The remote host answers to an ICMPv6 Node Information Query and responds with its DNS name, the list of IPv4 addresses and the list of IPv6 addresses to which it is bound. 

An attacker can use this information to understand how the network is architected, which may help him bypass filters.

The remote operating system can be identified by querying its sysObjectID object using SNMP.

The SSL certificate associated with the remote service will expire soon.

The SSL certificate for the remote SSL-enabled service is not yet valid.

The remote service encrypts traffic using TLS / SSL but allows a client to insecurely renegotiate the connection after the initial handshake.
An unauthenticated, remote attacker may be able to leverage this issue to inject an arbitrary amount of plaintext into the beginning of the application protocol stream, which could facilitate man-in-the-middle attacks if the service assumes that the sessions before and after renegotiation are from the same 'client' and merges them at the application layer.

The remote host supports the use of SSL ciphers that offer medium strength encryption. Nessus regards medium strength as any encryption that uses key lengths at least 64 bits and less than 112 bits, or else that uses the 3DES encryption suite.

Note that it is considerably easier to circumvent medium strength encryption if the attacker is on the same physical network.

The remote NNTP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote ACAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote host contains an SSL certificate with a common name containing a Null character (\x00) in it.  This may indicate a compromise or that a program such as SSLsniff is spoofing the certificate in order to intercept the traffic via a Man-in-The-Middle (MiTM) attack. 

Certificates with such characters may exploit a bug contained in many different web browser and other SSL-related products, in how they validate the common name of such a certificate.

Security patches may have been 'backported' to the remote HTTP server without changing its version number.

Banner-based checks have been disabled to avoid false positives.

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote SSH server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote FTP server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

The remote NNTP server seems to be open to outsiders.  Some people like open NNTP servers as they allow one to read Usenet news articles anonymously.  Unwanted connections could waste your bandwidth. 

Note that it is very common for NNTP servers to use IP-based authentication so this may be a false positive if the Nessus scanner is among the allowed source addresses.

Nessus was able to identify the remote operating system by examining the HTML returned from certain HTTP requests.

Nessus was able to identify the remote operating system based on the response from the remote host's FTP banner.

Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's hardware, such as its product name and serial number.

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service.

Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm.

Note that certificates in the chain that are contained in the Nessus CA database (known_CA.inc) have been ignored.

Using SMBIOS and UEFI, it was possible to get BIOS info.

According to its self-reported version number, the Unix operating system running on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Nessus was able to enumerate MAC addresses by connecting to the remote host via SSH with the supplied credentials.

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.

Nessus was able to identify the remote operating system based on the telnet banner.

This plugin lists the packages installed on the remote Solaris host by calling pkginfo.

This script attempts to identify the remote operating system type and version by fingerprinting its Remote Desktop Services (RDP) / Terminal Services service.

The remote host supports the use of SSL ciphers that offer weak encryption.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

This plugin attempts to identify the operating system type and version by looking at certain files on the remote operating system (e.g., '/etc/redhat-release' on Red Hat).

This plugin attempts to identify the operating system type and version by looking at the SSH banner returned by the remote server.

This plugin attempts to identify the Operating System type and version by connecting to the remote SMB server.

This script attempts to identify the Operating System type and version by looking at the data returned by 'uname -a'.

This script attempts to identify the operating system type and version by using the same technique as SinFP.

This plugin attempts to identify the operating system type and version by connecting to the remote Microsoft Remote Procedure Call (MSRPC) server.

Nessus was able to identify the remote operating system type and version by examining the data returned by the remote HTTP server.

Nessus was able to identify the operating system type and version by examining the SNMP data returned by the remote server.

This script attempts to identify the Operating System type and version by looking at the data returned by the mDNS server.

This plugin attempts to identify the operating system type and version by looking at the NTP data returned by the remote server.

The remote host implements TCP timestamps, as defined by RFC1323.  A side effect of this feature is that the uptime of the remote host can sometimes be computed.

Nessus was able to enumerate the network interfaces configured with IPv4 addresses by connecting to the remote host via SSH using the supplied credentials.

Nessus was able to enumerate the network interfaces configured with IPv6 addresses by connecting to the remote host via SSH using the supplied credentials.

The remote host responds to the LLTD (Link Layer Topology Discovery) protocol.

This protocol can be used to enumerate the IPv4 and IPv6 addresses of a remote host, its name, the characteristics of the physical layer it is connected to, as well as the topology of the network, etc...

This plugin attempts to extract the IP addresses of the remote host as well as the physical layer it is connected to the network with.

Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).

This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.

The remote host answered to an ICMP 'Domain Name Request' as defined in RFC 1788.

Such a request is designed to obtain the DNS name of a host based on its IP.

According to the MAC address of its network adapter, the remote host is a VMware virtual machine.

The remote version of the Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.

This flaw exists because the RDP server stores a publicly known hard-coded RSA private key. Any attacker in a privileged network location can use the key for this attack.

The remote server seems open to remote users.  Some people prefer open public NNTP servers to be able to read or post articles anonymously.  Unwanted connections could waste your bandwidth or put you into legal trouble if a malicious person were to use your server to post abusive articles. 

Keep in mind that robots are harvesting such open servers on Internet, so you cannot hope that you will stay hidden for long. 

** As it is very common to have IP based authentication, this might be 
** a false positive if the Nessus scanner is among the allowed source 
** addresses.

This plugin checks expiry dates of certificates associated with SSL- enabled services on the target and reports whether any have already expired.

This plugin detects the protocols understood by the remote IP stack.

ID	Name	Severity
45411	SSL Certificate with Wrong Hostname	medium
45410	SSL Certificate 'commonName' Mismatch	info
45405	Reachable IPv6 address	info
45399	ICMP Node Information Query Information Disclosure	info
44344	OS Identification : SNMP sysObjectID	info
42981	SSL Certificate Expiry - Future Expiry	info
42980	SSL Certificate Expiry - Future Validity	info
42880	SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection	medium
42873	SSL Medium Strength Cipher Suites Supported (SWEET32)	high
42086	NNTP Service STARTTLS Command Support	info
42084	ACAP Service STARTTLS Command Support	info
42053	SSL Certificate Null Character Spoofing Weakness	high
39521	Backported Security Patch Detection (WWW)	info
39520	Backported Security Patch Detection (SSH)	info
39519	Backported Security Patch Detection (FTP)	info
39329	News Server (NNTP) Anonymous Read Access	low
35779	OS Identification : HTML	info
35658	OS Identification : FTP	info
35351	System Information Enumeration (via DMI)	info
35291	SSL Certificate Signed Using Weak Hashing Algorithm	medium
34098	BIOS Info (SSH)	info
33850	Unix Operating System Unsupported Version Detection	critical
33276	Enumerate MAC Addresses via SSH	info
10863	SSL Certificate Information	info
29831	OS Identification : Telnet	info
29217	Solaris Installed Package Enumeration (credentialed check)	info
27507	OS Identification : RDP	info
26928	SSL Weak Cipher Suites Supported	medium
25335	OS Identification : Linux Distribution	info
25287	OS Identification : SSH	info
25252	OS Identification : SMB	info
25251	OS Identification : Unix uname	info
25250	OS Identification : SinFP	info
25248	OS Identification : MSRPC	info
25247	OS Identification : HTTP	info
25246	OS Identification : SNMP	info
25245	OS Identification : mDNS	info
25244	OS Identification : NTP	info
25220	TCP/IP Timestamps Supported	info
25203	Enumerate IPv4 Interfaces via SSH	info
25202	Enumerate IPv6 Interfaces via SSH	info
24904	Link Layer Topology Discovery (LLTD) Detection	info
22869	Software Enumeration (SSH)	info
21643	SSL Cipher Suites Supported	info
20887	ICMP Domain Name Request	info
20094	VMware Virtual Machine Detection	info
18405	Remote Desktop Protocol Server Man-in-the-Middle Weakness	medium
17204	News Server (NNTP) Anonymous Read / Write Access	medium
15901	SSL Certificate Expiry	medium
14788	IP Protocols Scan	info

Detections

Analytics

General Family for Nessus

medium

info

info

info

info

info

info

medium

high

info

info

high

info

info

info

low

info

info

info

medium

info

critical

info

info

info

info

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

medium

medium

info