This script detects whether a host allows resuming SSL sessions by performing a full SSL handshake to receive a session ID, and then reconnecting with the previously used session ID.  If the server accepts the session ID in the second connection, the server maintains a cache of sessions that can be resumed.

The remote operating system can be identified by querying its hrSWInstalledName object using SNMP.

The X.509 certificate of the remote host is known to be shipping by default with the remote service / device.  The private key for this cert has been published, therefore the SSL communications done with the remote host can not be considered as being secret as anyone with the ability to snoop the traffic between the remote host and the clients could decipher the traffic.

The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :

  - First, the top of the certificate chain sent by the     server might not be descended from a known public     certificate authority. This can occur either when the     top of the chain is an unrecognized, self-signed     certificate, or when intermediate certificates are     missing that would connect the top of the certificate     chain to a known public certificate authority.

  - Second, the certificate chain may contain a certificate     that is not valid at the time of the scan. This can     occur either when the scan occurs before one of the     certificate's 'notBefore' dates, or after one of the     certificate's 'notAfter' dates.

  - Third, the certificate chain may contain a signature     that either didn't match the certificate's information     or could not be verified. Bad signatures can be fixed by     getting the certificate with the bad signature to be     re-signed by its issuer. Signatures that could not be     verified are the result of the certificate's issuer     using a signing algorithm that Nessus either does not     support or does not recognize.

If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

This plugin attempts to identify the operating system by examining a hard-coded SSL certificate issued by the device manufacturer.

The remote operating system can be identified through the banner reported by a SIP service running on it.

Using a combination of remote probes (TCP/IP, SMB, HTTP, NTP, SNMP, etc), it was possible to gather one or more fingerprints from the remote system. Unfortunately, though, Nessus does not currently know how to use them to identify the overall system.

According to the DMI information, the remote host is a VirtualBox virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

According to the DMI information, the remote host is a VirtualPC virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

According to the DMI information, the remote host is a VMware virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

Hostnames different from the current hostname have been collected by miscellaneous plugins. Nessus has generated a list of hostnames that point to the remote host. Note that these are only the alternate hostnames for vhosts discovered on a web server.

Different web servers may be hosted on name-based virtual hosts.

By using information obtained from a Nessus scan, this plugin reports CPE (Common Platform Enumeration) matches for various hardware and software products found on a host. 

Note that if an official CPE is not available for the product, this plugin computes the best possible CPE based on the information available from the scan.

Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's memory devices, such as the total amount of installed memory.

Nessus was able to retrieve information about the remote system's hardware, such as its processor type, by using the SMBIOS (aka DMI) interface.

The 'commonName' (CN) attribute of the SSL certificate presented for this service is for a different machine.

The service running on the remote host presents an SSL certificate for which the 'commonName' (CN) attribute does not match the hostname on which the service listens.

Although this host was scanned through a private IPv4 or local scope IPv6 address, some network interfaces are configured with global scope IPv6 addresses.  Depending on the configuration of the firewalls and routers, this host may be reachable from Internet.

The remote host answers to an ICMPv6 Node Information Query and responds with its DNS name, the list of IPv4 addresses and the list of IPv6 addresses to which it is bound. 

An attacker can use this information to understand how the network is architected, which may help him bypass filters.

The remote operating system can be identified by querying its sysObjectID object using SNMP.

The SSL certificate associated with the remote service will expire soon.

The SSL certificate for the remote SSL-enabled service is not yet valid.

The remote service encrypts traffic using TLS / SSL but allows a client to insecurely renegotiate the connection after the initial handshake.
An unauthenticated, remote attacker may be able to leverage this issue to inject an arbitrary amount of plaintext into the beginning of the application protocol stream, which could facilitate man-in-the-middle attacks if the service assumes that the sessions before and after renegotiation are from the same 'client' and merges them at the application layer.

The remote host supports the use of SSL ciphers that offer medium strength encryption. Nessus regards medium strength as any encryption that uses key lengths at least 64 bits and less than 112 bits, or else that uses the 3DES encryption suite.

Note that it is considerably easier to circumvent medium strength encryption if the attacker is on the same physical network.

The remote NNTP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote ACAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote host contains an SSL certificate with a common name containing a Null character (\x00) in it.  This may indicate a compromise or that a program such as SSLsniff is spoofing the certificate in order to intercept the traffic via a Man-in-The-Middle (MiTM) attack. 

Certificates with such characters may exploit a bug contained in many different web browser and other SSL-related products, in how they validate the common name of such a certificate.

Security patches may have been 'backported' to the remote HTTP server without changing its version number.

Banner-based checks have been disabled to avoid false positives.

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote SSH server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote FTP server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

The remote NNTP server seems to be open to outsiders.  Some people like open NNTP servers as they allow one to read Usenet news articles anonymously.  Unwanted connections could waste your bandwidth. 

Note that it is very common for NNTP servers to use IP-based authentication so this may be a false positive if the Nessus scanner is among the allowed source addresses.

Nessus was able to identify the remote operating system by examining the HTML returned from certain HTTP requests.

Nessus was able to identify the remote operating system based on the response from the remote host's FTP banner.

Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's hardware, such as its product name and serial number.

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service.

Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm.

Note that certificates in the chain that are contained in the Nessus CA database (known_CA.inc) have been ignored.

Using SMBIOS and UEFI, it was possible to get BIOS info.

According to its self-reported version number, the Unix operating system running on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Nessus was able to enumerate MAC addresses by connecting to the remote host via SSH with the supplied credentials.

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.

Nessus was able to identify the remote operating system based on the telnet banner.

This plugin lists the packages installed on the remote Solaris host by calling pkginfo.

This script attempts to identify the remote operating system type and version by fingerprinting its Remote Desktop Services (RDP) / Terminal Services service.

The remote host supports the use of SSL ciphers that offer weak encryption.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

This plugin attempts to identify the operating system type and version by looking at certain files on the remote operating system (e.g., '/etc/redhat-release' on Red Hat).

This plugin attempts to identify the operating system type and version by looking at the SSH banner returned by the remote server.

This plugin attempts to identify the Operating System type and version by connecting to the remote SMB server.

This script attempts to identify the Operating System type and version by looking at the data returned by 'uname -a'.

This script attempts to identify the operating system type and version by using the same technique as SinFP.

This plugin attempts to identify the operating system type and version by connecting to the remote Microsoft Remote Procedure Call (MSRPC) server.

Nessus was able to identify the remote operating system type and version by examining the data returned by the remote HTTP server.

Nessus was able to identify the operating system type and version by examining the SNMP data returned by the remote server.

ID	Name	Severity
51891	SSL Session Resume Supported	info
51859	OS Identification : SNMP hrSWInstalledName	info
51356	Well-known SSL Certificate Used in Remote Device	medium
51192	SSL Certificate Cannot Be Trusted	medium
50543	OS Identification : SSL Certificates	info
50542	OS Identification : SIP	info
50350	OS Identification Failed	info
47801	VirtualBox Virtual Machine detection (dmidecode)	info
47800	VirtualPC Virtual Machine detection (dmidecode)	info
47761	VMware Virtual Machine detection (dmidecode)	info
46180	Additional DNS Hostnames	info
45590	Common Platform Enumeration (CPE)	info
45433	Memory Information (via DMI)	info
45432	Processor Information (via DMI)	info
45411	SSL Certificate with Wrong Hostname	medium
45410	SSL Certificate 'commonName' Mismatch	info
45405	Reachable IPv6 address	info
45399	ICMP Node Information Query Information Disclosure	info
44344	OS Identification : SNMP sysObjectID	info
42981	SSL Certificate Expiry - Future Expiry	info
42980	SSL Certificate Expiry - Future Validity	info
42880	SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection	medium
42873	SSL Medium Strength Cipher Suites Supported (SWEET32)	high
42086	NNTP Service STARTTLS Command Support	info
42084	ACAP Service STARTTLS Command Support	info
42053	SSL Certificate Null Character Spoofing Weakness	high
39521	Backported Security Patch Detection (WWW)	info
39520	Backported Security Patch Detection (SSH)	info
39519	Backported Security Patch Detection (FTP)	info
39329	News Server (NNTP) Anonymous Read Access	low
35779	OS Identification : HTML	info
35658	OS Identification : FTP	info
35351	System Information Enumeration (via DMI)	info
35291	SSL Certificate Signed Using Weak Hashing Algorithm	medium
34098	BIOS Info (SSH)	info
33850	Unix Operating System Unsupported Version Detection	critical
33276	Enumerate MAC Addresses via SSH	info
10863	SSL Certificate Information	info
29831	OS Identification : Telnet	info
29217	Solaris Installed Package Enumeration (credentialed check)	info
27507	OS Identification : RDP	info
26928	SSL Weak Cipher Suites Supported	medium
25335	OS Identification : Linux Distribution	info
25287	OS Identification : SSH	info
25252	OS Identification : SMB	info
25251	OS Identification : Unix uname	info
25250	OS Identification : SinFP	info
25248	OS Identification : MSRPC	info
25247	OS Identification : HTTP	info
25246	OS Identification : SNMP	info

Detections

Analytics

General Family for Nessus

info

info

medium

medium

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

medium

high

info

info

high

info

info

info

low

info

info

info

medium

info

critical

info

info

info

info

info

medium

info

info

info

info

info

info

info

info