By using the identd server (RFC 1413), it is possible to determine the process owner of the remote service.

This plugin registers services that were identified by external scanners (amap, nmap, etc...). 

It does not perform any fingerprinting by itself.

It is possible to obtain the traceroute to the remote host by sending packets with the 'Record Route' option set.  It is a complement to traceroute.

Nessus was able to resolve the fully qualified domain name (FQDN) of the remote host.

This plugin attempts to identify the Operating System type and version by sending more or less incorrect ICMP requests using the techniques outlined in Ofir Arkin's paper 'ICMP Usage In Scanning'. An attacker may use this to identify the kind of the remote operating system and gain further knowledge about this host.

Using a combination of remote probes (e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.

The remote host has predictable TCP sequence numbers.

An attacker may use this flaw to establish spoofed TCP connections to this host.

The remote host seems to generate Initial Sequence Numbers (ISN) in a weak manner which seems to solely depend on the source and dest port of the TCP packets.

An attacker may exploit this flaw to establish spoofed connections to the remote host.

The Raptor Firewall and Novell NetWare are known to be vulnerable to this flaw, although other network devices may be vulnerable as well.

By probing the remote NNTP server, Nessus is able to collect information about it, such as whether it allows remote connections, the number of newsgroups, etc.

Nessus has determined that the remote host is a wireless access point (AP).

Ensure that proper physical and logical controls are in place for its use. A misconfigured access point may allow an attacker to gain access to an internal network without being physically present on the premises. If the access point is using an 'off-the-shelf' configuration (such as 40 or 104 bit WEP encryption), the data being passed through the access point may be vulnerable to hijacking or sniffing.

One of several ports that were previously open are now closed or unresponsive.

There are several possible reasons for this :

  - The scan may have caused a service to freeze or stop     running.

  - An administrator may have stopped a particular service     during the scanning process.

This might be an availability problem related to the following :

  - A network outage has been experienced during the scan,     and the remote network cannot be reached anymore by the     scanner.

  - This scanner may has been blacklisted by the system     administrator or by an automatic intrusion detection /     prevention system that detected the scan.

  - The remote host is now down, either because a user     turned it off during the scan or because a select denial     of service was effective.

In any case, the audit of the remote host might be incomplete and may need to be done again.

The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol. 

These protocols are not completely cryptographically safe so they should not be used.

This plugin determines the versions of the SSH protocol supported by the remote SSH daemon.

This script performs a Labrea tarpit scan, by sending a bogus ACK and ACK-windowprobe to a potential host.  It also sends a TCP SYN to test for non-persisting labrea machines.

It was possible to crash the remote service by flooding it with too much data.

An attacker may use this flaw to make this service crash continuously, preventing this service from working properly. It may also be possible to exploit this flaw to execute arbitrary code on this host.

The remote host answers to an ICMP timestamp request.  This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.

Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.

The remote host answers to an ICMP_MASKREQ query and responds with its netmask.  An attacker can use this information to understand how your network is set up and how routing is done.  This may help him to bypass your filters.

ID	Name	Severity
14674	identd Service UID Association	info
14664	External Scanner Service Identification	info
12264	Record Route	info
12053	Host Fully Qualified Domain Name (FQDN) Resolution	info
25249	OS Identification : ICMP	info
11936	OS Identification	info
10443	TCP/IP Predictable ISN (Initial Sequence Number) Generation Weakness	high
11057	TCP/IP Initial Sequence Number (ISN) Reuse Weakness	high
11033	News Server (NNTP) Information Disclosure	info
11026	Wireless Access Point Detection	info
10919	Open Port Re-check	info
10882	SSH Protocol Version 1 Session Key Retrieval	high
10881	SSH Protocol Versions Supported	info
10796	LaBrea Tarpitted Host Detection	info
10735	Generic Overflow Detection	high
10287	Traceroute Information	info
10114	ICMP Timestamp Request Remote Date Disclosure	low
10113	ICMP Netmask Request Information Disclosure	low

Detections

Analytics

General Family for Nessus

info

info

info

info

info

info

high

high

info

info

info

high

info

info

high

info

low

low