Nessus was able to enumerate the network interfaces configured with IPv4 addresses by connecting to the remote host via SSH using the supplied credentials.

Nessus was able to enumerate the network interfaces configured with IPv6 addresses by connecting to the remote host via SSH using the supplied credentials.

The remote host responds to the LLTD (Link Layer Topology Discovery) protocol.

This protocol can be used to enumerate the IPv4 and IPv6 addresses of a remote host, its name, the characteristics of the physical layer it is connected to, as well as the topology of the network, etc...

This plugin attempts to extract the IP addresses of the remote host as well as the physical layer it is connected to the network with.

Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).

This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.

The remote host answered to an ICMP 'Domain Name Request' as defined in RFC 1788.

Such a request is designed to obtain the DNS name of a host based on its IP.

According to the MAC address of its network adapter, the remote host is a VMware virtual machine.

The remote version of the Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.

This flaw exists because the RDP server stores a publicly known hard-coded RSA private key. Any attacker in a privileged network location can use the key for this attack.

The remote server seems open to remote users.  Some people prefer open public NNTP servers to be able to read or post articles anonymously.  Unwanted connections could waste your bandwidth or put you into legal trouble if a malicious person were to use your server to post abusive articles. 

Keep in mind that robots are harvesting such open servers on Internet, so you cannot hope that you will stay hidden for long. 

** As it is very common to have IP based authentication, this might be 
** a false positive if the Nessus scanner is among the allowed source 
** addresses.

This plugin checks expiry dates of certificates associated with SSL- enabled services on the target and reports whether any have already expired.

This plugin detects the protocols understood by the remote IP stack.

By using the identd server (RFC 1413), it is possible to determine the process owner of the remote service.

This plugin registers services that were identified by external scanners (amap, nmap, etc...). 

It does not perform any fingerprinting by itself.

It is possible to obtain the traceroute to the remote host by sending packets with the 'Record Route' option set.  It is a complement to traceroute.

Nessus was able to resolve the fully qualified domain name (FQDN) of the remote host.

This plugin attempts to identify the Operating System type and version by sending more or less incorrect ICMP requests using the techniques outlined in Ofir Arkin's paper 'ICMP Usage In Scanning'. An attacker may use this to identify the kind of the remote operating system and gain further knowledge about this host.

Using a combination of remote probes (e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.

The remote host has predictable TCP sequence numbers.

An attacker may use this flaw to establish spoofed TCP connections to this host.

The remote host seems to generate Initial Sequence Numbers (ISN) in a weak manner which seems to solely depend on the source and dest port of the TCP packets.

An attacker may exploit this flaw to establish spoofed connections to the remote host.

The Raptor Firewall and Novell NetWare are known to be vulnerable to this flaw, although other network devices may be vulnerable as well.

By probing the remote NNTP server, Nessus is able to collect information about it, such as whether it allows remote connections, the number of newsgroups, etc.

Nessus has determined that the remote host is a wireless access point (AP).

Ensure that proper physical and logical controls are in place for its use. A misconfigured access point may allow an attacker to gain access to an internal network without being physically present on the premises. If the access point is using an 'off-the-shelf' configuration (such as 40 or 104 bit WEP encryption), the data being passed through the access point may be vulnerable to hijacking or sniffing.

One of several ports that were previously open are now closed or unresponsive.

There are several possible reasons for this :

  - The scan may have caused a service to freeze or stop     running.

  - An administrator may have stopped a particular service     during the scanning process.

This might be an availability problem related to the following :

  - A network outage has been experienced during the scan,     and the remote network cannot be reached anymore by the     scanner.

  - This scanner may has been blacklisted by the system     administrator or by an automatic intrusion detection /     prevention system that detected the scan.

  - The remote host is now down, either because a user     turned it off during the scan or because a select denial     of service was effective.

In any case, the audit of the remote host might be incomplete and may need to be done again.

The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol. 

These protocols are not completely cryptographically safe so they should not be used.

This plugin determines the versions of the SSH protocol supported by the remote SSH daemon.

This script performs a Labrea tarpit scan, by sending a bogus ACK and ACK-windowprobe to a potential host.  It also sends a TCP SYN to test for non-persisting labrea machines.

It was possible to crash the remote service by flooding it with too much data.

An attacker may use this flaw to make this service crash continuously, preventing this service from working properly. It may also be possible to exploit this flaw to execute arbitrary code on this host.

The remote host answers to an ICMP timestamp request.  This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.

Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.

The remote host answers to an ICMP_MASKREQ query and responds with its netmask.  An attacker can use this information to understand how your network is set up and how routing is done.  This may help him to bypass your filters.

ID	Name	Severity
25203	Enumerate IPv4 Interfaces via SSH	info
25202	Enumerate IPv6 Interfaces via SSH	info
24904	Link Layer Topology Discovery (LLTD) Detection	info
22869	Software Enumeration (SSH)	info
21643	SSL Cipher Suites Supported	info
20887	ICMP Domain Name Request	info
20094	VMware Virtual Machine Detection	info
18405	Remote Desktop Protocol Server Man-in-the-Middle Weakness	medium
17204	News Server (NNTP) Anonymous Read / Write Access	medium
15901	SSL Certificate Expiry	medium
14788	IP Protocols Scan	info
14674	identd Service UID Association	info
14664	External Scanner Service Identification	info
12264	Record Route	info
12053	Host Fully Qualified Domain Name (FQDN) Resolution	info
25249	OS Identification : ICMP	info
11936	OS Identification	info
10443	TCP/IP Predictable ISN (Initial Sequence Number) Generation Weakness	high
11057	TCP/IP Initial Sequence Number (ISN) Reuse Weakness	high
11033	News Server (NNTP) Information Disclosure	info
11026	Wireless Access Point Detection	info
10919	Open Port Re-check	info
10882	SSH Protocol Version 1 Session Key Retrieval	high
10881	SSH Protocol Versions Supported	info
10796	LaBrea Tarpitted Host Detection	info
10735	Generic Overflow Detection	high
10287	Traceroute Information	info
10114	ICMP Timestamp Request Remote Date Disclosure	low
10113	ICMP Netmask Request Information Disclosure	low

Detections

Analytics

General Family for Nessus

info

info

info

info

info

info

info

medium

medium

medium

info

info

info

info

info

info

info

high

high

info

info

info

high

info

info

high

info

low

low