This plugin is a complement of find_service1.nasl.  It attempts to identify common services which might have been missed because of a network problem.

Cfengine is a language-based system for testing and configuring Unix systems attached to a TCP/IP network.

The remote host is running distcc, a distributed GCC compiler.  distcc allows a user to use the resources several hosts to compile his programs more quickly. 

As distcc allows anyone to execute arbitrary commands on the remote host, it should be configured to only accept connections from a restricted set of IP addresses, otherwise an attacker can use it to obtain an interactive shell on the remote host with the privileges of the distcc daemon (usually 'distccd').

The remote host is running the Subversion server.  Subversion is a software product which is similar to CVS in that it manages file revisions and can be accessed across a network by multiple clients.

H323 is a protocol used all over the Internet.  It is used for Voice Over IP (VoIP), Microsoft NetMeeting, and countless other applications.  Nessus was able to determine that the remote device supports the H323 protocol. 

Make sure the use of this program is done in accordance with your corporate security policy.

The remote service is the web interface for eMule, an eDonkey2000 compatible peer-to-peer file sharing application.

The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running. 

This plugin attempts to discover mDNS used by hosts that are not on the network segment on which Nessus resides.

The remote host is running a version of HALO Network Server.  The server is used to host Internet and Local Area Network (LAN) games.

The remote host is running a version of Unreal Tournament Server. The Server is used to host Internet and Local Area Network (LAN) games.

Yahoo Messenger is running on this machine and listening on this port. It allows a user to chat and share files with remote entities.

The remote system is running software that speaks the Session Initiation Protocol (SIP).

SIP is a messaging protocol to initiate communication sessions between systems.  It is a protocol used mostly in IP Telephony networks / systems to setup, control, and teardown sessions between two or more systems.

The remote host seems to be enabled to do Internet Key Exchange (IKE) version 1. This is typically indicative of a VPN server. VPN servers are used to connect remote hosts into internal resources. 

Make sure that the use of this VPN endpoint is done in accordance with your corporate security policy. 

Note that if the remote host is not configured to allow the Nessus host to perform IKE/IPSEC negotiations, Nessus won't be able to detect the IKE service. 

Also note that this plugin does not run over IPv6.

SAP DB or MaxDB, an ERP software, is running on the remote port.

The remote host is running HELLO, an obsolete routing protocol.
If possible, this IP protocol should be disabled.

The remote host is running EGP, an obsolete routing protocol. 

If possible, this IP protocol should be disabled.

The remote host is running BGP, a popular routing protocol.  This indicates that the remote host is probably a network router.

The remote host is running OSPF, a popular routing protocol.

A 'NetInfo' daemon is running on this port.  NetInfo is in charge of maintaining databases (or 'maps') regarding the system.  Such databases include the list of users, the password file, and more.  If the remote host is not a NetInfo server, this service should not be reachable directly from the network.

The remote service is a SOCKS (SOCKetS) server, which allows client applications to operate transparently through a firewall.

RIP is an Interior Gateway Protocol and is based on the distance vector routing algorithm.

Routing tables may disclose your internal network architecture and help a remote attacker.

The remote host is running a TFTP (Trivial File Transfer Protocol) daemon. TFTP is often used by routers and diskless hosts to retrieve their configuration. It can also be used by worms to propagate.

The remote host is running a RADIUS server.

The remote web server accepts connections encrypted using Secure HyperText Transfer Protocol (S-HTTP), a cryptographic layer that was defined in 1999 by RFC 2660 and never widely implemented.

The remote host is running Remote PC Access Server. It is, therefore, affected by an information disclosure vulnerability due to the protocol transmitting username and passwords in cleartext. A man-in-the-middle attacker can exploit this to disclose the credentials and then take control of the remote system.

The remote host is a WSP100 802.11b Remote Sensor from Network Chemistry.

This device sniffs data flowing on the channels used by 802.11b and forwards it to any host which 'subscribes' to this device.

An attacker may use this device to sniff 802.11b networks of the area it is deployed from any location.

The remote service is a daemon to monitor and manage an APC UPS battery backup unit.

An IMAP (Internet Message Access Protocol) server is installed and running on the remote host.

The remote service supports the Notes Remote Procedure Call protocol, which is used by Lotus Notes and Lotus Domino to communicate with other servers.

The remote rsync server can be accessed remotely.

The remote host is running a 'discard' service.  This service typically sets up a listening socket and will ignore all the data which it receives. 

This service is unused these days, so it is advised that you disable it.

This service gives potential attackers information about who is connected and who isn't, easing social engineering attacks for example.

This plugin determines the version of the IRC daemon.

Nessus was unable to identify a service on the remote host even though it returned a banner of some type.

It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives a 'HELP' request.

A QMTP/QMQP server is running on this port.
QMTP is a proposed replacement of SMTP by D.J. Bernstein.

** Note that Nessus only runs SMTP tests currently.

It seems that 'Red Hat Interchange' ecommerce and dynamic content management application is running in 'Inet' mode on this port.

Versions 4.8.5 and earlier are flawed and may disclose contents of sensitive files to attackers.

** Nessus neither checked Interchange version nor tried 
** to exploit the vulnerability

The remote host is running xteld, a Minitel emulator. This service allows users to connect to the Teletel network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services.

The remote host is running xteld, a Minitel emulator, in HyperTerminal mode. This service allows users to connect to the Teletel network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services.

By sending a DUMP request to the portmapper, it was possible to enumerate the ONC RPC services running on the remote port.  Using this information, it is possible to connect and bind to each service by sending an RPC request to the remote port.

The remote host is an Alcatel PABX 4400.

This device can be configured thru the serial port or using this port. 

Outsiders should not be able to connect to this device.

Citrix servers allow a Windows user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

NOTE: by default the Citrix Server application utilizes a weak 40 bit obfuscation algorithm (not even a true encryption).  If the default settings have not been changed, there are tools that can be used to passively discover userIDs and passwords as they traverse a network.

If this server is located within your DMZ, the risk is substantially higher, as Citrix necessarily requires access into the internal network for applications like SMB browsing, file sharing, email synchronization, etc.

If an attacker gains a valid login and password, this service could be used to gain further access on the remote host or remote network. This protocol has also been shown to be vulnerable to a man-in-the-middle attack.

The Remote Desktop Protocol allows a user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

If an attacker gains a valid login and password, this service could be used to gain further access on the remote host.  An attacker may also use this service to mount a dictionary attack against the remote host to try to log in remotely.

Note that RDP (the Remote Desktop Protocol) is vulnerable to Man-in-the-middle attacks, making it easy for attackers to steal the credentials of legitimate users by impersonating the Windows server.

The X Display Manager Control Protocol (XDMCP) service allows a Unix user to remotely obtain a graphical X11 login and therefore act as a local user on the remote host. If an attacker can gain a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to mount a dictionary attack against the remote host to try to log in remotely.

Note that XDMCP is vulnerable to man-in-the-middle attacks, making it easy for attackers to steal the credentials of legitimate users by impersonating the XDMCP server. In addition to this, XDMCP is not a ciphered protocol, which allows an attacker to capture the keystrokes entered by the user.

This machine answered to a unicast UPnP NOTIFY packet by trying to fetch the XML description that Nessus advertised.

Symantec pcAnywhere allows a Windows user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

The remote server is an RTSP server.  RTSP is a client-server multimedia presentation protocol, which is used to stream videos and audio files over an IP network. 

It is usually possible to obtain the list of capabilities and the server name of the remote RTSP server by sending an OPTIONS request.

The remote host is running VNC (Virtual Network Computing), which uses the RFB (Remote Framebuffer) protocol to provide remote access to graphical user interfaces and thus permits a console on the remote host to be displayed on another.

The remote host is running healthd, a daemon which uses the sensors of the remote host to report the temperature of various of its components. 

It is recommended to not let anyone connect to this port.

The remote service understands the Apple Filing Protocol (AFP) and responds to a 'FPGetSrvrInfo' ('DSIGetStatus') request with information about itself. 

AFP is used to offer file services for Mac OS X as well as the older Mac OS. In the past, it has also been known as 'AppleTalk Filing Protocol' and 'AppleShare'.

This script contacts the remote DHCP server (if any) and attempts to retrieve information about the network layout. 

Some DHCP servers provide sensitive information such as the NIS domain name, or network layout information such as the list of the network web servers, and so on. 

It does not demonstrate any vulnerability, but a local attacker may use DHCP to become intimately familiar with the associated network.

ID	Name	Severity
14772	Service Detection (2nd Pass)	info
14315	Cfengine Detection	info
12638	DistCC Detection	high
12259	Subversion Server Detection	info
12243	H323 Protocol / VoIP Application Detection	info
12233	eMule Web Server Detection	info
12218	mDNS Detection (Remote Network)	medium
12117	HALO Network Server Detection	info
12115	Unreal Tournament Server Detection	info
11993	Yahoo Messenger Detection	info
21642	Session Initiation Protocol Detection	info
11935	IPSEC Internet Key Exchange (IKE) Version 1 Detection	info
11929	SAP DB / MaxDB Detection	info
11913	DCN HELLO detection	info
11908	EGP Detection	info
11907	BGP Service Detection	info
11906	Open Shortest Path First (OSPF) Agent Detection	info
11897	NetInfo Daemon Detection	info
11865	SOCKS Server Detection	info
11822	RIP Detection	info
11819	TFTP Daemon Detection	info
11738	RADIUS Server Detection	info
11720	Secure HyperText Transfer Protocol (S-HTTP) Detection	medium
11673	Remote PC Access Server detection.	medium
11559	Network Chemistry Wireless Sensor Detection	medium
11483	apcnisd / apcupsd Detection	info
11414	IMAP Service Banner Retrieval	info
11410	IBM Lotus Notes Detection	info
11389	rsync Service Detection	info
11367	Discard Service Detection	info
11222	writesrv Service Detection	info
11156	IRC Daemon Version Detection	info
11154	Unknown Service Detection: Banner Retrieval	info
11153	Service Detection (HELP Request)	info
11134	QMTP/QMQP Server Detection	info
11128	Red Hat Interchange INET Mode Detection	medium
11121	xtel Detection	info
11120	xtelw Detection	info
11111	RPC Services Enumeration	info
11019	Alcatel PABX 4400 Detection	info
10942	Citrix Server Detection	info
10940	Remote Desktop Protocol Service Detection	info
10891	X Display Manager Control Protocol (XDMCP) Detection	medium
10829	UPnP Client Detection	info
10794	Symantec pcAnywhere Detection (TCP)	info
10762	RTSP Server Type / Version Detection	info
10758	VNC HTTP Server Detection	info
10731	healthd Detection	info
10666	Apple Filing Protocol Server Detection	info
10663	DHCP Server Detection	low

Detections

Analytics

Service detection Family for Nessus

info

info

high

info

info

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

medium

medium

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

medium

info

info

info

info

info

info

low