The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_07_stable-channel-update advisory.

  - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages     to the plugin broker process that should have come from the browser process, which allows remote attackers     to bypass a sandbox protection mechanism via an unexpected message type, related to     broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and     render_frame_message_filter.cc. (CVE-2016-1706)

  - ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure     that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL     display via a crafted web site. (CVE-2016-1707)

  - The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome     before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows     remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact     via a crafted web site. (CVE-2016-1708)

  - Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before     2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a crafted SFNT font. (CVE-2016-1709)

  - The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in     Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows     remote attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates.
An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 101, 7 Update 111, or 6 Update 121. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the CORBA subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-3458)

  - An unspecified flaw exists in the Networking     subcomponent that allows a local attacker to impact     integrity. (CVE-2016-3485)

  - An unspecified flaw exists in the JavaFX subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2016-3498)

  - An unspecified flaw exists in the JAXP subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3500)

  - An unspecified flaw exists in the Install subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3503)

  - An unspecified flaw exists in the JAXP subcomponent that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3508)

  - An unspecified flaw exists in the Deployment     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-3511)

  - An unspecified flaw exists in the Hotspot subcomponent     that allows an unauthenticated, remote attacker to     disclose potentially sensitive information.
    (CVE-2016-3550)

  - An unspecified flaw exists in the Install subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3552)

  - A flaw exists in the Hotspot subcomponent due to     improper access to the MethodHandle::invokeBasic()     function. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2016-3587)

  - A flaw exists in the Libraries subcomponent within the     MethodHandles::dropArguments() function that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-3598)

  - A flaw exists in the Hotspot subcomponent within the     ClassVerifier::ends_in_athrow() function when handling     bytecode verification. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-3606)

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2016-3610)

The version of Oracle JRockit installed on the remote Windows host is 28.3.10. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Networking     subcomponent that allows a local attacker to impact     integrity. (CVE-2016-3485)

  - Multiple unspecified flaws exist in the JAXP     subcomponent that allow an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3500, CVE-2016-3508)

Nessus was able to gather evidence of cached search results from Windows Explorer searches.

Nessus was able to generate a report of files opened in WordPad on the remote host.

Nessus was able to generate a report of WinSCP connections and connection settings.

Nessus was able to gather evidence of compressed files that were opened by WinRAR. Note that only compressed files that were opened and not extracted through the explorer shortcut or command line interface were reported.

Nessus was able to gather evidence from the UserAssist registry key that has a list of programs that have been executed.

Nessus was able to generate a report of all files listed in the default user download folder.

Nessus was able to generate a report on terminal service connections on the target system.

Nessus was able to collect the Skype user configuration files for each system user.

Nessus was able to gather a list of settings from the target system that store common user folder locations. A few of the more common locations are listed below :

  - Administrative Tools
  - AppData
  - Cache
  - CD Burning
  - Cookies
  - Desktop
  - Favorites
  - Fonts
  - History
  - Local AppData
  - My Music
  - My Pictures
  - My Video
  - NetHood
  - Personal
  - PrintHood
  - Programs
  - Recent
  - SendTo
  - Start Menu
  - Startup
  - Templates

Nessus was able to find evidence of the last key that was opened when the Registry Editor was closed for each user.

Nessus was able to generate a list of all files found in $Recycle.Bin subdirectories.

Nessus was able to gather evidence of files opened by file type from the remote host.

Nessus was able to generate a list of files opened using the Microsoft Paint program.

Nessus was able to generate a report on files that were opened using the shell dialog box or saved using the shell dialog box. This is the box that appears when you attempt to save a document or open a document in Windows Explorer.

Nessus was able to gather evidence of files that were opened using any Microsoft Office application. The report was extracted from Office MRU (Most Recently Used) registry keys.

Nessus was able to query the MUIcache registry key to find evidence of program execution.

Nessus was able to find evidence of program execution using Windows Explorer registry logs and settings.

Nessus was able to generate a report of mapped network drives on the remote Windows host.

Nessus was able to generate a list URLs that were manually typed into the Internet Explorer address bar.

Nessus was able to query the system to generate a list of files opened by Foxit programs.

Nessus was able to generate a list of URLs that set Flash cookies on the remote host.

Nessus was able to enumerate the directory paths that users visited by manually typing the full directory path into Windows Explorer. The generated folder list report contains folders local to the system, folders from past mounted network drives, and folders from mounted devices.

Nessus was able to query the registry to find the most recent program to use Direct3D for each user on the remote Windows host.

Nessus was able to enumerate folders that were opened in Windows Explorer. Microsoft Windows maintains folder settings using a registry key known as shellbags or BagMRU. The generated folder list report contains folders local to the system, folders from past mounted network drives, and folders from mounted devices.

Nessus was able to generate a report on the application compatibility cache on the remote Windows host.

Nessus was able to query Adobe settings on the remote Windows host to find recently opened Adobe file information.

Nessus was able to query 7-Zip settings on the remote Windows host to find recently accessed compressed files.

The version of Apple iTunes installed on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Nessus was able to collect the time of the last password change for active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of active sessions on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect group details for currently active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of SMB sessions from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details for NetBIOS over TCP/IP from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of the DNS cache from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect ARP table information from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect time zone information from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect system and user level Windows scripting host settings from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect and report the PowerShell execution policy for the remote Windows host.

Nessus was able to collect and report the remote host's last boot time as an ISO 8601 timestamp.

Nessus was able to collect the hosts file from the remote Windows host and report it as attachment.

Nessus was able to collect system and active account environment variables on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect available device logs from the remote Windows host and add them as attachments.

Nessus was able to collect AppLocker configuration information on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment.

Microsoft Visio, a diagramming and vector graphics application, is installed on the remote Windows host.

ID	Name	Severity
92628	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities	critical
92557	stunnel 4.46 < 5.34 Improper Level 4 Peer Certificate Validation Security Bypass	critical
92516	Oracle Java SE Multiple Vulnerabilities (July 2016 CPU)	critical
92492	Oracle JRockit R28.3.10 Multiple Vulnerabilities (July 2016 CPU)	low
92439	Explorer Search History	info
92438	WordPad History	info
92437	WinSCP History	info
92436	WinRAR History	info
92435	UserAssist Execution History	info
92434	User Download Folder Files	info
92433	Terminal Services History	info
92432	Skype User Configuration Files	info
92431	User Shell Folders Settings	info
92430	Registry Editor Last Accessed	info
92429	Recycle Bin Files	info
92428	Recent File History	info
92427	Microsoft Paint Recent File History	info
92426	OpenSaveMRU History	info
92425	Microsoft Office File History	info
92424	MUICache Program Execution History	info
92423	Windows Explorer Recently Executed Programs	info
92422	Windows Mapped Network Drives	info
92421	Internet Explorer Typed URLs	info
92420	Foxit History	info
92419	Flash Cookie History	info
92418	Windows Explorer Typed Paths	info
92417	Direct3D Recent Program	info
92416	BagMRU Folder History	info
92415	Application Compatibility Cache	info
92414	Adobe Recent Files	info
92413	7-Zip Recent Files	info
92410	Apple iTunes < 12.4.2 Multiple Vulnerabilities (credentialed check)	critical
92377	Microsoft Windows Current Users Last Password Change	info
92376	Microsoft Windows Current Users	info
92375	Microsoft Windows Current Sessions	info
92374	Microsoft Windows Current Groups	info
92373	Microsoft Windows SMB Sessions	info
92372	Microsoft Windows NetBIOS over TCP/IP Info	info
92371	Microsoft Windows DNS Cache	info
92370	Microsoft Windows ARP Table	info
92369	Microsoft Windows Time Zone Information	info
92368	Microsoft Windows Scripting Host Settings	info
92367	Microsoft Windows PowerShell Execution Policy	info
92366	Microsoft Windows Last Boot Time	info
92365	Microsoft Windows Hosts File	info
92364	Microsoft Windows Environment Variables	info
92363	Microsoft Windows Device Logs	info
92362	Microsoft Windows AppLocker Configuration	info
92361	Microsoft Office Macros Configuration	info
92220	Microsoft Visio Installed (credentialed check)	info

Detections

Analytics

Windows Family for Nessus

critical

critical

critical

low

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info