The remote host is running a Group Policy server.

The remote host is running the NetBIOS protocol and is a part of the identified domain.

The remote host is a NETBIOS workstation which is a part of the following Domain or workgroup

The remote host is running the X Server software.

The version of Windows Media Services running on the remote host has a buffer overflow vulnerability.  This issue is related to the way the Windows Media Unicast Service handles specially crafted transport information packets.  A remote attacker could exploit this to execute arbitrary code.

The remote host is running a Windows Media Service server, a media streaming server.

The remote host is running the Microsoft Media Server.

The remote host is running Zabbix, an IT monitoring service.  The installed version of Zabbix is earlier than 1.8.2.  Such versions are potentially affected by a SQL-injection vulnerability in the 'user' parameter of the 'api.jsonrpc.php' script.  A remote, unauthenticated attacker could exploit this flaw to gain control of the affected application.

The version of Altiris Deployment Solution installed on the remote host is earlier than 6.9 SP4.  Such versions are reportedly affected by a denial of service vulnerability.  The DBManager component has a user-after-free error when processing specially crafted 'CreateSession' and 'PXEManagerSignOn' requests.  A remote attacker could exploit this to crash the DBManager service.

The remote host is running memcached, a distributed memory object caching system.  The installed version of memcached is earlier than 1.4.3.  Such versions are potentially affected by a denial of service vulnerability because the application continues to read in new data, reallocating its input buffer until a newline character is received which could lead to excessive memory consumption.  An attacker, exploiting this flaw, could crash the affected service.

According to its banner, the remote host is running version 11.x, 12.x, or 13.x of RealNetworks Helix Server / Helix Mobile Server.  Such versions are potentially affected by multiple vulnerabilities.

  - A heap overflow exists in the NTLM authentication code related to invalid Base64 encoding. (CVE-2010-1317)

  - A stack-based buffer overflow within AgentX++ could lead to arbitrary code execution. (CVE-2010-1318)

  - An integer overflow within AgentX++ could lead to arbitrary code execution. (CVE-2010-1319)

A DNS domain name resolution has been observed.

A Common Platform Enumeration (CPE) is a standard method of describing and identifying classes of applications, operating systems, and hardware devices. One or more CPEs have been identified on the remote host.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running eDirectory, a directory service software from Novell.  The eMBox service included with the installed version of eDirectory is affected by a denial of service vulnerability.  By sending a specially crafted HTTP SOAP request, it may be possible for a remote attacker to crash the remote service.

The version of OpenOffice installed on the remote host is earlier than 3.2.  Such versions are potentially affected by several issues : 

  - Signatures may not be handled properly due to a vulnerability in the libxml2 library. (CVE-2006-4339)

  - There is an HMAC truncation authentication bypass vulnerability in the libxmlsec library. (CVE-2009-0217)

  - The application is bundled with a vulnerable version of the Microsoft VC++ runtime. (CVE-2009-2493)

  - Specially crafted XPM files are not processed properly, which could lead to arbitrary code execution. (CVE-2009-2949)

  - Specially crafted GIF files are not processed properly, which could lead to arbitrary code execution. (CVE-2009-2950)

  - Specially crafted Microsoft Word documents are not processed properly, which could lead to arbitrary code execution. (CVE-2009-3301 / CVE-2009-3302)

The remote host has performed a DNS lookup.

The remote client has issued a name query for the following FQDN

The remote host is running the Symantec-Raptor VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the Symantec-Raptor-v8.1 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the Netscreen-16 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the Netscreen-15 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment. 

The remote host is running the Netscreen-14 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment. 

The remote host is running the strongSwan 2.7.0 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 2.7.1 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 2.7.2 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 2.7.3 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 2.8.0 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 4.0.0 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment. 

The remote host is running the strongSwan 4.0.1 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 4.0.2 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 4.0.3 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 4.0.4 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The remote host is running the strongSwan 4.0.5 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment. 

The remote host is running the Dead Peer Detection v1.0 VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment. 

The remote host is running the Windows-Vista VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN which allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of Risk to the internal computing environment.

The installed version is earlier than 6.3.1 Update 1.  Such versions are potentially affected by multiple vulnerabilities : 

 - Under certain conditions simultaneous long binds are incorrectly assigned the same backed connections.  An attacker may exploit this flaw to hijack an authenticated user's session and perform unauthorized operations. (CVE-2009-4440)
 - 'SO_KEEPALIVE' socket option is not enabled, and hence it may be possible for a remote attacker to trigger a denial of service condition by exhausting available connection slots. (CVE-2009-4441)
 - 'max-client-connections' configuration setting is not correctly implemented, thus it may be possible for a remote attacker to trigger a denial of service condition. (CVE-2009-4442)
 - An unspecified vulnerability in the 'psearch' functionality could allow an attacker to trigger a denial of service condition. (CVE-2009-4443)

The remote host is running Zabbix, an IT monitoring service.  The installed version of Zabbix is earlier than 1.6.8.  Such versions are potentially affected by multiple vulnerabilities : 

  - A denial-of-service vulnerability in the 'zbx_get_next_field()' function. (ZBX-1355)

  - A SQL-injection vulnerability in the 'send_history_last_id()' function of the 'zabbix_server/trapper/nodehistory.c' source file. (ZBX-1031)

  - It is possible for remote unauthenticated users to execute OS commands. (ZBX-1030)

The remote host is running Zabbix, an IT monitoring service.  The installed version of Zabbix is earlier than 1.6.7.  Such versions are potentially affected by a security bypass vulnerability because the application does not prevent unauthenticated users from executing arbitrary SQL queries (ZBX-1031).

The remote host is running Zabbix, an IT monitoring service.  The installed version of Zabbix is earlier than 1.6.6.  Such versions are potentially affected by a Null Pointer Dereference vulnerability in the 'process_trap()' function of the 'zabbix_server/trapper/trapper.c' source file.  An attacker can exploit this flaw to crash the affected service.

The remote host is running Winamp, a media player for Windows.  The version of Winamp installed on the remote host is earlier than 5.57.  Such versions are potentially affected by multiple vulnerabilities : 

  - A boundary error in the Module Decoder Plug-in exists when parsing samples and can be exploited to cause a heap-based buffer overflow via a specially crafted 'Impulse Tracker' file. (CVE-2009-3995)

  - An error in the Module Decoder Plug-in when parsing 'Ultratracker' files can be exploited to cause a heap-based buffer overflow. (CVE-2009-3996)

  - An integer overflow error exists in the Module Decoder Plug-in when parsing 'Oktalyzer' files and can be exploited to cause a heap-based buffer overflow.

  - Multiple integer overflow vulnerabilities in the 'jpeg.w5s' and 'png.w5s' filters when processing malformed 'JPEG' and 'PNG' data.

The remote host is running eDirectory, a directory service from Novell.  The installed version is earlier than 8.8 SP5 ftf2, or 8.7.3.10 ftf2.  Such versions are potentially affected by a remote buffer overflow vulnerability when handling specially crafted 'NDS Verb 0x1' requests.  An attacker, exploiting this flaw, could execute arbitrary commands on the host subject to the privileges of the affected software.

The remote host is using default credentials, and these credentials were passed in plaintext.

The remote host is running an SMB client that was observed downloading a file.

ID	Name	Severity
7031	Microsoft Group Policy Server Detection	info
7030	NetBIOS Domain Detection	info
5533	NETBIOS Domain/workgroup Detection	info
5528	X Server Detection	info
9053	Microsoft Windows Media Services Remote Code Execution (MS10-025) (deprecated)	critical
7029	MS10-025: Vulnerability in Microsoft Windows Media Services Could Allow Remote Code Execution (980858) (deprecated)	critical
7028	Windows Media Service Server Detection (deprecated)	info
5525	Microsoft Media Server Version Detection (deprecated)	info
5519	Zabbix 1.8.x < 1.8.2 'DBCondition' Parameter SQL Injection	high
5515	Altiris Deployment Solution < 6.9 SP4 DBManager DoS (SYM10-007)	medium
5514	Memcached < 1.4.3 No Newline Memory Consumption DoS	medium
5511	RealNetworks Helix Server 11.x / 12.x / 13.x Multiple Vulnerabilities	critical
7027	DNS Client Failed Query Detection	info
7026	DNS Domain Name Resolution Detection	info
7025	Common Platform Enumeration (CPE) Detection	info
5500	DNS Query Failed	info
5499	DNS Query Failed	info
5498	DNS Generic Query Detection	info
5497	DNS Generic Query Detection	info
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	critical
5341	Novell eDirectory < 8.8 SP5 Patch 3 eMBox SOAP Request DoS	medium
5339	OpenOffice < 3.2 Multiple Vulnerabilities	medium
7024	DNS Client Query Detection	info
5326	DNS Client Query Detection	info
5322	Symantec-Raptor VPN Detection	info
5321	Symantec-Raptor-v8.1 VPN Detection	info
5320	Netscreen-16 VPN Detection	info
5319	Netscreen-15 VPN Detection	info
5318	Netscreen-14 VPN Detection	info
5317	strongSwan 2.7.0 VPN Detection	info
5316	strongSwan 2.7.1 VPN Detection	info
5315	strongSwan 2.7.2 VPN Detection	info
5314	strongSwan 2.7.3 VPN Detection	info
5313	strongSwan 2.8.0 VPN Detection	info
5312	strongSwan 4.0.0 VPN Detection	info
5311	strongSwan 4.0.1 VPN Detection	info
5310	strongSwan 4.0.2 VPN Detection	info
5309	strongSwan 4.0.3 VPN Detection	info
5308	strongSwan 4.0.4 VPN Detection	info
5307	strongSwan 4.0.5 VPN Detection	info
5306	Dead Peer Detection v1.0 VPN Detection	info
5305	Windows-Vista VPN Detection	info
5289	Sun Java System Directory Proxy Server 6.x < 6.3.1 Update 1 Multiple Vulnerabilities	medium
5270	Zabbix < 1.6.8 Multiple Vulnerabilities	high
5269	Zabbix < 1.6.7 Security Bypass Vulnerability	high
5268	Zabbix < 1.6.6 Null Pointer Dereference DoS	medium
5267	Winamp < 5.57 Multiple Vulnerabilities	medium
5251	eDirectory < 8.8.5.2/8.7.3.10 ftf2 'NDS Verb 0x1' Buffer Overflow	high
7022	Default Credentials Detection	info
7021	SMB Client File Download	info

Detections

Analytics

Generic Family for Nessus Network Monitor

info

info

info

info

critical

critical

info

info

high

medium

medium

critical

info

info

info

info

info

info

info

critical

medium

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

high

high

medium

medium

high

info

info