The remote host is running Mercury's LoadRunner.  This tool is used to manage and test network applications.  In the past, LoadRunner has been vulnerable to remote attacks. 

The remote host is a 'remoting' server.  .NET Remoting is an API developed by Microsoft and used for interprocess communications that take place over a channel.

The remote host is a 'remoting' client.  .NET Remoting is an API developed by Microsoft and used for interprocess communications that take place over a channel.

The remote server is a Nokia Intellisync Server.  These portals are designed for access by users of portable devices (PDA, cell phone, etc.).  One of the server components is a syncing port (TCP/3102) that maintains state and synchronization with the remote clients.

The remote host is acting as a Socks version 5 proxy.  This allows remote proxy clients to tunnel traffic through the host.  This sort of behavior is somewhat commonplace on compromised hosts.

The remote host is acting as a Socks version 4 proxy.  This allows remote proxy clients to tunnel traffic through the host.  This sort of behavior is somewhat commonplace on compromised hosts.

The remote host is running a Teredo server.  Teredo is a protocol for tunneling IPv6 over UDP and is used to enable nodes to obtain IPv6 connectivity even when they are located behind IPv4 NAT devices that have no support for IPv6. A Teredo server is a node that is connected to both IPv4 and IPv6 internets and supports a Teredo tunneling interface over which packets are received.

The remote client is a Teredo client.  Teredo allows clients to tunnel IPv6 traffic over IPv4.  The protocol operates over UDP port 3544 and the RFC draft is sponsored by Microsoft.  Teredo client puts the IPv6 data inside of an IPv4 packet and sends it to a gateway machine.  The gateway machine then strips away the IPv4 header and delivers the IPv6 packet.  Given this, Teredo can be used to circumvent firewall rules.  

The remote host is running Novell software.  In addition, the software is announcing itself on the network as a service agent.

The remote host is running Novell client software.

The remote host is running ZoneAlarm, a firewall for Windows.  The vendor has released version 6.5.722.000 of ZoneAlarm.  This version corrects several bugs within the firewall.

The remote host is running Winamp, a multi-media software application.  This version of Winamp is vulnerable to multiple heap overflows.  Specifically, the application fails to handle buffers when handling 'ultravox-max' and 'Lyrics3' tags.  An attacker exploiting this flaw would need to be able to convince a user into perusing a malicious media server.  Successful exploitation would give the attacker the ability to execute code with the privileges of the user running Winamp.

The remote server is an H.323 proxy that understands the Skinny protocol, also known as SCCP, for 'Skinny Client Control Protocol'.  Skinny is Cisco's proprietary lightweight terminal control protocol used by some VoIP phones to communicate with Cisco CallManager or Asterisk PBX systems.

The remote host is running the ZABBIX client.  ZABBIX is a client-server application that allows a central server to collect and manage results from multiple clients.

The remote host is running the Asterisk Voice Over IP (VoIP) Server.  This service is used to manage phone calls between Internet hosts.

The remote host is running a SIP server. This protocol is used to connect VoIP users via the Internet.

The remote host is running a Cisco SIP VOIP server.  The device is configured to allow TFTP access.  An attacker can guess the name of the image files and download the device configuration.  Such information would include passwords and IDs.  

The remote host is running a SIP client. This protocol is used to connect VoIP users via the Internet.

The remote web server contains CGI scripts that are vulnerable to cross-site scripting attacks.  The remote web server contains a CGI script used by Sun Secure Global Desktop or Tarantella, a Java-based program for web-enabling applications running on a variety of platforms.  According to the version reported in one of its scripts, the installation of the software on the remote host fails to sanitize user-supplied input to several unspecified parameters before using it to generate dynamic web content.  An unauthenticated remote attacker may be able to leverage these issues to inject arbitrary HTML and script code into a user's browser to be evaluated within the security context of the affected web site.

The remote server is running the Sun Secure Global Desktop, a web server application that allows access from multiple platforms.

The remote version of HP OpenView Data Protector is vulnerable to an authentication bypass flaw. By sending specially crafted requests to the remote host, an attacker may be able to execute unauthorized Backup commands. Due to the nature of the software, a successful exploitation of this vulnerability could result in remote code execution.

The remote host is running HP OpenView Storage Data Protector.

The remote host may be running a NAT device.

The remote device appears to be a network firewall or proxy server.  NNM has determined this due to the device flagging as multiple operating systems within a short time frame.

The remote host is running F-Secure, a firewall and antivirus software package.

The remote host is running F-Secure, a firewall and antivirus software package.  This version of F-Secure is vulnerable to a flaw where specially crafted file names are not scanned.  This can lead to potentially damaging files not being deleted or quarantined.  An attacker exploiting this flaw would only need the ability to create these files and deliver them to a vulnerable F-Secure user.  Successful exploitation would result in a false sense of security.

The remote host is running OpenOffice.org application.

The remote host is running the Helix RealServer streaming media server.  All versions of Helix 10.0.x and 11.0.x are vulnerable to multiple remote buffer overflows.  Apparently, the application does not properly sanitize malformed HTTP requests.  An attacker exploiting this flaw would only need to be able to send HTTP requests to the Helix server.  Successful exploitation would result in the attacker executing arbitrary code.

The remote host is running Winamp, a multimedia software application.  This version of Winamp is vulnerable to a buffer overflow.  Specifically, when handling a malformed MIDI file, Winamp may crash, possibly executing arbitrary code.  An attacker exploiting this flaw would need to be able to convince a Winamp user to open a malicious MIDI file.

The remote host is running Microsoft Windows Media Player version 9.  There is a vulnerability in the remote version of this software that may allow an attacker to execute arbitrary code on the remote host.  To exploit this flaw, an attacker would need to be able to convince a user to open a malicious media resource using the vulnerable player.

The remote host is running Microsoft Media Player version 10.  There is a vulnerability in the remote version of this software that may allow an attacker to execute arbitrary code on the remote host.  To exploit this flaw, one attacker would need to be able to convince a user to open a malicious media resource using the vulnerable player.

The remote host is running EMC Legato Networker, an enterprise application that enables centralized file management, backup and more.  This version of Networker is vulnerable to a number of vulnerabilities including buffer overflows.  Given this, an attacker can gain full control of the remote server using a number of attack vectors.

According to its version number, the installed instance of Retrospect client is vulnerable to a buffer overflow when it receives a packet starting with a specially-crafted sequence of bytes.  An unauthenticated remote attacker may be able to exploit this flaw to execute code on the remote host.

The remote host is running the StoneGate VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN that allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of risk to the internal computing environment. 

The remote host is running the Avaya VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN that allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of risk to the internal computing environment. 

The remote host is running the Netscreen VPN Server.  A VPN (Virtual Private Network) allows remote users to connect to an internal network as if they were local users.  A VPN that allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of risk to the internal computing environment. 

ID	Name	Severity
3911	Mercury LoadRunner Detection	info
3886	Microsoft Remoting Client Detection	info
3885	Microsoft Remoting Client Detection (deprecated)	info
3666	Nokia Intellisync Web Portal Detection (deprecated)	info
3884	Socks 5 Proxy Detection	info
3883	Socks 4 Proxy Detection	info
3876	Teredo Server Detection	info
3875	Teredo IPv6 Client Detection	info
3844	Novell Service Agent Detection	info
3843	Novell Client Detection	info
3667	ZoneAlarm < 6.5.722.000 Multiple Vulnerabilities	high
3800	Winamp < 5.31 Multiple Heap Overflows	low
3795	Skinny Server Detection	info
3789	ZABBIX Client Detection	info
3768	Asterisk VoIP Server Detection	info
3767	SIP Server Detection	info
3764	Cisco SIP TFTP Server Detection	medium
3763	SIP Server Detection	info
3762	SIP Client Detection	info
3760	Sun Secure Global Desktop / Tarantella < 4.20.983 Multiple XSS	medium
3759	Sun Secure Global Desktop Detection	info
3728	HP OpenView Storage Data Protector Backup Agent Remote Arbitrary Command Execution	medium
3727	HP OpenView Storage Data Protector Detection	info
3722	Firewall / Proxy / NAT Dependency	info
3721	Firewall / Proxy / NAT Dependency	info
3720	Firewall / Proxy / NAT Dependency	info
3719	Proxy / Firewall Detection	info
3718	Firewall / Proxy / NAT Dependency	info
3717	Firewall / Proxy / NAT Dependency	info
3716	Firewall / Proxy / NAT Dependency	info
3715	Proxy / Firewall Detection Via User-Agent	info
3712	Firewall / Proxy / NAT dependency	info
3711	Firewall / Proxy / NAT Dependency	info
3710	Firewall / Proxy / NAT Dependency	info
3709	Firewall / Proxy / NAT Dependency	info
3708	Proxy / Firewall Detection Via Update	info
3704	Proxy / Firewall Detection Via Update	info
3676	F-Secure Product Detection (UDP)	info
3675	F-Secure Scan Evasion	medium
3673	OpenOffice.org Detection	info
3664	Helix RealServer < 11.1.0.801 Remote Overflow	high
3658	Winamp < 5.22 MIDI File Handling Overflow	medium
3651	Microsoft Windows Media Player PBG File Processing Overflow (917734)	medium
3650	Microsoft Windows Media Player PNG Processing Overflow (917734)	medium
3630	Networker Multiple Vulnerabilities	high
3615	EMC Retrospect Client Packet Handling Overflow	medium
3614	StoneGate VPN Detection	info
3613	StoneGate VPN Detection	info
3612	Avaya VPN Detection	info
3611	Netscreen VPN Detection	info

Detections

Analytics

Generic Family for Nessus Network Monitor

info

info

info

info

info

info

info

info

info

info

high

low

info

info

info

info

medium

info

info

medium

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

info

high

medium

medium

medium

high

medium

info

info

info

info