The remote CVS server is vulnerable to a double free() vulnerability that may allow an attacker to gain a shell on this host.

The remote server is running the CVS daemon.  The server is being used as a central file repository for maintenance of file or package version. 

The remote rsync server might be vulnerable to an array index overflow. An attacker may use this flaw to gain a shell on this host.

The remote host is running rsync on this port.

The remote server is running McAfee ePolicy Orchestrator. This service *might* be vulnerable to a format string attack which may allow an attacker to execute arbitrary commands with the SYSTEM privileges.

The remote host is running a version of apcupsd which is vulnerable to a buffer overflow. An attacker could exploit this flaw to gain a root shell on this host.

The remote host is running apcupsd, a APC battery manager backup unit manager. 

The remote host is running tanned. Some versions of this software are vulnerable to a format string attack which may allow an attacker to get a root shell on this host.

The remote host is running a NNTP server. 

The remote host is running the LeafNode NNTP server. The version of LeafNode that is installed is vulnerable to a denial of service attack that may be abused by an attacker to cause this system to fail.

VNC (Virtual Network Computing) is installed on this host on this port. Disable this service if it is not used actively and for a legitimate purpose.

The remote host is a Checkpoint Firewall version AI R55.

The remote host is running subversion, an open-source file management product.  According to the version number, the remote system is vulnerable to at least one remote buffer overflow. 

The remote server is running 'Subversion'.  Subversion is an alternative to CVS that is used to sync file revisions between multiple developers.

The remote client is running a version of the Nullsoft Winamp media player that may be vulnerable to a denial of service attack if the client is presented with a file containing an excessive number of characters and has the '.mid' extension. 

The H.323 protocol is used for Voice Over IP (VOIP), Microsoft NetMeeting and countless other applications.  NNM was able to observe that the server is using the H.323 protocol.

Winamp versions 3.0 build 488 and below suffer from a vulnerability in the processing of B4S files.

The remote client is running a version of the Nullsoft Winamp media player that may be vulnerable to a heap overflow. This vulnerability may be used to remotely crash the client or possible execute arbitrary code.

The remote CVS server, according to its version number, might allow an attacker to execute arbitrary commands on the remote system because of a heap overflow in the cvs pserver code.

The remote CVS server, according to its version number, might allow an attacker to checkout RCS archive files that are outside of the cvs root.

The remote rsync server may be vulnerable to a path traversal issue.
 An attacker may use this flaw to create arbitrary files hosted outside of a module directory.

Helix Universal Server versions prior to 9.0.3 are vulnerable to a trivial remote Denial of Service (DoS) attack. By sending a malformed HTTP GET request, an unauthenticated attacker can crash the service.

The remote systems appears to have PhatBOT installed.  This program allows the machine to be controlled via a P2P network.  PhatBOT is extremely sophisticated and allows the remote attacker to use the victim machine to perform various actions. 

This event signifies that a BGP speaking system is trying to maintain connectivity with other BGP systems.  The traffic is benign in nature, however it does reveal who is currently speaking BGP on your network.

The remote server is running the Windows Media Service Server.  This server is used to stream media to remote clients.

The remote host is advertising the BGP routing protocol.

The remote host is vulnerable to a series of remote vulnerabilities to the ISS IDS engine.  In addition, network traffic seems to indicate that the machine was compromised by a worm (Witty) which spreads via these ISS vulnerabilities.

The remote CVS server, according to its version number, might allow an attacker to execute arbitrary commands on the remote system as cvs does not drop root privileges properly.

The remote CVS server, according to its version number, may allow an attacker to create directories and possibly files at the root of the filesystem holding the CVS repository.

The remote client is using CVS to synchronize files.

The remote host is running the open source Zebra routing daemon.  This daemon is capable of routing RIP, OSPF, and BGP traffic.

The remote server is an LDAP server.  Further, it appears as if the server allows NULL BIND requests.  If this is an internal server, then this is considered an acceptable configuration.

The remote host has created a PPTP VPN connection.  You should ensure that this sort of connection is authorized within existing company guidelines or policies.

The remote host is running Kerberos 5 over TCP.

The remote host is running Kerberos 4.  It has been demonstrated that the Kerberos 4 protocol has inherent design flaws that make it insecure to use.

The remote host is running an implementation of Kerberos 5 over UDP.

The remote host is running with Routing Information Protocol (RIP) version 2 enabled.  It is probably a router.

The remote host is running with Routing Information Protocol (RIP) version 1 enabled, an inherently insecure protocol.  It is probably a router.

The remote host is running Terminal Services or Remote Desktop Protocol (RDP).  This protocol is used to manage remote desktops and servers and is installed by default on Windows systems.  NNM has observed an RDP client attempting to connect to this host.

The remote server is running a Network Time Protocol (NTP) protocol version 2 server service (Stratum 1) which is used to synchronize time amongst multiple machines.

The remote server is running a Network Time Protocol (NTP) protocol version 1 server service (Stratum 1) which is used to synchronize time amongst multiple machines.

The remote server is running a Network Time Protocol (NTP) protocol version 2 server service (Stratum 2) which is used to synchronize time amongst multiple machines.

The remote server is running a Network Time Protocol (NTP) protocol version 3 server service (Stratum 1) which is used to synchronize time amongst multiple machines.

The remote server is running a Network Time Protocol (NTP) protocol version 1 server service (Stratum 2) which is used to synchronize time amongst multiple machines.

The remote host is a RADIUS server.  In addition, a login into this host just failed.

The remote server is running a NTP (protocol version 3) server service (Stratum 2) which is used to synchronize time amongst multiple machines.

ID	Name	Severity
1903	Telnet Server Detection	info
1902	Time Server Detection	info
1901	UUCP Server Detection	info
1899	CVS < 1.11.5 pserver Directory Request Double Free() Privilege Escalation	high
1898	CVS Server Detection	info
1897	rsync < 2.5.2 Signedness Error Array Overflow	critical
1896	rsync Detection	info
1895	McAfee ePolicy Orchestrator Remote Format String	critical
1891	apcupsd Overflow	critical
1890	apcupsd Detection	info
1889	tanned < 0.7.2 Remote Format String	critical
1888	NNTP Server Type and Version	info
1887	LeafNode < 1.9.30 Resource Exhaustion DoS	medium
1882	VNC Detection (deprecated)	info
1228	Checkpoint Firewall-1 Version Detection	info
1227	Subversion (SVN) apr_time_t Data Conversion Remote Overflow (deprecated)	high
1226	Subversion (SVN) Software Detection (deprecated)	info
1225	Winamp Malformed File Name Handling DoS	low
1224	H.323 Application Detection	info
1223	Winamp b4s File Handling Multiple Malformed Fields Overflow	high
1222	Winamp Fasttracker 2 Plug-in in_mod.dll Heap Overflow	high
1220	CVS < 1.11.16 / 1.12.8 pserver Line Entry Handling Remote Overflow	critical
1219	CVS < 1.11.15 / 1.12.7 Client Traversal Arbitrary File Retrieval	medium
1216	rsync < 2.6.1 Traversal Arbitrary File Creation	medium
1214	RealNetworks Helix Universal Server < 9.0.3 HTTP GET Request DoS	high
1202	Trojan/Backdoor - PhatBOT Detection	critical
1200	BGP Keep Alive Message Detection (Client Initiation)	info
1199	BGP Keep Alive Message Detection (Server Response)	info
1198	Windows Media Service Server Detection	info
1196	BGP Routing Protocol Open Message Detection	info
1182	Witty Worm Detection	critical
1181	CVS pserver CVSROOT Passwd File Arbitrary Code Execution	high
1180	CVS < 1.11.10 / 1.12.3 pserver Crafted Module Request Arbitrary File / Directory Creation	medium
1179	CVS Software Detection	info
1177	Zebra Routing Software Detection	info
1172	LDAP Server NULL Bind Detection	medium
1170	PPTP Set-Link-Info - Setup of PPTP VPN Channel Detection	info
1164	Kerberos Version 5 Server Detection - TCP	info
1163	MIT Kerberos 4 Multiple Vulnerabilities	high
1162	Kerberos Version 5 Server Detection - UDP	info
1155	RIP Router Version 2 Detection	info
1154	RIP Router Version 1 Detection	medium
1153	Windows RDP / Terminal Services Detection (deprecated)	info
1151	NTP Server Protocol Version 2 Detection	info
1150	NTP Server Protocol Version 1 Detection	info
1149	NTP Server Protocol Version 2 Detection	info
1148	NTP Server Protocol Version 3 Detection	info
1146	NTP Server Protocol Version 1 Detection	info
1145	RADIUS Server Failed Login Detection	medium
1144	NTP Server Protocol Version 3 Detection	info

Detections

Analytics

Generic Family for Nessus Network Monitor

info

info

info

high

info

critical

info

critical

critical

info

critical

info

medium

info

info

high

info

low

info

high

high

critical

medium

medium

high

critical

info

info

info

info

critical

high

medium

info

info

medium

info

info

high

info

info

medium

info

info

info

info

info

info

medium

info