TrueWeather is a program which runs on a client workstation.  The program routinely polls a parent server and downloads information such as weather reports and news. The program may, under certain circumstances, take up bandwidth while downloading.  A network with too many instances of TrueWeather may notice a degradation in network performance during update periods.

The remote host is running an instance of Symantec Antivirus.  The host is also configured to automatically update virus signatures via LiveUpdate. Depending on the version, this may allow a local user to gain elevated privileges.

The remote host responds to SNMP v3 queries.  It is likely that the host is configured for remote administration.

The remote host seems to be enabled to do Internet Key Exchange (IKE).  This is typically indicative of a VPN server.  VPN servers are used to connect remote hosts into internal resources.  You should ensure that: the VPN is authorized for your company's computing environment, the VPN utilizes strong encryption and that the VPN utilizes strong authentication.

The remote host is an Ingenico Point of Sales device

The remote host is a security camera.  The camera streams images to a central server.  As this traffic is passed unencrypted, it is possible for a passive listener to "eavesdrop" on the stream and reconstruct the images.  It is usually recommended to run this sort of streaming service on a private VLAN.

The remote server is running Windows Media Services, an application for streaming video and audio files to remote hosts. 

The remote host is an NFS server hosting the indicated file.

The remote host is an NFS server, with remotely accessible directories.

The remote server is a TACACS authentication server.

The remote host is configured to use TACACS authentication.  Further, the client is configured to send authentication in plaintext. 

The remote host is running Cisco IronPort, an appliance for email and web security. Be sure that the installed version has the latest patches installed. 

The remote host is running Winamp, a media player for Windows.  The version of Winamp installed on the remote host is earlier than 5.552.  Such versions reportedly contain a flaw in the way that it handles malformed '.maki' files.  A malfored file will cause a buffer overflow within the 'gen_ff.dll' library.  Successful exploitation will result in the attacker executing arbitrary code.  An attacker, exploiting this flaw, would need to be able to entice a user into opening a malformed '.maki' file.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

The remote host is running WinRemotePC, a software application that allows for remote desktop administration of the machine.

The remote server is managed by a Java JConsole.  Further, the server is configured to accept plaintext credentials.  This can be dangerous if an attacker can gain access to network traffic.  

The remote host is running an RMI registry, which acts as a bootstrap naming service for registering and retrieving remote objects with simple names in the Java Remote Method Invocation (RMI) system. This server is managed and monitored by a Sun Jconsole system.

The remote host is running the Sun Jconsole application.  This application is used to manage Sun servers across the network.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.4.  Mac OS X 10.5.4 contains security fixes for a number of programs.

The remote host is running the EMC AlphaStor Library Manager service. AlphaStor is a tape backup management and library sharing for EMC NetWorker.

The version of OpenOffice installed on the remote host reportedly contains an integer overflow vulnerability in 'rtl_allocateMemory()', a custom memory allocation function used by the application.  If an attacker can trick a user on the affected system, he can leverage this issue to execute arbitrary code subject to his privileges.

The remote server is running a Novell Groupwise Messenger server.

The remote server is running the Computer Associates eTrust SCM, a filtering proxy server.

The remote host is running the DLINK Audio/Video camera with embedded web and file transfer services (HTTP and FTP).  

The remote host is running the iGuard embedded web server.  This software is commonly found on hardware security devices which are used to control facility access.  The embedded web server typically allows for remote administration of the device and includes a built-in web server, database server, and more.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

The remote service supports the Multi Directory Access Protocol (MDAP), which is used to multicast commands to certain types of network devices, such as Thompson ADSL modems. 

The version of the Altiris Deployment Solution installed on the remote host reportedly is affected by several issues :

  - A SQL injection vulnerability that could allow a user to run arbitrary code
  - A remote attacker may be able to obtain encrypted Altiris Deployment Solution domain credentials without authentication.
  - A local user could access a privileged command prompt via the Agent's user interface.
  - A local user could leverage a GUI tooltip to access a privileged command prompt.
  - A local user can modify or delete several registry keys used by the application, resulting in unauthorized access to system information or disruption of service.
  - A local user with access to the install directory of Deployment Solution could replace application components, which might then run with administrative privileges on an affected system.

The remote host is running the Microsoft Defender software.  Defender is used to protect the local system from malware.

The remote host is running a version of Microsoft Publisher which is subject to a flaw which may allow arbitrary code to be run.  An attacker may use this to execute arbitrary code on this host.  To succeed, the attacker would have to send a rogue file to  a user of the remote computer and have it open it. Then a bug in the font parsing handler would result in code execution.

The remote server is a Nokia Intellisync Server.  These portals are designed for access by users of portable devices (PDA, cell phone).  One of the server components is a syncing port (TCP/3102) that maintains state and synchronization with the remote clients.

The remote host is running Windows Media Player.

The remote client is streaming video or audio from the Yahoo Launch servers. Yahoo Launch is a service that allows Yahoo users to download and view videos and songs from a variety of artists.  This can potentially impact performance of bandwidth and user productivity.

The remote host is running HylaFAX, a fax transmission software. It is reported that HylaFAX is prone to an access control bypass vulnerability. An attacker exploiting this flaw may be able to gain unauthorized access to the service. 

The remote host is running a CVS server that, according to its version number, is vulnerable to an information disclosure issue. This weakness can be exploited by malicious users to gain knowledge about files and directories existing on the server.

The remote client is running a version of the Nullsoft Winamp media player that may be vulnerable to a remote code execution issue. This vulnerability may be used to remotely execute arbitrary code on the host by crafting a malicious .WSZ file (Winamp Skin). 

The remote host is running Subversion, an open-source file management product.  According to the version number, the remote system is vulnerable to at least one remote buffer overflow. 

NNM computes the bytes exchanged between each TCP endpoint when the session ends. The total bytes exchanged during the lifetime of this session is more than 100 MB but less than or equal to 1 GB.

NNM computes the bytes exchanged between each TCP endpoint when the session ends. The total bytes exchanged during the lifetime of this session is more than 10 MB but less than or equal to 100 MB.

NNM computes the bytes exchanged between each TCP endpoint when the session ends. The total bytes exchanged during the lifetime of this session is between 1 and 10 MB.

NNM detected one or more inbound encrypted sessions. An encrypted session is a TCP or UDP session that contains sufficiently random payloads. Inbound identifies that the session occurred from an external host to a host in the monitored network range.

NNM detected one or more outbound encrypted sessions. An encrypted session is a TCP or UDP session that contains sufficiently random payloads. Outbound identifies that the session occurred from a host in the monitored network range to an external host.

NNM detected one or more internal encrypted sessions. An encrypted session is a TCP or UDP session that contains sufficiently random payloads. Internal identifies that the session occurred between hosts in the monitored network range.

NNM detected one or more inbound interactive sessions. An interactive session uses timing and statistical profiling of the packets in a session to determine if the session involves a human typing at a command line prompt. Inbound identifies that the session occurred from an external host to a host in the monitored network range.

NNM detected one or more outbound interactive sessions. An interactive session uses timing and statistical profiling of the packets in a session to determine if the session involves a human typing at a command line prompt. Outbound identifies that the session occurred from a host in the monitored network range to an external host.

NNM detected one or more internal interactive sessions. An interactive session uses timing and statistical profiling of the packets in a session to determine if the session involves a human typing at a command line prompt. Internal identifies that the session occurred between hosts in the monitored network range.

NNM identifies internal servers that a host has connected to on a particular port. These connections are considered "trusted" as they have occurred between hosts within the monitored network range. This is the opposite of plugin 15 which reports on server trusted connections.

NNM has observed this host tunneling traffic for other network devices.

This plugin determines the IPv6 tunnel traffic from the remote machine.

ID	Name	Severity
1142	TrueWeather Application Detection	info
1137	Symantec Antivirus LiveUpdate Local Privilege Escalation	high
1120	SNMP Version 3 Detection	low
1106	Internet Key Exchange (IKE) Server Detection	medium
5231	Ingenico Point of Sales (POS) Device Detection	info
5228	Avigilon Security Camera Detection	info
5213	Windows NETBIOS Workstation Name Detection	info
5154	Windows Media Services Version Detection	info
5071	NFS File Detection	info
5070	NFS Directory Detection	info
5052	TACACS Server Detection	info
5051	TACACS Client Detection	info
5050	Cisco IronPort Detection	info
5031	Winamp < 5.552 Buffer Overflow	medium
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	critical
4596	WinRemotePC Server Detection	info
4586	Java Remote Management Platform Plaintext Password Detection	medium
4583	RMI Registry Detection	info
4581	Sun Jconsole Detection	info
4564	Mac OS X < 10.5.4 Multiple Vulnerabilities	critical
4563	EMC AlphaStor Library Manager Detection	info
4538	OpenOffice < 2.4.1 rtl_allocateMemory Integer Overflow	medium
4535	Novell Groupwise Messenger server	info
4534	CA eTrust SCM Detection	info
4526	DLINK Audio/Video Camera Detection	info
4524	iGuard Security Device Version Detection	info
4523	Mac OS X < 10.5.3	critical
4516	MDAP Service Detection	info
4504	Altiris Deployment Solution < 6.9.176 Multiple Vulnerabilities	high
4503	Windows Defender Client Detection	info
4502	Microsoft Publisher Remote Code Execution Vulnerability (951208)	medium
3511	Nokia Intellisync Web Portal Detection (deprecated)	info
2526	Windows Media Player Version Information (deprecated)	info
2525	launch.yahoo.com Streaming Client Detection (deprecated)	info
2517	HylaFAX < 4.2.1 Remote Access Control Bypass	high
2155	CVS history.c File Existence Disclosure	medium
2151	Winamp < 5.05 .WSZ File Handling RCE	medium
2117	Subversion (SVN) < 1.0.3 Remote Buffer Overflow (deprecated)	high
99	TCP Session Bandwidth (100 - 1024 MB)	info
98	TCP Session Bandwidth (10 - 100 MB)	info
97	TCP Session Bandwidth (1 - 10 MB)	info
9	Inbound encrypted sessions	info
8	Outbound encrypted sessions	info
7	Internal encrypted sessions	info
6	Inbound interactive sessions	info
5	Outbound interactive sessions	info
4	Internal interactive sessions	info
3	Internal client trusted connection	info
292	ERSPAN Type 2 Packet Encapsulation	info
20	Generic IPv6 Tunnel Traffic Detection	info

Detections

Analytics

Generic Family for Nessus Network Monitor

info

high

low

medium

info

info

info

info

info

info

info

info

info

medium

critical

info

medium

info

info

critical

info

medium

info

info

info

info

critical

info

high

info

medium

info

info

info

high

medium

medium

high

info

info

info

info

info

info

info

info

info

info

info

info