Nessus was able to identify the remote operating system based on the banner reported by the mail server running on it.

Security patches may have been 'backported' to the remote SMTP server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

The remote SSH daemon has a small key size, which is insecure.  Given current technology, it should be 1024 bits at a minimum.

The remote host appears to be run a version of the Linux kernel that sends UDP responses in which the IP identification field is constant and equal to zero (0).

With this information, an attacker could mount further, more targeted attacks against this host.

Note that RedHat does not consider this a security issue as there are many ways to identify or fingerprint a Linux host.

The X.509 certificate chain for this service is not signed by a recognized certificate authority.  If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. 

Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.

This plugin examines the chain of X.509 certificates used by this service.

The remote NNTP server contains a logic error that causes clients that send only a username, neglecting to send a password, to be treated as authenticated.  This may permit an unauthenticated, remote attacker to view and post to restricted newsgroups, impersonating other users in the process.

The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy (PFS) encryption.  These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised.

This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications.

Dropbox is installed on the remote host.  Dropbox is an application for storing and synchronizing files between computers, possibly outside the organization.

At least one of the X.509 certificates sent by the remote host is not required to form a path from the server's own certificate to the CA. This may indicate that the certificate bundle installed with the server's certificate is for certificates lower in the certificate hierarchy. 

Some SSL implementations, often those found in embedded devices, cannot handle certificate chains with unused certificates.

At least one of the X.509 certificates sent by the remote host is not in order.  Some certificate authorities publish certificate bundles that are in descending instead of ascending order, which is incorrect according to RFC 4346, Section 7.4.2. 

Some SSL implementations, often those found in embedded devices, cannot handle unordered certificate chains.

Using the supplied credentials, Nessus was able to determine when the host was last started.

An X.509 certificate sent by the remote host contains one or more violations of the restrictions imposed on it by RFC 5280.  This means that either a root or intermediate Certificate Authority signed a certificate incorrectly.

Certificates that fail to adhere to the restrictions in their extensions may be rejected by certain software.  The existence of such certificates indicates either an oversight in the signing process, or malicious intent.

The Linux kernel is prone to a security weakness related to TCP sequence number generation. Attackers can exploit this issue to inject arbitrary packets into TCP sessions using a brute-force attack.

An attacker may use this vulnerability to create a denial of service condition or a man-in-the-middle attack.

Note that this plugin may fire as a result of a network device (such as a load balancer, VPN, IPS, transparent proxy, etc.) that is vulnerable and that re-writes TCP sequence numbers, rather than the host itself being vulnerable.

The X.509 certificate of the remote host was signed by a certificate belonging to a Certificate Authority (CA) called DigiNotar, which was revoked due to a known compromise.  You should verify that the remote certificate indeed was obtained legally, and you should get a new CA to sign it, as most web browsers are being updated to stop trusting this authority.

This plugin reports a device's hostname collected via SSH or WMI.

Based on the remote operating system, it is possible to determine what the remote system type is (eg: a printer, router, general-purpose computer, etc).

The remote operating system can be identified through information collected via HNAP (Home Network Administration Protocol).

The remote SSL/TLS server accepts a weak Diffie-Hellman (DH) public key value.

This flaw may aid an attacker in conducting a man-in-the-middle (MiTM) attack against the remote server since it could enable a forced calculation of a fully predictable Diffie-Hellman secret.

By itself, this flaw is not sufficient to set up a MiTM attack (hence a risk factor of 'None'), as it would require some SSL implementation flaws to affect one of the clients connecting to the remote host.

This script attempts to identify the operating system type and version by looking at the capabilities of the remote Apple Filing Protocol Server.

The remote service uses an SSL certificate that is either fraudulent, no longer secure due to leaked or compromised private keys, or was issued from a certificate authority that is considered to be untrustworthy.

Memcached is a memory-based object store. As it is designed for performance, this program does not contain any security mechanism (ie: authentication), meaning that anyone can connect to this server and perform queries against it.

Plugin deprecated by compiled .nbin version os_fingerprint_upnp.nbin

The version of OpenSSL on the remote host has been shown to allow the use of disabled ciphers when resuming a session.  This means that an attacker that sees (e.g.  by sniffing) the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent resumptions of that session to use a disabled cipher chosen by the attacker.

The version of OpenSSL on the remote host has been shown to allow resuming session with a weaker cipher than was used when the session was initiated.  This means that an attacker that sees (i.e., by sniffing) the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent resumptions of that session to use a weaker cipher chosen by the attacker.

Note that other SSL implementations may also be affected by this vulnerability.

This script detects whether a host allows resuming SSL sessions by performing a full SSL handshake to receive a session ID, and then reconnecting with the previously used session ID.  If the server accepts the session ID in the second connection, the server maintains a cache of sessions that can be resumed.

The remote operating system can be identified by querying its hrSWInstalledName object using SNMP.

The X.509 certificate of the remote host is known to be shipping by default with the remote service / device.  The private key for this cert has been published, therefore the SSL communications done with the remote host can not be considered as being secret as anyone with the ability to snoop the traffic between the remote host and the clients could decipher the traffic.

The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :

  - First, the top of the certificate chain sent by the     server might not be descended from a known public     certificate authority. This can occur either when the     top of the chain is an unrecognized, self-signed     certificate, or when intermediate certificates are     missing that would connect the top of the certificate     chain to a known public certificate authority.

  - Second, the certificate chain may contain a certificate     that is not valid at the time of the scan. This can     occur either when the scan occurs before one of the     certificate's 'notBefore' dates, or after one of the     certificate's 'notAfter' dates.

  - Third, the certificate chain may contain a signature     that either didn't match the certificate's information     or could not be verified. Bad signatures can be fixed by     getting the certificate with the bad signature to be     re-signed by its issuer. Signatures that could not be     verified are the result of the certificate's issuer     using a signing algorithm that Nessus either does not     support or does not recognize.

If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.

This plugin attempts to identify the operating system by examining a hard-coded SSL certificate issued by the device manufacturer.

The remote operating system can be identified through the banner reported by a SIP service running on it.

Using a combination of remote probes (TCP/IP, SMB, HTTP, NTP, SNMP, etc), it was possible to gather one or more fingerprints from the remote system. Unfortunately, though, Nessus does not currently know how to use them to identify the overall system.

According to the DMI information, the remote host is a VirtualBox virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

According to the DMI information, the remote host is a VirtualPC virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

According to the DMI information, the remote host is a VMware virtual machine. 

Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.

Hostnames different from the current hostname have been collected by miscellaneous plugins. Nessus has generated a list of hostnames that point to the remote host. Note that these are only the alternate hostnames for vhosts discovered on a web server.

Different web servers may be hosted on name-based virtual hosts.

By using information obtained from a Nessus scan, this plugin reports CPE (Common Platform Enumeration) matches for various hardware and software products found on a host. 

Note that if an official CPE is not available for the product, this plugin computes the best possible CPE based on the information available from the scan.

Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's memory devices, such as the total amount of installed memory.

Nessus was able to retrieve information about the remote system's hardware, such as its processor type, by using the SMBIOS (aka DMI) interface.

The 'commonName' (CN) attribute of the SSL certificate presented for this service is for a different machine.

The service running on the remote host presents an SSL certificate for which the 'commonName' (CN) attribute does not match the hostname on which the service listens.

Although this host was scanned through a private IPv4 or local scope IPv6 address, some network interfaces are configured with global scope IPv6 addresses.  Depending on the configuration of the firewalls and routers, this host may be reachable from Internet.

The remote host answers to an ICMPv6 Node Information Query and responds with its DNS name, the list of IPv4 addresses and the list of IPv6 addresses to which it is bound. 

An attacker can use this information to understand how the network is architected, which may help him bypass filters.

The remote operating system can be identified by querying its sysObjectID object using SNMP.

The SSL certificate associated with the remote service will expire soon.

The SSL certificate for the remote SSL-enabled service is not yet valid.

The remote service encrypts traffic using TLS / SSL but allows a client to insecurely renegotiate the connection after the initial handshake.
An unauthenticated, remote attacker may be able to leverage this issue to inject an arbitrary amount of plaintext into the beginning of the application protocol stream, which could facilitate man-in-the-middle attacks if the service assumes that the sessions before and after renegotiation are from the same 'client' and merges them at the application layer.

The remote host supports the use of SSL ciphers that offer medium strength encryption. Nessus regards medium strength as any encryption that uses key lengths at least 64 bits and less than 112 bits, or else that uses the 3DES encryption suite.

Note that it is considerably easier to circumvent medium strength encryption if the attacker is on the same physical network.

ID	Name	Severity
57915	OS Identification : SMTP	info
57913	Backported Security Patch Detection (SMTP)	info
57620	Small SSH RSA Key	high
17841	Linux Kernel UDP Implementation IP Identification Field Remote OS Disclosure	medium
57582	SSL Self-Signed Certificate	medium
57571	SSL Certificate Chain Analysis	info
57336	Cyrus IMAPd NNTP AUTHINFO USER Command Parsing Authentication Bypass	medium
57041	SSL Perfect Forward Secrecy Cipher Suites Supported	info
56984	SSL / TLS Versions Supported	info
56693	Dropbox Software Detection (uncredentialed check)	info
56692	Dropbox Software Detection (listener)	info
56472	SSL Certificate Chain Contains Unnecessary Certificates	info
56471	SSL Certificate Chain Not Sorted	info
56468	Time of Last System Startup	info
56284	SSL Certificate Fails to Adhere to Basic Constraints / Key Usage Extensions	medium
56283	Linux Kernel TCP Sequence Number Generation Security Weakness	medium
56043	SSL Certificate Signed with the Revoked DigiNotar Certificate Authority	medium
55472	Device Hostname	info
54615	Device Type	info
53471	OS Identification : HNAP	info
53360	SSL Server Accepts Weak Diffie-Hellman Keys	info
53331	OS Identification : Apple Filing Protocol	info
52963	Blacklisted SSL Certificate	high
52633	Unprotected memcached	medium
52043	OS Identification : UPnP - deprecated	info
51893	OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Ciphersuite Disabled Cipher Issue	medium
51892	OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Session Resume Ciphersuite Downgrade Issue	medium
51891	SSL Session Resume Supported	info
51859	OS Identification : SNMP hrSWInstalledName	info
51356	Well-known SSL Certificate Used in Remote Device	medium
51192	SSL Certificate Cannot Be Trusted	medium
50543	OS Identification : SSL Certificates	info
50542	OS Identification : SIP	info
50350	OS Identification Failed	info
47801	VirtualBox Virtual Machine detection (dmidecode)	info
47800	VirtualPC Virtual Machine detection (dmidecode)	info
47761	VMware Virtual Machine detection (dmidecode)	info
46180	Additional DNS Hostnames	info
45590	Common Platform Enumeration (CPE)	info
45433	Memory Information (via DMI)	info
45432	Processor Information (via DMI)	info
45411	SSL Certificate with Wrong Hostname	medium
45410	SSL Certificate 'commonName' Mismatch	info
45405	Reachable IPv6 address	info
45399	ICMP Node Information Query Information Disclosure	info
44344	OS Identification : SNMP sysObjectID	info
42981	SSL Certificate Expiry - Future Expiry	info
42980	SSL Certificate Expiry - Future Validity	info
42880	SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection	medium
42873	SSL Medium Strength Cipher Suites Supported (SWEET32)	high

Detections

Analytics

General Family for Nessus

info

info

high

medium

medium

info

medium

info

info

info

info

info

info

info

medium

medium

medium

info

info

info

info

info

high

medium

info

medium

medium

info

info

medium

medium

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

medium

high