The remote NNTP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote ACAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel.

The remote host contains an SSL certificate with a common name containing a Null character (\x00) in it.  This may indicate a compromise or that a program such as SSLsniff is spoofing the certificate in order to intercept the traffic via a Man-in-The-Middle (MiTM) attack. 

Certificates with such characters may exploit a bug contained in many different web browser and other SSL-related products, in how they validate the common name of such a certificate.

Security patches may have been 'backported' to the remote HTTP server without changing its version number.

Banner-based checks have been disabled to avoid false positives.

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote SSH server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

Security patches may have been 'backported' to the remote FTP server without changing its version number. 

Banner-based checks have been disabled to avoid false positives. 

Note that this test is informational only and does not denote any security problem.

The remote NNTP server seems to be open to outsiders.  Some people like open NNTP servers as they allow one to read Usenet news articles anonymously.  Unwanted connections could waste your bandwidth. 

Note that it is very common for NNTP servers to use IP-based authentication so this may be a false positive if the Nessus scanner is among the allowed source addresses.

Nessus was able to identify the remote operating system by examining the HTML returned from certain HTTP requests.

Nessus was able to identify the remote operating system based on the response from the remote host's FTP banner.

Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's hardware, such as its product name and serial number.

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service.

Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm.

Note that certificates in the chain that are contained in the Nessus CA database (known_CA.inc) have been ignored.

Using SMBIOS and UEFI, it was possible to get BIOS info.

According to its self-reported version number, the Unix operating system running on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Nessus was able to enumerate MAC addresses by connecting to the remote host via SSH with the supplied credentials.

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.

Nessus was able to identify the remote operating system based on the telnet banner.

This plugin lists the packages installed on the remote Solaris host by calling pkginfo.

This script attempts to identify the remote operating system type and version by fingerprinting its Remote Desktop Services (RDP) / Terminal Services service.

The remote host supports the use of SSL ciphers that offer weak encryption.

Note: This is considerably easier to exploit if the attacker is on the same physical network.

This plugin attempts to identify the operating system type and version by looking at certain files on the remote operating system (e.g., '/etc/redhat-release' on Red Hat).

This plugin attempts to identify the operating system type and version by looking at the SSH banner returned by the remote server.

This plugin attempts to identify the Operating System type and version by connecting to the remote SMB server.

This script attempts to identify the Operating System type and version by looking at the data returned by 'uname -a'.

This script attempts to identify the operating system type and version by using the same technique as SinFP.

This plugin attempts to identify the operating system type and version by connecting to the remote Microsoft Remote Procedure Call (MSRPC) server.

Nessus was able to identify the remote operating system type and version by examining the data returned by the remote HTTP server.

Nessus was able to identify the operating system type and version by examining the SNMP data returned by the remote server.

This script attempts to identify the Operating System type and version by looking at the data returned by the mDNS server.

This plugin attempts to identify the operating system type and version by looking at the NTP data returned by the remote server.

The remote host implements TCP timestamps, as defined by RFC1323.  A side effect of this feature is that the uptime of the remote host can sometimes be computed.

Nessus was able to enumerate the network interfaces configured with IPv4 addresses by connecting to the remote host via SSH using the supplied credentials.

Nessus was able to enumerate the network interfaces configured with IPv6 addresses by connecting to the remote host via SSH using the supplied credentials.

The remote host responds to the LLTD (Link Layer Topology Discovery) protocol.

This protocol can be used to enumerate the IPv4 and IPv6 addresses of a remote host, its name, the characteristics of the physical layer it is connected to, as well as the topology of the network, etc...

This plugin attempts to extract the IP addresses of the remote host as well as the physical layer it is connected to the network with.

Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).

This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.

The remote host answered to an ICMP 'Domain Name Request' as defined in RFC 1788.

Such a request is designed to obtain the DNS name of a host based on its IP.

According to the MAC address of its network adapter, the remote host is a VMware virtual machine.

The remote version of the Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.

This flaw exists because the RDP server stores a publicly known hard-coded RSA private key. Any attacker in a privileged network location can use the key for this attack.

The remote server seems open to remote users.  Some people prefer open public NNTP servers to be able to read or post articles anonymously.  Unwanted connections could waste your bandwidth or put you into legal trouble if a malicious person were to use your server to post abusive articles. 

Keep in mind that robots are harvesting such open servers on Internet, so you cannot hope that you will stay hidden for long. 

** As it is very common to have IP based authentication, this might be 
** a false positive if the Nessus scanner is among the allowed source 
** addresses.

This plugin checks expiry dates of certificates associated with SSL- enabled services on the target and reports whether any have already expired.

This plugin detects the protocols understood by the remote IP stack.

By using the identd server (RFC 1413), it is possible to determine the process owner of the remote service.

This plugin registers services that were identified by external scanners (amap, nmap, etc...). 

It does not perform any fingerprinting by itself.

It is possible to obtain the traceroute to the remote host by sending packets with the 'Record Route' option set.  It is a complement to traceroute.

Nessus was able to resolve the fully qualified domain name (FQDN) of the remote host.

This plugin attempts to identify the Operating System type and version by sending more or less incorrect ICMP requests using the techniques outlined in Ofir Arkin's paper 'ICMP Usage In Scanning'. An attacker may use this to identify the kind of the remote operating system and gain further knowledge about this host.

Using a combination of remote probes (e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.

The remote host has predictable TCP sequence numbers.

An attacker may use this flaw to establish spoofed TCP connections to this host.

The remote host seems to generate Initial Sequence Numbers (ISN) in a weak manner which seems to solely depend on the source and dest port of the TCP packets.

An attacker may exploit this flaw to establish spoofed connections to the remote host.

The Raptor Firewall and Novell NetWare are known to be vulnerable to this flaw, although other network devices may be vulnerable as well.

By probing the remote NNTP server, Nessus is able to collect information about it, such as whether it allows remote connections, the number of newsgroups, etc.

ID	Name	Severity
42086	NNTP Service STARTTLS Command Support	info
42084	ACAP Service STARTTLS Command Support	info
42053	SSL Certificate Null Character Spoofing Weakness	high
39521	Backported Security Patch Detection (WWW)	info
39520	Backported Security Patch Detection (SSH)	info
39519	Backported Security Patch Detection (FTP)	info
39329	News Server (NNTP) Anonymous Read Access	low
35779	OS Identification : HTML	info
35658	OS Identification : FTP	info
35351	System Information Enumeration (via DMI)	info
35291	SSL Certificate Signed Using Weak Hashing Algorithm	high
34098	BIOS Info (SSH)	info
33850	Unix Operating System Unsupported Version Detection	critical
33276	Enumerate MAC Addresses via SSH	info
10863	SSL Certificate Information	info
29831	OS Identification : Telnet	info
29217	Solaris Installed Package Enumeration (credentialed check)	info
27507	OS Identification : RDP	info
26928	SSL Weak Cipher Suites Supported	medium
25335	OS Identification : Linux Distribution	info
25287	OS Identification : SSH	info
25252	OS Identification : SMB	info
25251	OS Identification : Unix uname	info
25250	OS Identification : SinFP	info
25248	OS Identification : MSRPC	info
25247	OS Identification : HTTP	info
25246	OS Identification : SNMP	info
25245	OS Identification : mDNS	info
25244	OS Identification : NTP	info
25220	TCP/IP Timestamps Supported	info
25203	Enumerate IPv4 Interfaces via SSH	info
25202	Enumerate IPv6 Interfaces via SSH	info
24904	Link Layer Topology Discovery (LLTD) Detection	info
22869	Software Enumeration (SSH)	info
21643	SSL Cipher Suites Supported	info
20887	ICMP Domain Name Request	info
20094	VMware Virtual Machine Detection	info
18405	Remote Desktop Protocol Server Man-in-the-Middle Weakness	medium
17204	News Server (NNTP) Anonymous Read / Write Access	medium
15901	SSL Certificate Expiry	medium
14788	IP Protocols Scan	info
14674	identd Service UID Association	info
14664	External Scanner Service Identification	info
12264	Record Route	info
12053	Host Fully Qualified Domain Name (FQDN) Resolution	info
25249	OS Identification : ICMP	info
11936	OS Identification	info
10443	TCP/IP Predictable ISN (Initial Sequence Number) Generation Weakness	high
11057	TCP/IP Initial Sequence Number (ISN) Reuse Weakness	high
11033	News Server (NNTP) Information Disclosure	info

Detections

Analytics

General Family for Nessus

info

info

high

info

info

info

low

info

info

info

high

info

critical

info

info

info

info

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

medium

medium

info

info

info

info

info

info

info

high

high

info