Using the supplied credentials, this script performs a compliance check against the given policy.

This plugin has been deprecated and any audits for this plugin have been migrated to 21157 Unix Compliance Checks.

Note that per PCI Security Standards Council (PCI SSC) standards, if the version of the remote software is known to contain flaws, a vulnerability scanner must report it as vulnerable. The scanner must still flag it as vulnerable, even in cases where a workaround or mitigating configuration option is in place. This will result in the scanner issuing false positives by PCI SSC design.

It is recommended that any workarounds and mitigating configurations that are in place be documented including technical details, to be presented to a third-party PCI auditor during an audit.

This script reports additional SCAP content information.

This script reports SCAP content results including attached ARF, OVAL, and XCCDF results.

Using the supplied credentials, this script performs a compliance check against the policy specified by SCAP content.

The remote host is running a database server that is reachable from the Internet.  This violates PCI DSS, section 1.3.7.

Due to increased risk to the cardholder data environment when remote  access software is present, 1) justify the business need for this software to the ASV and confirm it is implemented securely, or 2) confirm it is disabled/ removed. Consult your ASV if you have questions about this Special Note.

Applications that fail to adequately encrypt network traffic using strong cryptography are at increased risk of being compromised and exposing cardholder data. An attacker who is able to exploit weak cryptographic processes can gain control of an application or even gain cleartext access to encrypted data.

The scan settings did not fulfill the PCI DSS scan validation requirements. Even if the technical tests passed, this report may be insufficient to certify this server. If you are scanning for PCI / ASV attestation, please contact the Tenable ASV team as soon as possible, as this finding can invalidate your scan.

Using the available information, Nessus did not find any disqualifying flaws for this host. 

Note that this result is NOT a PCI certification. To obtain a certification, you need to run the scan through Nessus Cloud and click on 'Submit for PCI Validation' to send the results to Tenable for review.

The remote host is vulnerable to one or more conditions that are considered to be 'automatic failures' according to the PCI DSS Approved Scanning Vendors Program Guide (version 4.0). These failures include one or more of the following :

  - Vulnerabilities with a CVSS base score greater than or     equal to 4.0

  - Unsupported operating systems

  - Internet reachable database servers (must validate     whether cardholder data is stored)

  - Presence of built-in or default accounts

  - Unrestricted DNS Zone transfers

  - Unvalidated parameters leading to SQL injection attacks

  - Cross-Site Scripting (XSS) flaws

  - Directory traversal vulnerabilities

  - HTTP response splitting/header injection

  - Detection of backdoor applications (malware, trojan     horses, rootkits, backdoors)

  - Use of older, insecure SSL/TLS versions (TLS v1.2 is the     minimum standard)

  - Use of anonymous key exchange protocols (such as anonymous     Diffie-Hellman in SSL/TLS)

  - Scan Interference

Details of the failed items may be found in the 'Output' section of this plugin result. These vulnerabilities and/or failure conditions will have to be corrected before you are able to submit your scan results for validation by Tenable to meet your quarterly external scanning requirements.

If you are conducting this scan via Tenable.io and either disagree with any of the results, believe there are false-positives, or must rely on compensating controls to mitigate the vulnerability then you may proceed with submitting this report to our PCI-ASV Workbench by clicking on 'Submit for PCI'. You may login to the Tenable PCI-ASV Workbench in Tenable.io and dispute or provide mitigation evidence for each of the residual findings.

Using the supplied credentials, this script perform a Windows file contents compliance check against the given policy.

ID	Name	Severity
70469	FireEye Compliance Checks	info
69512	Citrix XenServer Compliance Checks (deprecated)	info
70271	HP ProCurve Compliance Checks	info
64455	VMware vCenter/vSphere Compliance Checks	info
64095	Palo Alto Networks PAN-OS Compliance Checks	info
62680	Juniper Junos Compliance Checks	info
62679	Check Point GAiA Compliance Checks	info
60020	PCI DSS Compliance : Handling False Positives	info
66759	SCAP Information	info
66758	SCAP XML Results	info
66757	SCAP Linux Compliance Checks	info
66756	SCAP Windows Compliance Checks	info
57860	IBM iSeries Compliance Checks	info
57581	PCI DSS Compliance : Database Reachable from the Internet	high
56209	PCI DSS Compliance : Remote Access Software Has Been Detected	high
56208	PCI DSS Compliance : Insecure Communication Has Been Detected	medium
46689	Cisco IOS Compliance Checks	info
33814	Database Compliance Checks	info
33931	PCI DSS Compliance : Tests Requirements	medium
33930	PCI DSS Compliance : Passed	info
33929	PCI DSS compliance	high
21156	Windows Compliance Checks	info
24760	Windows File Contents Compliance Checks	info
21157	Unix Compliance Checks	info

Detections

Analytics

Policy Compliance Family for Nessus

info

info

info

info

info

info

info

info

info

info

info

info

info

high

high

medium

info

info

medium

info

high

info

info

info