This product is used to deploy easily and quickly latest Microsoft product updates.

The remote host is an Airport, Airport Extreme or Airport Express wireless access point.  It is possible to gather information about the remote base station (such as its connection type or connection time) by sending packets to UDP port 192. 

An attacker connected to this network may also use this protocol to force the base station to disconnect from the network if it is using PPPoE, thus causing a denial of service for the other users.

The remote host is running a Network Block Device (NBD) server, which allows one Linux host to use another as one of its block devices.

According to its banner, the remote host appears to be running a VMware server authentication daemon, which likely indicates the remote host is running VMware Server, ESX Server, or GSX Server.

The remote host is an HP Integrated Lights-Out (iLO) server. These servers are embedded systems integrated into HP ProLiant servers for the purpose of out-of-band management.

The remote host is running the VERITAS NetBackup Volume Manager service.

The remote host is running a GO-Global server, a commercial thin- client computing solution for Windows and unix.

The remote host is running a Backup Agent that uses the Network Data Management Protocol (NDMP).

The remote host is running a Cheops NG agent.  Cheops NG is an open source network management tool, and the cheops-agent provides a way for remote hosts to communicate with the tool and use it to map your network, port scan machines and identify running services.

The remote host is running the VERITAS NetBackup Java Console service. This service is used by the NetBackup Java Console GUI to manage the backup server. A user, authorized to connect to this service, can use it as a remote shell with system privileges by sending 'command_EXEC_LIST' messages.

The remote host is running the Computer Associate Message Queuing service (CAM). 

This service is available with products like Unicenter TNG, Unicenter NSM, and BrightStor SAN Manager.

The remote host is running TrendMicro OfficeScan client, an embedded HTTP server used by TrendMicro Antivirus software.

The remote host is running a YIFF sound server, an open source network sound server.

The remote host is running a VLAN Management Policy Server (VMPS), which is used for assigning switch ports to specific VLANs based on the MAC address of connecting device.

The remote host is running HSQLDB, an open source database written in Java, and its database engine is listening on TCP port 9001 for network server database connections using JDBC.

The remote service accepts connections encrypted using SSL 2.0 and/or SSL 3.0. These versions of SSL are affected by several cryptographic flaws, including:

  - An insecure padding scheme with CBC ciphers.

  - Insecure session renegotiation and resumption schemes.

An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients.

Although SSL/TLS has a secure means for choosing the highest supported version of the protocol (so that these versions will be used only if the client or server support nothing better), many web browsers implement this in an unsafe way that allows an attacker to downgrade a connection (such as in POODLE). Therefore, it is recommended that these protocols be disabled entirely.

NIST has determined that SSL 3.0 is no longer acceptable for secure communications. As of the date of enforcement found in PCI DSS v3.1, any version of SSL will not meet the PCI SSC's definition of 'strong cryptography'.

The remote host is running Skype, a peer-to-peer Voice-Over-IP application.

Due to the peer-to-peer nature of Skype, any user connecting to the Skype network may consume a large amount of bandwidth. 

Make sure the use of this program is done in accordance with your corporate security policy.

The remote host is running Py2Play, a peer-to-peer network game engine. Make sure that this service has been installed in accordance with your security policy.

The remote host is running a Tofu server.  Tofu is a network gaming engine. Make sure this service has been installed in accordance to your security policy.

The remote host is running Ventrilo, a voice over IP (VoIP) software developed by Flagship Industries.

The remote host is running the HP OpenView Network Node Management Alarm Service.  This service is part of the HP OpenView Management suite.

The remote host is running an HP OpenView UI Process Manager daemon on this port.

The remote host runs a Tetrinet game server on this port.  Make sure the use of this software is done in accordance to your security policy.

The remote host is running HP OpenView Topology Manager Daemon for IP discovery and layout. This service is part of the HP OpenView Management suite.

HP Data Protector (formerly HP OpenView Storage Data Protector), a data management solution that automates backup and recovery, is running on the remote host.

The remote host is running EMC Legato Networker backup software or one of these variants :

 - Sun StorEdge Enterprise Backup Software
 - Sun Solstice Backup Software
 - Informix Storage Manager

The BrightStor ARCServe MSSQL Agent is installed on the remote host.

UltraVNC seems to be running on the remote port. 

Upon connection, the remote service on this port always sends the same 12 pseudo-random bytes. 

It is probably UltraVNC with the old DSM encryption plugin.  This plugin tunnels the RFB protocol into a RC4-encrypted stream. 

This old protocol does not use a random IV so the RC4 pseudo random flow is reused from one session to another.  An authenticated user could leverage this issue to decrypt other users' sessions.

This script checks the remote VNC server protocol version and the available 'security types'.

The remote host is running the CA eTrust Intrusion Detection System service.

The reporting console for Dragon, a network intrusion detection system distributed by Enterasys, is running on this port.

The remote host is running FlexCast, an audio/video streaming server.

The Entropy Gathering Daemon is running on the remote host.
EGD is a user space random generator for operating systems that lack /dev/random

The remote ident/authd server returns random tokens instead of leaking real user IDs (this is a good thing).  It may be slidentd or some other fake identd.

The remote host is running Computer Associates eTrust Antivirus, Threat Manager or Anti-Spyware administration server.

The File Alteration Monitor daemon (famd) is running on this port. This service does not need to be reachable from the outside, it is therefore recommended that reconfigure it to disable network access.

The remote host appears to be running Kerio Winroute Firewall Admin service. It is recommended to block incoming traffic to this port.

Also, make sure the use of this software matches your corporate security policy.

The remote host appears to be running the Kerio Admin MailServer Admin Service on this port.

The remote host appears to be running the Kerio Personal Firewall Admin service on this port. It is recommended that this port is not reachable from the outside.

Also, make sure that the use of this software is done in accordance with your corporate security policy.

The remote host is running the BrightStor ARCServe UniversalAgent on this port.

The remote host seems to be running Hydrogen, a backdoor used by penetration testers to gather screen shots, download files or gain control of the remote host.

Make sure that the use of this software on the remote host is done in accordance with your security policy.

It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.

The remote host appears to run ISS deployment manager. Connections are allowed to the web interface to remote install various SiteProtector components.

Letting attackers know that you are using this software will help them to focus their attack or will make them change their strategy.

In addition to this, an attacker may attempt to set up a brute-force attack to log into the remote interface.

The remote host seems to be running the IDA Pro Disassembler program.

The remote host is running a Sybase SQL server.

The remote device seems to be a Rio Karma MP3 player, running the Rio Kama file upload service.

Make sure the use of such network devices are done in accordance with your corporate security policy.

The remote service is the TCP contact port for Timbuktu, a remote control software application for Windows and Mac OS X.

This script detects if the remote system has a Danware NetOp program enabled and running on UDP.  These programs are used for remote system administration, for telecommuting and for live online training.  They also usually allow authenticated users to access the local system remotely.

This script detects if the remote system has a Danware NetOp program enabled and running on TCP.  These programs are used for remote system administration, for telecommuting and for live online training.  They also usually allow authenticated users to access the local system remotely.

If an attacker can log into the IntruShield Management Console on the remote host, the attacker will have the ability to modify sensor configuration.

ID	Name	Severity
20377	Windows Server Update Services (WSUS) Detection	info
20345	Airport Administrative Traffic Detection (192/UDP)	medium
20340	Network Block Device Server Detection	info
20301	VMware ESX/GSX Server detection	info
20285	HP Integrated Lights-Out (iLO) Detection	info
20181	VERITAS NetBackup Volume Manager Detection	info
20177	GO-Global Server Detection	info
20175	VERITAS Backup Agent Detection	info
20160	Cheops NG Agent Detection	info
20148	VERITAS NetBackup Agent Detection	info
20147	CA Message Queuing Service Detection	info
20109	Trend Micro OfficeScan Client Detection	info
20092	YIFF Sound Server Detection	info
20066	VLAN Membership Policy Server Detection	info
20065	HSQLDB Server Detection	info
20007	SSL Version 2 and 3 Protocol Detection	critical
19772	Skype Detection	info
19759	Py2Play Game Engine Detection	info
19758	Tofu Server Detection	info
19717	Ventrilo Server Detection	info
19706	HP OpenView NNM Alarm Service Detection	info
19701	HP OpenView UI Process Manager Daemon Detection	info
19608	Tetrinet server detection	info
19607	HP OpenView Topology Manager Daemon Detection	info
19601	HP Data Protector Detection	info
19557	EMC Legato Networker Detection	info
19376	CA ARCServe MSSQL Agent Detection	info
19289	UltraVNC w/ DSM Plugin Detection	medium
19288	VNC Server Security Type Detection	info
18536	CA eTrust Intrusion Detection System Detection	info
18532	Enterasys Dragon Enterprise Reporting Detection	info
18428	FlexCast Server Detection	info
18393	Entropy Gathering Daemon (EGD) Detection	info
18373	slident / fake identd Detection	info
25200	CA InoWeb Detection	info
18186	File Alteration Monitor daemon (famd) Detection	low
18185	Kerio Winroute Firewall Admin Service Detection	info
18184	Kerio Mailserver Admin Service Detection	info
18183	Kerio Personal Firewall Admin Service Detection	info
18040	CA ARCServe UniversalAgent Detection	info
18039	Hydrogen Detection	info
17975	Service Detection (GET request)	info
17585	ISS Deployment Manager Detection	info
17258	IDA Pro Disassembler Software Detection	info
17161	Sybase TCP/IP Listener Service Detection	info
16462	Rio Karma MP3 Player File Upload Service Detection	info
15891	Timbuktu Detection (TCP)	info
15766	NetOp Products Detection (UDP)	info
15765	NetOp Products Detection (TCP)	info
15615	McAfee IntruShield Management Console Detection	info

Detections

Analytics

Service detection Family for Nessus

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

info

low

info

info

info

info

info

info

info

info

info

info

info

info

info

info