The remote service understands the Apple Filing Protocol (AFP) and responds to a 'FPGetSrvrInfo' ('DSIGetStatus') request with information about itself. 

AFP is used to offer file services for Mac OS X as well as the older Mac OS. In the past, it has also been known as 'AppleTalk Filing Protocol' and 'AppleShare'.

This script contacts the remote DHCP server (if any) and attempts to retrieve information about the network layout. 

Some DHCP servers provide sensitive information such as the NIS domain name, or network layout information such as the list of the network web servers, and so on. 

It does not demonstrate any vulnerability, but a local attacker may use DHCP to become intimately familiar with the associated network.

The remote host is running a PPTP (Point-to-Point Tunneling Protocol) server.  It allows users to set up a tunnel between their host and the network the remote host is attached to.

The remote host is running an AMANDA backup system client.  AMANDA is a backup system that allows a single backup server to backup multiple hosts.

This detects the AFS client version by connecting to the AFS callback port and processing the buffer received. The client version gives potential attackers additional information about the system they are attacking. Versions and types should be ommited where possible.

The remote host is running an X11 server.  X11 is a client-server protocol that can be used to display graphical applications running on a given host on a remote client. 

Since the X11 traffic is not ciphered, it is possible for an attacker to eavesdrop on the connection.

LCDproc is a client/server suite which contains drivers for LCD devices.

The remote service can be used to display messages on the LCD display attached to the remote host.

The remote host is running VNC (Virtual Network Computing), which uses the RFB (Remote Framebuffer) protocol to provide remote access to graphical user interfaces and thus permits a console on the remote host to be displayed on another.

The remote service responded to a talk request. 

A talk server (also known as 'talkd', 'in.talk', or 'ntalk') is a service that works over UDP and notifies a user when someone wants to initiate a conversation. 

Note that talk is nowadays considered by many to be obsolete.

The remote host is running LinuxConf, a web-based administration tool for Linux. It is suggested to not allow anyone to connect to this service.

The 'dtspcd' service is running.  This service deals with the CDE interface for the X11 system.

The remote host is running Symantec pcAnywhere Status server, a service used to discover pcAnywhere servers on a network.

A server listens for TCP connections on TCP port 17. Once a connection is established a short message is sent out the connection (and any data received is thrown away). The service closes the connection after sending the quote.

Another quote of the day service is defined as a datagram based application on UDP.  A server listens for UDP datagrams on UDP port 17.
When a datagram is received, an answering datagram is sent containing a quote (the data in the received datagram is ignored).

An easy attack is 'pingpong' which IP spoofs a packet between two machines running qotd. This will cause them to spew characters at each other, slowing the machines down and saturating the network.

The remote host is running a Telnet server, a remote terminal server.

It is possible to obtain information about the remote SSH server by sending an empty authentication request.

The remote host is running a mail (SMTP) server on this port. 

Since SMTP servers are the targets of spammers, it is recommended you disable it if you do not use it.

The remote host is running a server that understands the Post Office Protocol (POP), used by email clients to retrieve messages from a server, possibly across a network link.

The remote host is running a news server (NNTP).  Make sure that hosting such a server is authorized by your company policy.

A Nessus daemon is listening on the remote port.

The remote host is running MSSQL, a database server from Microsoft. It is possible to extract the version number of the remote installation from the server pre-login response.

It is possible to obtain the banner of the remote FTP server by connecting to a remote port.

Concurrent Versions System (CVS), an open source versioning system, is running on the remote port. The CVS server can be accessed either using third-party tools (e.g., RSH or SSH) or via the 'pserver' protocol, which is unencrypted.

The rexecd service is running on the remote host. This service is design to allow users of a network to execute commands remotely.
However, rexecd does not provide any good means of authentication, so it may be abused by an attacker to scan a third-party host.

The rlogin service is running on the remote host. This service is vulnerable since data is passed between the rlogin client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If the host is vulnerable to TCP sequence number guessing (from any network) or IP spoofing (including ARP hijacking on a local network) then it may be possible to bypass authentication.
Finally, rlogin is an easy way to turn file-write access into full logins through the .rhosts or rhosts.equiv files.

The Telnet service is running. This service is dangerous in the sense that it is not ciphered - that is, everyone can sniff the data that passes between the telnet client and the telnet server. This includes logins and passwords.

The rsh service is running on the remote host. This service is vulnerable since data is passed between the rsh client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If the host is vulnerable to TCP sequence number guessing (from any network) or IP spoofing (including ARP hijacking on a local network) then it may be possible to bypass authentication.
Finally, rsh is an easy way to turn file-write access into full logins through the .rhosts or rhosts.equiv files.

The remote host is running the 'echo' service. This service echoes any data which is sent to it.

This service is unused these days, so it is strongly advised that you disable it, as it may be used by attackers to set up denial of services attacks against this host.

The remote host is running a 'daytime' service.  This service is designed to give the local time of the day of this host to whoever connects to this port.  The date format issued by this service may sometimes help an attacker to guess the operating system type of this host, or to set up timed authentication attacks against the remote host. 

In addition, if the daytime service is running on a UDP port, an attacker may link it to the echo port of a third-party host using spoofing, thus creating a possible denial of service condition between this host and the third party.

The remote host is running an ident (also known as 'auth') daemon.

The 'ident' service provides sensitive information to potential attackers. It is designed to say which accounts are running which services. This helps attackers to focus on valuable services (those owned by root or other privileged accounts). If you do not use this service, and software you run does not require it, disable it.

ID	Name	Severity
10666	Apple Filing Protocol Server Detection	info
10663	DHCP Server Detection	low
10622	PPTP Detection	info
10462	AMANDA Client Version	info
10441	AFS Client Version Detection	info
10407	X Server Detection	low
10379	LCDproc Detection	info
10342	VNC Software Detection	info
25201	Talk Service (talkd, in.talk, ntalk) Detection	info
10135	LinuxConf Detection	info
10833	CDE Subprocess Control Service (dtspcd) Detection	info
10006	Symantec pcAnywhere Status Service Detection (UDP)	info
10198	Quote of the Day (QOTD) Service Detection	medium
10281	Telnet Server Detection	info
10267	SSH Server Type and Version Information	info
10263	SMTP Server Detection	info
10185	POP Server Detection	info
10159	NNTP Server Detection	info
10147	Nessus Server Detection	info
10144	Microsoft SQL Server TCP/IP Listener Detection	info
10092	FTP Server Detection	info
10051	CVS pserver Detection	info
10203	rexecd Service Detection	critical
10205	rlogin Service Detection	high
10280	Telnet Service Detection	info
10245	rsh Service Detection	high
10061	Echo Service Detection	medium
10052	Daytime Service Detection	info
10021	Identd Service Detection	info

Detections

Analytics

Service detection Family for Nessus

info

low

info

info

info

low

info

info

info

info

info

info

medium

info

info

info

info

info

info

info

info

info

critical

high

info

high

medium

info

info