FSP daemon running

Risk Level: Low risk vulnerability Low

Check or Attack Name: Fsp
Platforms: Any, Solaris: 2.5.1
Description:

A File Service Protocol (FSP) server has been detected as running. FSP is an alternative to FTP that transfers files using UDP. The majority of FSP activity is illegitimate. You should investigate this machine for possible software piracy or intrusion.
Remedy:

Investigate FSP server and determine if its presence is legitimate. Remove the FSP server if it is not needed.

References:

Andy Doherty <A.J.Doherty@reading.ac.uk>, File Service Protocol (FSP) Frequently Asked Questions, http://mclachlan.rdg.ac.uk/misc/fsp/faq/faq.htm

Andy Doherty <A.J.Doherty@reading.ac.uk>, File Service Protocol (FSP) Frequently Asked Questions, http://itu.rdg.ac.uk/misc/fsp/faq/faq.htm


Modem detected and active

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Active Modem
Platforms: Windows NT
Description:

An active modem driver was detected. This situation only occurs when the modem is in use, or when the modem driver program is active. Modems can be a sign of an unauthorized channel around your firewall. Attackers can use the modem to circumvent network security.
Remedy:

The modem must not be active while the computer is attached to the network. You may want to minimize the impact of a security breach caused by unauthorized modem use by limiting which machines trust the computer using the modem.

If using a modem on the network is required, configure all Remote Access Setup ports so that the port usage can dial-out only. Verify that your dial-out network configuration protocols match exactly the protocols you need to access the remote network. Review share permissions and account security to verify that the file system is not accessible from a remote location.
References:


Portd running

Risk Level: | High risk vulnerability High | Check or Attack Name: PortdCheck
Platforms: | Any
Description: | A port daemon or a potential backdoor program has been detected on port 31337 of the target machine. This usually means that an attacker has backdoored the system.
Remedy: | If the process is unauthoized, consider the computer and possibly your network compromised. Follow your company's policy for recovering from a system compromise.
References: | CERT Tech Tips, Steps for Recovering from a UNIX Root Compromise, http://www.cert.org/tech_tips/root_compromise.html


NetBus trojan horse allows complete remote control of Windows systems

Risk Level: High risk vulnerability High

Check or Attack Name: NetBus
Platforms: Windows NT, Windows 95, Windows 98, Trojan Horse: Windows
Description:

NetBus version 1.x is a Trojan horse program for Windows 95, 98, and NT that relinquishes complete control of a system to an attacker who knows the correct password. By default, NetBus will listen on TCP port 12345 for commands and is easily detectable. If you determine you have been infected with this program, remove it immediately.

Remedy:

To verify if Netbus is installed, follow these steps:

  1. From a DOS command prompt, type: netstat -an | find "12345"
  2. The machine may be infected with NetBus if the response is similar to one of the following entries:
    • TCP 0.0.0.0:12345 0.0.0.0:0 LISTENING (NetBus is idle.)
    • TCP 127.0.0.1:12345 127.55.51.212:29223 ESTABLISHED (NetBus is active.)

    Note: If you use netstat -a instead of -an, you can get the hostname instead of the IP address.

  3. If NetBus exists on the machine, perform the following procedures to remove a NetBus installation.

    • Remove Netbus from your computers.

      To remove NetBus from your computers, follow these steps:

      1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
      2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run key.
      3. Locate and delete a value named SysEdit. This is the default NetBus server signature.

        4. Note: The SysEdit value may vary. If you cannot find this value, the machine may have NetBus 1.6 or later installed. See below to remove an installation of NetBus 1.6.

      4. Reboot the computer.
      5. Delete the SysEdit.exe and KeyHook.dll files from your system. You can locate these files from the Windows NT Start menu by choosing Find, Files or Folders. After the registry entry and server executables are deleted, NetBus is no longer installed on the system.

    • To remove an installation of NetBus 1.6, follow these steps:

      1. From a DOS command prompt, type: telnet <your_hostname> 12345
      2. Type: Password;1;
      3. Then type: RemoveServer;1;
References:

NetBus Web Site (changes frequently), NetBus - Remote administration tool, http://www.angelfire.com/ab/netbussite/index.html

ISS Security Advisory #8, Windows Backdoors Update, http://xforce.iss.net/alerts/advise8.php3

NetBus Web Site, NetBus - Remote administration tool, http://fly.to/netbus


Back Orifice default installation

Risk Level: High risk vulnerability High

Check or Attack Name: BackOrifice
Platforms: Windows 95, Windows 98
Description:

Back Orifice is a backdoor for Windows 95/98 released by the hacker group Cult of the Dead Cow. This backdoor allows remote users to totally control your machine. If discovered, Back Orifice should be removed immediately.
Remedy:

Remove Back Orifice immediately by editing the RunServices registry key and removing the Back Orifice executable.

To remove a default installation of Back Orifice from your system, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedit, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices registry key.
  3. Look for an entry called (Default) with a value of .exe.
  4. Delete this entry and reboot the machine.
  5. Delete the file exe~1 in your Windows system directory (probably c:\windows\system).
References:

Cult of the Dead Cow (cDc), cDc Home Page, http://www.cultdeadcow.com

ISS Security Advisory #5, Cult of the Dead Cow Back Orifice Backdoor, http://xforce.iss.net/alerts/advise5.php3


Internet Explorer accept cookies warning disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE accept cookies
Platforms: Internet Explorer
Description:

The web browser does not display a warning before accepting a cookie from a remote site. Web sites frequently store a small file or cookie on your computer to provide customization features or to recognize you when you return. This file is usually stored in a non-secure manner and may be accessible to others.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced and enable Warn Before Accepting a Cookie.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Advanced tab.
    4. Locate the feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced and disable Always accept cookies.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable Allow cookies that are stored on your computer or disable Allow per-session cookies (not stored).

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.

For more information on cookies, see Internet Explorer topic "Control your cookie intake" at http://www.microsoft.com/ie/win31/?/ie/win31/ie40/cookie.htm.
References:

Microsoft Internet Explorer Information, Control your cookie intake, http://www.microsoft.com/windows/ie/win31/?/ie/win31/ie40/cookie.htm


Internet Explorer has low active content security enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE active content
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser downloads and executes any active content embedded within HTML pages. Potentially malicious content can be downloaded and executed by the web browser.
Remedy:

  • In Internet Explorer 3.x, from the Options dialog box, go to the Security/Safety Level and disable None (Not recommended).

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Click Safety Level.
    5. Disable the None (Not recommended) option.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Miscellaneous.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the Miscellaneous folder, locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.
      6. <


Internet Explorer allows active content to be automatically downloaded

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE active download
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser allows active content to be automatically downloaded from the HTML page that contains the content. Potentially malicious or virus-infected programs may be stored on the local file system.
Remedy:

  • In Internet Explorer 3.x, from the Options dialog box, go to Security and disable Allow Downloading of Active Content.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Disable the Allow Downloading of Active Content option.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Downloads.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the Downloads folder, locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.


Internet Explorer active scripting is enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE active scripting
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser has active scripting enabled. This option allows ActiveX controls to be scripted within HTML pages. The web browser may automatically execute potentially malicious scripts.
Remedy:

  • In Internet Explorer 3.x, from the Options dialog box, go to Security and disable Run ActiveX Scripts.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Disable the Run ActiveX Scripts option.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Scripts.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the Scripts folder, locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.


Internet Explorer allows ActiveX controls to be automatically executed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: IE ActiveX execution
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser allows ActiveX controls to be automatically executed. ActiveX controls and plug-ins may be launched directly from the HTML page that contains the control. Potentially malicious ActiveX controls or plug-ins may run without the user's approval or knowledge.
Remedy:

  • In Internet Explorer 3.x, from the Options dialog box, go to Security and disable Enable ActiveX Controls and Plug-ins.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Disable the Enable ActiveX Controls and Plug-ins option.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under ActiveX controls and plug-ins.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the ActiveX controls and plug-ins folder, locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.


Internet Explorer allows secure content to be cached

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE cached pages
Platforms: Internet Explorer
Description:

Allows secure content to be cached on the local file system in non-encrypted or non-secure form.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced/Cryptography Settings and enable Do Not Save Secure Pages To Disk.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Advanced tab.
    4. Locate the feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced, and in the Security section enable Do not save encrypted pages to disk.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, enable the appropriate settings under the Advanced tab.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Advanced tab.
    4. Enable Do not save encrypted pages to disk.
    5. Click OK to apply the changes.


Internet Explorer has the check security certificate before sending option disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE send certificate
Platforms: Internet Explorer
Description:

The web browser issues no warning when sending data to a remote site whose security certificate does not match its Internet address. The user may submit confidential data to a non-secure site.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 2.x, from the Options dialog box, go to Security and disable Low: Do Not Warn Before Sending.

    1. Open Internet Explorer 2.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced and enable Warn About Invalid Site Certificates.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Advanced tab.
    4. Locate the feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced and enable Warn about invalid site certificates.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Advanced and enable the Warn about invalid site certificates option.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Advanced tab.
    4. In the Security folder, enable Warn about invalid site certificates option.
    5. Click OK to apply the changes.


Internet Explorer has check security certificate before viewing option disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE view Certificate
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser issues no warning when viewing data on a remote site containing a security certificate that does not match its Internet address. The user may be unable to distinguish between secure and insecure content.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 2.x, from the Options dialog box, go to Security and enable Check Security Certificate Before Viewing.

    1. Open Internet Explorer 2.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced and enable Warn About Invalid Site Certificates.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced and enable Warn about invalid site certificates.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Locate the security feature and set it to the recommended value.
    8. Click OK twice to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to the Advanced tab and enable the Warn about invalid site certificates option.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Advanced tab.
    4. In the Security folder, enable Warn about invalid site certificates option.
    5. Click OK to apply the changes.


Internet Explorer Form redirection enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE form redirection
Platforms: Internet Explorer
Description:

The web browser issues no warning when form data is redirected, that is, submitted to a web location other than the location making the request. Confidential data may be submitted to a non-secure site.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced, and in the Security section enable Warn if forms submit is being redirected.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. In the Security section, enable the Warn if forms submit is being redirected option.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, enable the Warn if forms submittal is being redirected option in the Advanced tab.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Advanced tab.
    4. Enable the Warn if forms submittal is being redirected option.
    5. Click OK to apply the changes.


Internet Explorer has Java enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE java enabled
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser has Java enabled. This option allows script code embedded in HTML pages to use Java applets, provided that the applets expose properties, methods, and events. The web browser may automatically execute potentially malicious scripts or Java applets.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 3.x, from the Options dialog box, go to Security and disable Enable Java Programs.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Disable the Enable Java Programs option.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced and disable the appropriate Java settings.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Go to the Java VM section and disable the appropriate options.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Java.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the Java folder, locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.


Internet Explorer non-secure form submission warning is disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE non-secure submission
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser issues no warning when submitting non-encrypted form data to the HTML page making the data request. The user may be unable to distinguish between submitting encrypted and non-encrypted form data. Potentially sensitive data may be intercepted by packet sniffing.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 2.x, from the Options dialog box, go to Security and disable Low: Do Not Warn Before Sending.

    1. Open Internet Explorer 2.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced and enable Warn Before Sending Over an Open Connection.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Advanced tab.
    4. Locate the feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Security and disable the appropriate settings under Miscellaneous.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab, and then click Custom Level.
    4. From the Miscellaneous folder, locate Submit nonencrypted form data and set it to the recommended value.
    5. Click OK to apply the changes.


Internet Explorer is outdated

Risk Level: | Low risk vulnerability Low | Check or Attack Name: IE outdated
Platforms: | Windows NT, Windows 95, Windows NT: 4.0
Description: | An outdated version of Microsoft Internet Explorer has been detected. All versions of Internet Explorer prior to 4.01 are known to have security issues.
Remedy: | Obtain the latest released version and patches for Internet Explorer at http://www.microsoft.com/ie.
References: | Microsoft Internet Explorer Home, Get Internet Explorer the Way You Want It, http://www.microsoft.com/windows/Ie/default.htm


Internet Explorer entering/leaving a secure site warning disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IE secure site
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser issues no warning when entering or leaving an encrypted or secure site. The user may be unable to distinguish between viewing trusted and non-trusted content.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • In Internet Explorer 2.x, from the Options dialog box, go to Security and disable Low: Do Not Warn Before Viewing.

    1. Open Internet Explorer 2.x.
    2. From the View menu, select Options.
    3. Click the Security tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 3.x, from the Options dialog box, go to Advanced and enable Warn If Changing Between Secure and Unsecure Mode.

    1. Open Internet Explorer 3.x.
    2. From the View menu, select Options.
    3. Click the Advanced tab.
    4. Locate the feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 4.x, from the Internet Options dialog box, go to Advanced and enable Warn if changing between secure and not secure mode.

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.

  • In Internet Explorer 5.x, from the Internet Options dialog box, go to Advanced and enable Warn if changing between secure and not secure mode.

    1. Open Internet Explorer 5.x.
    2. From the View menu, select Internet Options.
    3. Click the Advanced tab.
    4. Locate the advanced feature and set it to the recommended value.
    5. Click OK to apply the changes.


Netscape Navigator accept cookies warning

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav accept cookies
Platforms: Windows 95, Windows NT: 4.0
Description:

The web browser does not display a warning before accepting a cookie from the remote site. A remote site may store information concerning a user's identity and preferences on the local file system, usually in a non-secure manner.
Remedy:

In Netscape Navigator 3.x, from Network Preferences, go to the Protocol section and enable Accepting a Cookie.

To set protocol preferences in Netscape Navigator 3.x:

  1. Open Netscape Navigator 3.x.
  2. From the Options menu, select Network Preferences.
  3. Click Protocol.
  4. Locate the protocol option and set it to the recommended value.
  5. Click OK.


Netscape Navigator entering a secure site warning is disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav enter secure site
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser displays no warning when entering an encrypted or secure site. A user may be unable to distinguish between viewing trusted and non-trusted content. Because this option allows pages to be decrypted without intervention, it may result in secure content being cached on the local file system in a non-secure manner.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable Entering a Secure Document Space (Server).

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.

  • In Netscape Navigator 3.x, from Security Preferences, go to the General section and enable Entering a Secure Document Space (Server).

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.

  • In Netscape Navigator 4.x, from Security Info, go to the Navigator section and enable Entering an Encrypted Site.

    To set Security Preferences in Netscape Navigator 4.x, follow these steps:

    1. Open Netscape Navigator 4.x.
    2. From the Window menu, select Security Info.
    3. Click Navigator.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.


Netscape Navigator has Java enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav Java enabled
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser has Java enabled. This option allows script code embedded in HTML pages to use Java applets, provided that the applets expose properties, methods, and events. The web browser may automatically execute potentially malicious scripts or Java applets.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable Disable Java.

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.

  • In Netscape Navigator 3.x, from Network Preferences, go to the Language section and disable Enable Java.

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.


Netscape Navigator has JavaScript enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav Javascript enabled
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser has JavaScript enabled. This option allows the web browser to automatically execute JavaScript code embedded in HTML. The web browser may automatically execute potentially malicious JavaScripts.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable 'Disable JavaScript.'

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.

  • In Netscape Navigator 3.x, from Network Preferences, go to the Language section and disable 'Enable JavaScript.'

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.

  • To disable JavaScript via the Registry, follow these steps:

    1. Open the Registry Editor. From the Start menu, select Run, type regedt32 (or regedit on Windows 95 or 98 computers), and click OK.
    2. Set the 'HKEY_USERS\\Software\Netscape\Netscape Navigator\Java' value 'Enable JavaScript' (type REG_SZ) to 'No'.
References:

CERT Advisory CA-97.20, JavaScript Vulnerability, http://www.cert.org/advisories/CA-97.20.javascript.html


Netscape Navigator leaving a secure site warning is disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav leave secure site
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser displays no warning when leaving an encrypted or secure site. A user may be unable to distinguish between viewing trusted and non-trusted content. Because this option allows pages to be decrypted without intervention, it may result in secure content being cached on the local file system in a non-secure manner.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable Leaving a Secure Document Space (Server).

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.

  • In Netscape Navigator 3.x, from Security Preferences, go to the General section and enable Leaving a Secure Document Space (Server).

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.

  • In Netscape Navigator 4.x, from Security Info, go to the Navigator section and enable Leaving an Encrypted Site.

    To set Security Preferences in Netscape Navigator 4.x, follow these steps:

    1. Open Netscape Navigator 4.x.
    2. From the Window menu, select Security Info.
    3. Click Navigator.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.


Netscape Navigator mixed document security warning is disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav mixed document
Platforms: Windows NT, Windows 95, Windows NT: 4.0
Description:

The web browser displays no warning when viewing a document with both secure and insecure content. A user may be unable to distinguish between secure and insecure content.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable Viewing a Document With a Secure/Insecure Mix.

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.

  • In Netscape Navigator 3.x, from Security Preferences, go to the General section and enable Viewing a Document With a Secure/Insecure Mix.

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.

  • In Netscape Navigator 4.x, from Security Info, go to the Navigator section and enable Viewing a Page With an Encrypted/Unencrypted Mix.

    To set Security Preferences in Netscape Navigator 4.x, follow these steps:

    1. Open Netscape Navigator 4.x.
    2. From the Window menu, select Security Info.
    3. Click Navigator.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.


Netscape Navigator non-secure form submission warning is disabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav non-secure submission
Platforms: Windows 95, Solaris: 2.5.1, Windows NT: 4.0
Description:

The web browser displays no warning when submitting non-encrypted form data to the HTML page making the data request. A user may be unable to distinguish between encrypted and non-encrypted form data. Potentially sensitive data may be intercepted by packet sniffing.
Remedy:

Depending on your version, select one of the following choices in Netscape Navigator:

  • In Netscape Navigator 2.x, go to Security Preferences and enable Submitting a Form Insecurely.

    To set Security Preferences in Netscape Navigator 2.x, follow these steps:

    1. Open Netscape Navigator 2.x.
    2. From the Options menu, select Security Preferences.
    3. Locate the security feature and set it to the recommended value.
    4. Click OK.
  • In Netscape Navigator 3.x, from Security Preferences, go to the General section and enable Submitting a Form Insecurely.

    To set Security Preferences in Netscape Navigator 3.x, follow these steps:

    1. Open Netscape Navigator 3.x.
    2. From the Options menu, select Security Preferences.
    3. Click the General tab.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.
  • In Netscape Navigator 4.x, from Security Info, go to the Navigator section and enable Sending Unencrypted Information to a Site.

    To set Security Preferences in Netscape Navigator 4.x, follow these steps:

    1. Open Netscape Navigator 4.x.
    2. From the Window menu, select Security Info.
    3. Click Navigator.
    4. Locate the security feature and set it to the recommended value.
    5. Click OK.
            •


Netscape Navigator is outdated

Risk Level: Low risk vulnerability Low

Check or Attack Name: Nav outdated
Platforms: Netscape Communicator: 4.5, Netscape Communicator: 4.05, Netscape Navigator
Description:

All versions of Netscape Navigator prior to 4.08 and Netscape Communicator prior to 4.51 contain serious security vulnerabilities and should be upgraded to the latest available version.
Remedy:

Install the latest version of Navigator.

To install the latest version of Navigator, follow these steps:

  1. Open your web browser.
  2. Enter http://home.netscape.com/download/.
  3. Download the latest Navigator.

For a list of bugs, reference http://home.netscape.com/assist/security/index.html and http://home.netscape.com/assist/security/index.html.
References:

Netscape Netcenter, Netscape Products, http://www.netscape.com/download/index.html

Netscape Communications, Inc., Netscape Security Solutions, http://www.netscape.com/products/security/


FTP default account accessible

Risk Level: High risk vulnerability High

Check or Attack Name: defftp
Platforms: Any
Description:

An accessible default account was detected through FTP. Default accounts through FTP allow attackers easy access to remote systems.
Remedy:

Disable the open account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Change the password on this account to something difficult to guess, or disable login access to this Windows account.

To change a password on a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. To change the password to something difficult to guess, type and confirm the new password.
  4. Click OK.

—OR—

To disable login access to a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. To disable the account, select the Account Disabled check box.
  4. Click OK.


Kerberos IV brute force

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: kerbbf
Platforms: Kerberos: IV
Description:

Using the Kerberos IV Brute Force attack, the Kerberos IV Key Distribution Center (KDC) enables anyone to request a ticket-granting ticket. Because certain parts of the ticket contents are known, and the ticket is encrypted with the user's password, attackers can mount a brute force attack on the KDC.
Remedy:

Obtain the latest Kerberos distribution from the Kerberos information site at http://web.mit.edu/network/kerberos-form.html.
References:

Massachusetts Institute of Technology, Kerberos: The Network Authentication Protocol, http://web.mit.edu/kerberos/www/

CERT Advisory CA-96.03, Vulnerability in Kerberos 4 Key Server, http://www.cert.org/advisories/CA-96.03.kerberos_4_key_server.html


Kerberos IV peek accesses user names and information

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: kerbul
Platforms: | Kerberos: IV
Description: | Because the Kerberos IV Key Distribution Center (KDC) does not clear some internal buffers, a remote attacker can send a malformed packet to the KDC that will cause it to leak the username of the last request. By sending these packets multiple times and analyzing the results of each one, a list of usernames can be obtained.
Remedy: | This problem does not affect Kerberos 5 installations or Kerberos 5 in version 4 compatibility mode. Cygnus Network Security provided a fix for this vulnerability in the 96Q4 release of Kerberos 4.
References: | L0pht Security Advisory, Kerberos 4, http://www.l0pht.com/advisories/krb_adv.html Massachusetts Institute of Technology, Kerberos: The Network Authentication Protocol, http://web.mit.edu/kerberos/www/


POP3 default account accessible

Risk Level: High risk vulnerability High

Check or Attack Name: defpop
Platforms: Any
Description:

An accessible default account was detected through POP3. Default accounts through POP3 allow attackers easy access to remote systems.
Remedy:

Disable the POP3 account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed.

To remove login access for a Unix account, follow these steps:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Change the password on this account to something difficult to guess, or disable login access to this Windows account.

To change a password on a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. In the Password field, type the new password.
  4. In the Confirm Password field, confirm the new password.
  5. Click OK.

—OR—

To disable login access to a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. To disable the account, select the Account Disabled check box.
  4. Click OK.


Rexec default account accessible

Risk Level: High risk vulnerability High

Check or Attack Name: defrexec
Platforms: Any
Description:

An accessible default account was detected through rexec. Default accounts allow attackers easy access to remote systems.
Remedy:

Disable the Rexec account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed.

To remove login access for a Unix account, follow these steps:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Change the password on this account to something difficult to guess, or disable login access to this Windows account.

To change a password on a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. To change the password to something difficult to guess, type and confirm the new password.
  4. Click OK.

—OR—

To disable login access to a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. To disable the account, select the Account Disabled check box.
  4. Click OK.


Rsh default account accessible

Risk Level: High risk vulnerability High

Check or Attack Name: defrsh
Platforms: Any
Description:

The remote host system for this account allowed access from the scanning machine. This trust may extend to other machines, allowing an attacker to compromise security.

Warning: Software that scans some Unix systems may cause the system to halt if the shutdown/shutdown or halt/halt accounts/password pairs exist. For a good security policy, these accounts should be removed, renamed, or at the very least contain a difficult to guess password.
Remedy:

Examine the .rhosts file, which contains configuration information for trusted hosts. Any entries containing a + (plus sign) should be removed or commented out.


AnyForm CGI script allows remote execution of arbitrary commands

Risk Level: High risk vulnerability High

Check or Attack Name: AnyForm
Platforms: Common Gateway Interface (CGI)
Description:

The AnyForm cgi-bin program contains a vulnerability that allows a remote attacker to execute programs on a web server. This is present in AnyForm2, version 2 of the AnyForm program by John Roberts.
Remedy:

Disable access or execute permission to the AnyForm2 script and upgrade to AnyForm version 3 or greater.
References:

University of Kentucky AnyForm Web Site, AnyForm - HTML Form Processor version 3.2, http://www.uky.edu/AnyForm

WWW-Security Mailing List, SECURITY HOLE: "AnyForm" CGI, http://www-ns.rutgers.edu/www-security/archives/0802.html


Campas cgi-bin file executes remote commands

Risk Level: | High risk vulnerability High | Check or Attack Name: Campas
Platforms: | NCSA Servers: Old, Common Gateway Interface (CGI)
Description: | The campas CGI program contains a vulnerability that allows a remote attacker to execute commands on a web server with the privileges of the user owning the server process. The campas program is included as a sample CGI program in some older versions of the NCSA server.
Remedy: | The campas CGI program is not required for the normal functioning of your web server and should be deleted.
References: | BUGTRAQ Mailing List, Francisco Torres <ftorres@CASTOR.JAVERIANA.EDU.CO>, Bug CGI campas, http://www.netspace.org/cgi-bin/wa?A2=ind9707c&L=bugtraq&F=&S=&P=1048


CGI program executed an arbitrary command

Risk Level: | High risk vulnerability High | Check or Attack Name: cgiexec
Platforms: | Any
Description: | A vulnerable CGI program was detected. If a CGI program can be tricked into echoing characters, it can potentially be exploited to execute other commands that pose a security risk.
Remedy: | Remove the offending cgi program, if possible. Otherwise, disable the program until the bug can be diagnosed and fixed. Make sure CGI programs do not pass unchecked user input to a shell for execution.
References: |


FormMail remote execution

Risk Level: High risk vulnerability High

Check or Attack Name: FormMailExec
Platforms: FormMail, Common Gateway Interface (CGI)
Description:

The FormMail CGI program contains a vulnerability that allows a remote attacker to execute arbitrary commands on a victim's server. This vulnerability is present in version 1.0 of the FormMail program by Matt Wright.
Remedy:

Disable access to the FormMail script until you can upgrade to the latest version.
References:

FormMail at Matt's Script Archive Web Site, FormMail Information, http://worldwidemart.com/scripts/formmail.shtml

WWW-Security Mailing List, SECURITY HOLE: FormMail, http://www-ns.rutgers.edu/www-security/archives/0810.html


FormMail remote usage

Risk Level: | Low risk vulnerability Low | Check or Attack Name: FormMailUse
Platforms: | FormMail, Common Gateway Interface (CGI)
Description: | The FormMail CGI program contains a vulnerability that allows remote sites to make use of your web server's resources by using your FormMail program for their own sites. This is present in versions of FormMail prior to v1.3 by Matt Wright.
Remedy: | Monitor your network for unauthorized access to your web server until you can upgrade to the latest version of FormMail.
References: | FormMail at Matt's Script Archive Web Site, FormMail Information, http://worldwidemart.com/scripts/formmail.shtml


Glimpse HTTP aglimpse remote execution vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: Aglimpse
Platforms: Glimpse: 2.0, Common Gateway Interface (CGI)
Description:

The aglimpse CGI script shipped with Glimpse HTTP 2.0 and WebGlimpse versions prior to 1.5 contains a vulnerability that would allow an attacker to remotely execute commands on a web server with the UID of the user running the httpd process.
Remedy:

Disable access to the aglimpse CGI script until you can upgrade to the latest version of WebGlimpse.
References:

GLIMPSE: A tool to search entire file systems, GlimpseHTTP security, http://donkey.cs.arizona.edu/security.html

CERT Vendor-Initiated Bulletin VB-97.13, Vulnerability in GlimpseHTTP and WebGlimpse CGI scripts, http://www.cert.org/ftp/cert_bulletins/VB-97.13.GlimpseHTTP.WebGlimpse


Glimpse HTTP aglimpse remote execution vulnerability

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: HTTP Glimpse Vulnerability
Platforms: Glimpse: 2.0, Common Gateway Interface (CGI)
Description:

The aglimpse program contains a vulnerability that allows a remote attacker to execute arbitrary commands on a web server. The aglimpse program is part of the Glimpse HTTP package, a web interface to the glimpse search tool. Glimpse HTTP v2.0 is vulnerable to this problem.

The attacker can access the files on the web server with the same user ID as that of the configuration of your web server. This exploit could allow the attacker to gain root or administrator access to the host. In either case, it allows the attacker to alter the contents of your web site.
Remedy:

Upgrade to WebGlimpse at http://donkey.cs.arizona.edu/security.html.

As a temporary fix, log on as root on the vulnerable machine and type: # /bin/chmod 400 /usr/local/etc/httpd/cgi-bin/aglimpse

Replace the path name with your cgi-bin directory.

Patches: Insert a / character at the start of the open command in the aglimpse program (around line 72).

The vulnerable line is: open(CONF,'$indexdir/archive.cfg') || &err_conf;

The patched line is: open(CONF,'/$indexdir/archive.cfg') || &err_conf;


Guestbook could allow execution of commands from remote

Risk Level: | High risk vulnerability High | Check or Attack Name: GuestBookCheck
Platforms: | Common Gateway Interface (CGI)
Description: | The guestbook CGI program contains a vulnerability that allows a remote attacker to execute arbitrary commands on a web server. This is present in Selena Sol's guestbook on servers with Server Side Includes enabled.
Remedy: | Modify the guestbook.setup file, adding the word exec to the comma delimited @bad_words variable. —OR— Modify the guestbook.setup file so that the @allow_html variable is set to no.
References: | CERT Vendor-Initiated Bulletin VB-97.02, Security Hole in Guestbook Script for Web Servers Using SSI, http://www.cert.org/ftp/cert_bulletins/VB-97.02.sol_guestbook


Nph-test-cgi file listing vulnerability

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: nphtestcgi
Platforms: NCSA Servers: Old, Apache: Old, Common Gateway Interface (CGI)
Description:

The nph-test-cgi program contains a vulnerability that allows a remote attacker to list the contents of any readable directory on a web server. This allows a remote attacker to inventory a system and to quickly determine other likely vulnerabilities or targets. This vulnerability is also commonly present in the test-cgi program. The nph-test-cgi program is installed by default with Apache web servers up to and including v1.0.5. It is also installed with some versions of NCSA web server.
Remedy:

The nph-test-cgi script is included in web server packages as a code sample and is not required for normal operation, therefore it should be removed from the cgi-bin directory. The Apache web server starting with v1.1.3 no longer includes nph-test-cgi in a default installation.
References:

L0pht Security Advisory, test-cgi vulnerability in certain setups, http://www.l0pht.com/advisories/test-cgi-vulnerability

CERT Advisory CA-97.07, Vulnerability in the httpd nph-test-cgi script, http://www.cert.org/advisories/CA-97.07.nph-test-cgi_script.html


Phone book CGI phf allows remote execution of arbitrary commands

Risk Level: High risk vulnerability High

Check or Attack Name: vulnphf
Platforms: NCSA Servers: Old, Apache: Old, Common Gateway Interface (CGI)
Description:

A vulnerability exists in the phf phone book program included with older NCSA and Apache server packages that allows a remote attacker to execute arbitrary commands on your web server. Exploit information for this vulnerability is widespread and many programs exist to actively probe entire networks for this vulnerability.
Remedy:

The phf program is not necessary for normal operation of your web server and should be removed from the cgi-bin directory.
References:

CERT Advisory CA-96.06, Vulnerability in NCSA/Apache CGI example code, http://www.cert.org/advisories/CA-96.06.cgi_example_code.html

IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:002.1, Some C-language based Common Gateway Interface programs that call a shell to execute other programs can be tricked into executing any arbitrary command, http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories

IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:002.2, Update of ERS-SVA-E01-1996:002.1, http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories


php.cgi buffer overflow

Risk Level: | High risk vulnerability High | Check or Attack Name: PHPBufferOverflow
Platforms: | PHP, Common Gateway Interface (CGI)
Description: | The php CGI program (php.cgi) is part of the PHP/FI package written by Rasmus Lerdorf. This program contains a buffer overflow that allows remote attackers to execute arbitrary commands on a web server. Commands are limited to those capable of being run under the UID of the user owning the httpd process, usually nobody.
Remedy: | Disable access to the php.cgi executable and upgrade to the latest version of PHP/FI.
References: | PHP: Hypertext Preprocessor Home Page, PHP Information, http://www.php.net Network Associates, Inc. Security Advisory #12, PHP/FI command line buffer overflow, http://www.nai.com/nai_labs/asp_set/advisory/12_php_overflow_adv.asp


PHP remote file read vulnerability

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: PHPread
Platforms: | PHP, Common Gateway Interface (CGI)
Description: | The php.cgi program contains a vulnerability that allows a remote attacker to view the contents of any file accessible to the user who owns the server process. The php.cgi program is part of the PHP/FI package written by Rasmus Lerdorf.
Remedy: | Upgrade to the latest version of PHP/FI, which includes fixes for this security problem.
References: | PHP: Hypertext Preprocessor Home Page, PHP Information, http://www.php.net


Test-cgi sample CGI script allows remote retrieval of file listings

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: vulntestcgi
Platforms: | NCSA Servers: Old, Apache: Old, Common Gateway Interface (CGI)
Description: | The test-cgi program shipped with older NCSA and Apache web server packages contains a vulnerability that allows remote users to view listings of files on your system. Exploit information for this hole has been widely distributed.
Remedy: | Remove test-cgi, in addition to any other example CGI scripts, from your cgi-bin directory. If these scripts exist on your system, you may be running an outdated server and should upgrade to the latest version offered by your vendor.
References: | L0pht Security Advisory, test-cgi vulnerability in certain setups, http://www.l0pht.com/advisories/test-cgi-vulnerability


HTTP View source vulnerability

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ViewSource
Platforms: | Common Gateway Interface (CGI)
Description: | The view-source CGI script distributed with some web servers and the SCO Skunkware CD-ROM contains a vulnerability that could allow a remote attacker to view files on the server. The attacker is limited to reading files accessible to the user owning the server process, usually nobody.
Remedy: | Remove the view-source script from the cgi-bin directory on your web server.
References: | BUGTRAQ Mailing List, view-source, http://www.netspace.org/cgi-bin/wa?A2=ind9702B&L=bugtraq&P=R64


CGI-BIN programs vulnerable

Risk Level: | High risk vulnerability High | Check or Attack Name: vulncgi
Platforms: | Unix, Common Gateway Interface (CGI)
Description: | The /cgi-bin was found to be potentially vulnerable. A common web server misconfiguration is to put shell interpreters (such as sh, csh, etc.) in the cgi-bin directory. Also, early web server documentation said to place CGI script interpreters such as Perl, Tcl, etc. in the cgi-bin directory. This placement can become a problem because it allows remote users to execute commands through the interpreters. Specially formatted HTTP requests can cause these shells to execute commands, for example, to e-mail password files.
Remedy: | Command interpreters such as sh or perl should never be located in /cgi-bin. Evaluate locally authored CGI executables to make sure they do not pass unvalidated user-supplied data to system commands.
References: | CERT Advisory CA-96.11, Interpreters in CGI bin Directories, http://www.cert.org/ftp/cert_advisories/CA-96.11.interpreters_in_cgi_bin_dir


DG/UX finger shell metacharacters allowed

Risk Level: | High risk vulnerability High | Check or Attack Name: DguxFing
Platforms: | DG/UX
Description: | Some older DG/UX finger daemons were vulnerable to shell metacharacter attacks, allowing attackers to execute arbitrary commands through the finger port.
Remedy: | Contact Data General for a patch. This problem has been reported as fixed in revision R4.11MU03 and later of DG/UX.
References: | BUGTRAQ Mailing List, Re: in.fingerd vulnerability, http://www.netspace.org/cgi-bin/wa?A2=ind9708D&L=bugtraq&F=&S=&P=635


Echo service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: echo
Platforms: Any
Description:

The echo service was detected as running. The echo (port 7) service can be spoofed into sending data from one service on one machine to another service on another machine. This action causes an infinite loop and creates a denial of service attack. The attack can consume increasing amounts of network bandwidth, causing loss of performance or a total shutdown of the affected network segments.
Remedy:

Disable the echo service if it is not used.

Unix: Disable the echo service by commenting out the echo entry in the /etc/inetd.conf file, then restarting the inetd process.

Windows: The echo service is not native to Windows, but may be present. To disable this service, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings/Control Panel/Services.
  2. Select the Simple TCP/IP Services service and click Stop.
  3. Click Startup.
  4. To permanently stop all TCP/IP services, click Disabled.

—OR—

If you only want to disable the echo service:

  1. Open the registry editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK.
  2. Select the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SimpTcp\Parameters key.
  3. Set EnableTcpEcho and EnableUdpEcho to 0.
  4. Restart the Simple TCP/IP service.


Finger service

Risk Level: Low risk vulnerability Low

Check or Attack Name: finger
Platforms: Finger Service, Windows NT
Description:

The finger service or daemon was detected as running. Finger can give an attacker information, such as login accounts and trusted hosts.
Remedy:

Disable finger, or install a finger service or daemon that limits the type of information provided.

Windows: The finger service is not native to Windows, but may be present. To stop or disable the service in Windows NT, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.

Unix: Disable the finger daemon or configure the type of information available from finger. Unix systems can use GNU finger available from ftp://prep.ai.mit.edu/pub/gnu/finger/finger-1.37.tar.gz.

To disable the finger daemon when started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

For more information on GNU finger, download the compressed file from ftp://prep.ai.mit.edu/pub/gnu/finger/finger-1.37.tar.gz. You will need decompression and untarring utilities to use this file.


INN control message vulnerable

Risk Level: High risk vulnerability High

Check or Attack Name: innd vuln
Platforms: InterNet News (INN)
Description:

A vulnerability has been identified in the InterNet News (INN) daemon that could allow a remote attacker to gain root access on vulnerable machines. This hole affects all versions up to and including 1.5.1. By sending a specially crafted control message to the victim news server, the process can be tricked into executing arbitrary commands with root privileges. Exploit information for this hole has been made widely available.
Remedy:

This problem affects all versions including and prior to 1.5.1. Users should upgrade to a more recent release of INN, or at the very least apply the patches to the 1.5.1 source tree and rebuild.
References:

CERT Summary CS-97.02, Current activity - attacks on news servers, ftp://info.cert.org/pub/cert_summaries/CS-97.02

CERT Advisory CA-97.08, Vulnerability in innd, http://www.cert.org/advisories/CA-97.08.innd.html

AUSCERT Advisory AA-96.19, INN parsecontrol Vulnerability, ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-96.19.INN.parsecontrol.vul

IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1997:002.1, Security vulnerability in "innd" (InterNetNews server), http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories


Dynamic Linker telnet vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: linkerbug
Platforms: IRIX, Linux, FreeBSD, NEC EWS-UX/V, NEC UP-UX/V, NEC UX/4800, NetBSD
Description:

Many telnet daemons offer the functionality of transferring environment variables from one system to the other. On systems that run these daemons and also provide support for shared object libraries, it could be possible to influence the login program called by the telnet daemon. Depending on the system's configuration, either a local or remote attacker could gain root on the affected system.
Remedy:

Determine if your telnet daemon uses the ENVIRON or NEW-ENVIRON options. If your daemon uses these options, you may be vulnerable. Immediately disable the telnet daemon or apply the wrapper provided by CERT until you can obtain a patch from your vendor.
References:

CERT Advisory CA-95.14, Telnetd Environment Vulnerability, http://www.cert.org/advisories/CA-95.14.Telnetd_Environment_Vulnerability.html

Silicon Graphics Inc. Security Advisory 19951101-01-P1010o1020, Telnetd vulnerability reported by MIT, ftp://sgigate.sgi.com/security/19951101-01-P1010o1020


Linux TFTP didn't restrict users to tftpboot directory, allowing remote retrieval of files

Risk Level: | High risk vulnerability High | Check or Attack Name: LinTftp
Platforms: | Linux, TFTP
Description: | Some older linux distributions did not correctly limit tftp access to the /tftpboot directory, allowing attackers to retrieve the passwd file as ../etc/passwd.
Remedy: | TFTP is rarely needed in most network configurations and should be disabled. If TFTP is required in your configuration, you should install a more recent version of the daemon or upgrade your OS's distribution.
References: | CERT Advisory CA-91.18, Active Internet tftp Attacks, http://www.cert.org/advisories/CA-91.18.Active.Internet.tftp.Attacks.html


NNTP posting

Risk Level: Low risk vulnerability Low

Check or Attack Name: nntppost
Platforms: Any
Description:

NNTP has been detected as running, and users can post to newsgroups without authorization. If the attacker has read access to the nntpd daemon, then your resources (and private company information, if your news server is for private newsgroups) may be obtained and used by unauthorized users. If posting access is allowed to the server, the NNTP server can be an access point for malicious users to post anonymous and possibly illegal information to the world from your computers.
Remedy:

Disable the NNTP daemon or restrict access to newsgroups.

Unix: To disable the NNTP daemon, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

To restrict access:

  1. Edit the /usr/lib/news/nntp_access file.
  2. Change the line starting with default to default no no.

Windows: To disable the NNTP service from Windows NT, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.


NNTP reading

Risk Level: Low risk vulnerability Low

Check or Attack Name: nntpread
Platforms: Any
Description:

NNTP has been detected as running, and users can read newsgroups without authorization. Your resources (and private company information, if your server is for private newsgroups) may be obtained and read by unauthorized users.
Remedy:

Disable the NNTP daemon or restrict access to newsgroups.

Unix: To disable the NNTP daemon, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
    2. Locate the line that controls the daemon.
  2. Type a # at the beginning of the line to comment out the daemon.
  3. Restart inetd.

—OR—

To restrict access:

  1. Edit the /usr/lib/news/nntp_access file.
  2. Change the line starting with default to default no no.

Windows: To disable the NNTP service from Windows NT, follow these steps:

  1. Open the Services control panel.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.


Windows NT telnet service installed

Risk Level: Low risk vulnerability Low

Check or Attack Name: telnet
Platforms: Windows NT
Description:

The Windows NT machine is running the Ataman telnet service. A user with a telnet client could potentially compromise the machine's security with a brute force password attack. Also, this service could potentially write sensitive information to the NT Application Log.

Remedy:

Check user passwords or disable the ataman service.

To check a user password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. Set the password values in accordance with your security policy.
  5. Click OK.

—OR—

To disable the FTP service, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Under Services, select ataman.
  3. Click Stop.


RIP tables modified

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: rip
Platforms: Any
Description:

The machine is vulnerable to false routing table information. RIP is a commonly used method for a local network to share routing information.

An attacker can inject false routing packets into the routing table on the host, forcing packets to be sent to the attacker’s machine for reading or modification. By sending forged RIP packets, an attacker can change the routing for a network connection, allowing sniffing, spoofing, hijacking, and dropping packets on the connection not originally going through a network. Vulnerable machines run non-authenticated RIP.
Remedy:

RIP is commonly used by the routed service. If you are using a simple gateway, you may be able to set a default route and not need to use routed. In cases where it is necessary to maintain a routing service on your network, the newer RIP-2 or OSPF routing protocols include a simple password scheme that will prevent machines outside of the network from being able to modify your routing tables. Contact your vendor for information on how to upgrade your routing protocol.
References:

Villanova University School of Law, Martin F. Noonan <mnoonan@www.vcilp.org>, An Analysis of the Security Risks Involved in Transmitting Credit Card Numbers Over the Internet; Security Issues Involved With RIP, http://www.law.vill.edu/chron/articles/iprtsec.html#secrip


Rlogin -froot command could allow remote root access

Risk Level: High risk vulnerability High

Check or Attack Name: rlogin
Platforms: Linux, AIX: 3.x
Description:

A vulnerability exists in the rlogin daemon of some AIX and Linux systems that could allow remote attackers to log in as root without being prompted for a password. By specifying the -froot option to rlogin, the server daemon will immediately drop the user into a root shell.
Remedy:

Disable rlogind in the /etc/inetd.conf file and restart the inetd process. AIX 3 users should retrieve APAR IX44254 from the IBM FixDist site at ftp://aix.boulder.ibm.com/aix/tools/fixdist/fixdist.html.
References:

CERT Advisory CA-94.09, /bin/login Vulnerability, http://www.cert.org/advisories/CA-94.09.bin.login.vulnerability.html

BUGTRAQ Mailing List, Mark G. Scheuern (mgscheue@vela.acs.oakland.edu), Re: -froot??? (AIX rlogin bug), http://geek-girl.com/bugtraq/1994_3/0100.html


Routed service active

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: routed
Platforms: Unix
Description:

The routed service was detected. This service provides an attacker your routing information. Routed accepts routing information from anyone, so it increases the possibility that an attacker can send false RIP packets, causing your data to be routed to the attacker's machine.
Remedy:

If you are using a simple gateway, use a default route. Most sites are connected through a single point of entry to the Internet with a simple infrastructure. These sites do not need to run routed.

To disable routed from running on a machine: Comment out routed from the /etc/inetd.conf file by putting a # at the beginning of the line and sending a HUP signal to the inetd (# kill -HUP <inetd.pid>).


Rsh vulnerable in hosts.equiv

Risk Level: | High risk vulnerability High | Check or Attack Name: rshequiv
Platforms: | Unix
Description: | Sites that have a '+' or other wildcard character in the hosts.equiv file can be accessed from remote without the attacker having to know any system passwords.
Remedy: | Modify your host's trust files to not include any wildcard characters. If possible, don't use Berkley-style trust relationships, but instead use a more secure solution, such as SSH.
References: | CERT Advisory CA-91.12, Trusted Hosts Configuration Vulnerability, http://www.cert.org/advisories/CA-91.12.Trusted.Hosts.Configuration.vulnerability.html


Rsh null vulnerable

Risk Level: | High risk vulnerability High | Check or Attack Name: rshnull
Platforms: | Unix
Description: | Older versions of the in.rshd daemon allowed users to log in as user NULL that, because of a flaw within the rusersok() function call, would grant access without proper authorization.
Remedy: | Disable the RSH service by commenting it out of the inetd.conf file and restarting the inetd process. If your configuration requires the use of RSH facilities, you should contact your vendor for patch information or install a RSH from a third party package.
References: |


Obsolete sshd 1.2.17 running

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Sshd1217
Platforms: Any
Description:

Internet Scanner detected an obsolete version of sshd, the secure shell remote login daemon. Sshd allows another computer to log in over a network, to execute commands from a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over insecure channels.

All versions of sshd less than version 1.2.17 have multiple vulnerability issues. Versions prior to 1.2.17 had problems with authentication agent handling on some machines. There is a chance that a malicious user could exploit a race condition to steal another user's credentials. This issue has been reported to be resolved in 1.2.17.
Remedy:

Upgrade sshd to version 1.2.17 or higher at http://www.cs.hut.fi/ssh.
References:

Thomas König's Web Site, The Ssh (Secure Shell) FAQ - Frequently asked questions, http://www.uni-karlsruhe.de/~ig25/ssh-faq/

Most UNIXes Bug List Page, ssh, http://oliver.efri.hr/~crv/security/bugs/mUNIXes/ssh2.html


Sshd version 1.2.23 obsolete

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Sshd 1223 Check
Platforms: SSH
Description:

An obsolete version of the SSH secure shell daemon, sshd version 1.2.23, has been detected. Sshd allows another computer to log in over a network, execute commands from a remote machine, and move files from one machine to another. It provides strong authentication and secure communications over insecure channels.

All versions of sshd less than version 1.2.23 have multiple security weaknesses. Specifically, versions prior to 1.2.23 are vulnerable to attacks where sshd can be forced to execute arbitrary commands. This vulnerability allows an attacker to execute arbitrary commands on the SSH server or otherwise subvert an encrypted SSH channel with arbitrary data. This issue has been reported to be resolved in sshd version 1.2.25.
Remedy:

Upgrade sshd servers and clients.

Unix: The latest version of ssh is available from ftp://ftp.cs.hut.fi/pub/ssh/.

Windows, Unix, Macintosh: F-Secure SSH version 1.3.5 fixes this security problem. If you are using the commercial Data Fellows' SSH package and you have a support contract, you can obtain v1.3.5 from your local retailer. Users without a support contract can obtain a patch that fixes this problem from http://www.DataFellows.com/fsecure/support/ssh/bug/su134patch.html.
References:

Data Fellows Web Site, F-Secure SSH Tunnel&Terminal, http://www.datafellows.com/f-secure/fclintp.htm

CORE SDI R+D Lab, Secure Shell Insertion Attack, http://www.core-sdi.com/CoreLabs/english/ssh/index.html

Thomas König's Web Site, The Ssh (Secure Shell) FAQ - Frequently asked questions, http://www.uni-karlsruhe.de/~ig25/ssh-faq/


Sshd advertises information

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SshdInfo
Platforms: | Any
Description: | In the process of communicating with clients, a sshd will advertise its version, its public keys, its supported authentication methods, and its supported ciphers. Attackers have been known to check this information in order to mount a more directed, precise attack on a network.
Remedy: | There is no fix available for this issue.
References: |


SSH .rhosts weak authentication

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: SshdRhosts
Platforms: | Any
Description: | The SSH server on this machine supports Berkeley .rhosts style authentication. This form of authentication relies on trusted host names and is defeatable by DNS cache poisoning and IP spoofing.
Remedy: | If SSH is already installed, disable .rhosts authentication and use only RSA and RHOSTS-RSA.
References: |


TFTP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: tftp
Platforms: TFTP, Solaris: 2.5.1
Description:

TFTP was detected. TFTP has no authentication process for letting file transfers take place. An attacker can gain access to the password file.
Remedy:

Unix: Comment out the tftp entry in /etc/inet.conf to disable TFTP entirely, or change the entry to restrict TFTP from accessing all world-readable files. Then restart inetd.

References:

CERT Advisory CA-89.05, DEC/Ultrix 3.0 Systems, http://www.cert.org/advisories/CA-89.05.ultrix3.0.hole.html

CERT Advisory CA-91.18, Active Internet tftp Attacks, http://www.cert.org/advisories/CA-91.18.Active.Internet.tftp.Attacks.html


UUCP available

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: uucp
Platforms: | Unix, Solaris: 2.5.1
Description: | UUCP was found. This may pose a security risk due to possible vulnerabilities, and should only be run if required at your site.
Remedy: | Disable uucp by commenting out the uucp line in inetd.conf. Kill the inetd process and then restart it.
References: | CERT Advisory CA-92.06, AIX uucp Vulnerability, http://www.cert.org/advisories/CA-92.06.AIX.uucp.vulnerability.html


Identd remote execution via sendmail

Risk Level: Low risk vulnerability Low

Check or Attack Name: identd
Platforms: Unix
Description:

An identd response has been detected, indicating that the identd daemon was detected and this exploit was attempted.

Remedy:

Ask your vendor for the latest sendmail patches or upgrade to the latest version of sendmail.
References:

CERT Advisory CA-96.20, Sendmail Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-96.20.sendmail_vul

CERT Advisory CA-96.20, Sendmail Vulnerabilities, http://www.cert.org/advisories/CA-96.20.sendmail_vul.html

Sendmail Consortium, Sendmail FAQ, http://www.sendmail.org/faq

Sendmail Consortium, Recent sendmail versions, http://www.sendmail.org

Sendmail Consortium, Recent sendmail versions, ftp://ftp.cs.berkeley.edu/ucb/sendmail


SMTP host possibly vulnerable

Risk Level: Low risk vulnerability Low

Check or Attack Name: identdresp
Platforms: Any
Description:

An identd response was detected, indicating that this exploit was attempted and the identd daemon was detected.

Remedy:

Ask your vendor for sendmail patches, or upgrade to the latest version of Sendmail.
References:

CERT Advisory CA-96.20, Sendmail Vulnerabilities, http://www.cert.org/advisories/CA-96.20.sendmail_vul.html

CERT Advisory CA-96.20, Sendmail Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-96.20.sendmail_vul

Sendmail Consortium, Sendmail FAQ, http://www.sendmail.org/faq

Sendmail Consortium, Sendmail recent versions, http://www.sendmail.org

Sendmail Consortium, Sendmail recent versions, ftp://ftp.cs.berkeley.edu/ucb/sendmail


Popd buffer overflow vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: popimap
Platforms: Post Office Protocol (POP)
Description:

A vulnerability exists in both the University of Washington's and Mark Crispin's POP3 implementation that could allow a remote attacker to gain unauthorized root access. This same vulnerability affects the IMAP servers shipped with these packages.
Remedy:

Immediately disable the POP3 (and IMAP) server on your systems and obtain the latest version of POP3.
References:

CERT Advisory CA-97.09, Vulnerability in IMAP and POP, http://www.cert.org/advisories/CA-97.09.imap_pop.html

CERT Advisory CA-97.09, Vulnerability in IMAP and POP, http://www.cert.org/ftp/cert_advisories/CA-97.09.imap_pop

University of Washington, UW IMAP Information Center, http://www.washington.edu/imap/

SNI Security Advisory #21, Buffer Overflow in imapd and ipop3d, http://www.nai.com/nai_labs/asp_set/advisory/21_imap_adv.asp

Silicon Graphics Inc. Security Advisory 19980302-01-I, IMAP/POP Vulnerability, ftp://sgigate.sgi.com/security/19980302-01-I


Files obtained

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: filesgrabbed
Platforms: Any
Description:

Specific files were obtained through various vulnerabilities. This check allows an administrator to quickly check these critical files for misconfigurations.

Vulnerabilities that can result in sensitive files being obtained include:

  • Brute force methods
  • TFTP (Trivial File Transfer Protocol) checks
  • Anonymous FTP
  • NFS Access Files
  • Rsh
  • Sendmail Remote Execution
Remedy:

View the reports to correct vulnerabilities obtained for the following types of files:

  • ftp
  • rexec
  • rlogin
  • rsh
  • telnet
  • tftp
  • nis


Finger output from common names

Risk Level: Low risk vulnerability Low

Check or Attack Name: Finger Names
Platforms: Any
Description:

Information was obtained by fingering common names. This information is useful to an attacker, especially when attempting to breach a system by social engineering.

Warning: NIS Servers under all versions of Sun Solaris may become slow when a finger names is in progress, possibly preventing user logins. Do not run a finger names on Solaris machines that run NIS. For more information, see the ISS Security Alert Advisory listed in the references.
Remedy:

Disable finger, or install a finger daemon that limits the type of information provided.

Unix: Disable the finger daemon, or configure the type of information available from finger. Unix systems can use GNU finger available from ftp://prep.ai.mit.edu/pub/gnu/finger-1.37.tar.gz.

To disable the finger daemon started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

For more information on GNU finger, see ftp://prep.ai.mit.edu/pub/gnu/finger-1.37.tar.gz.

Windows: The finger service is not native to Windows, but may be present.

Note: The finger service may be included as part of another application, such as Netscape Mail Server.

WARNING: Repeated use of finger can cause a machine to become overloaded, which can cause it to stop responding. An attacker can use this susceptibility to disrupt the network.

To stop or disable the service in Windows NT, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.
References:

CERT Advisory CA-91.04, Social Engineering, http://www.cert.org/ftp/cert_advisories/CA-91:04.social.engineering

CERT Advisory CA-91.04, Social Engineering, http://www.cert.org/advisories/CA-91.04.social.engineering.html

ISS Security Advisory #2, Distributed DoS Attack against NIS/NIS+ based networks, http://xforce.iss.net/alerts/advise2.php3


Stock fingerd running

Risk Level: Low risk vulnerability Low

Check or Attack Name: Finger Output
Platforms: Finger Service
Description:

The finger service or daemon was detected as running. Finger can give an attacker information, such as login accounts and trusted hosts.

Remedy:

Disable finger, or install a finger daemon that limits the type of information provided.

Unix: Disable the finger daemon, or configure the type of information available from finger. Unix systems can use GNU finger available from ftp://prep.ai.mit.edu/pub/gnu/finger-1.37.tar.gz.

To disable the finger daemon started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

For more information on GNU finger, see ftp://prep.ai.mit.edu/pub/gnu/finger-1.37.tar.gz.

Windows: The finger service is not native to Windows, but may be present.

Note: The finger service may be included as part of another application, such as Netscape Mail Server.

WARNING: Repeated use of finger can cause a machine to become overloaded, which can cause it to stop responding. An attacker can use this susceptibility to disrupt the network.

To stop or disable the service in Windows NT, follow these steps:

  • Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  • Select the service.
  • Click Stop.
  • When the service has stopped, click Startup.
  • Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  • Click OK, then click Close.
            •


Ident daemon can be used to remotely gather the username's system servers run under

Risk Level: | Low risk vulnerability Low | Check or Attack Name: IdentdUsers
Platforms: | Unix
Description: | The ident daemon is intended to advertise the username of a machine's clients to remote servers. Many identds will also advertise the usernames of local servers to remote clients. This allows attackers to better understand your system configuration.
Remedy: | Disable the ident daemon if it is not used on your system(s). If ident is used, you should upgrade to a more recent ident daemon that doesn't report the usernames of local servers.
References: | BUGTRAQ Mailing List, ident-scan, http://www.netspace.org/cgi-bin/wa?A2=ind9602C&L=bugtraq&P=R2


Traceroute can be used to map network topologies

Risk Level: Low risk vulnerability Low

Check or Attack Name: traceroute
Platforms: Any
Description:

Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly, an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall. This information may allow an attacker to determine trusted routers and other network information.

False Positives: If traceroute is active on an internal network, this message does not represent a vulnerability. If tracerouting is possible through the firewall, your network is vulnerable.
Remedy:

Prevent or limit external tracerouting into internal networks via packet filtering.

Unix: The Unix version of the Scanner uses UDP packets to conduct a traceroute. Disallow incoming UDP packets with high-numbered destination ports. For more information, refer to your firewall documentation. ICMP packets are not found by Unix.

Windows NT: The NT version of the Scanner uses ICMP to conduct a traceroute. Disallow incoming ICMP packets with high-numbered destination ports. For more information, refer to your firewall documentation. UDP packets are not found by NT.

Note: Because the Unix and NT versions of the Scanner use different methods for traceroute, this vulnerability may occasionally be found by one version of the Scanner and not the other.


Whois information

Risk Level: | Low risk vulnerability Low | Check or Attack Name: Whois
Platforms: | Any
Description: | This check obtains information on your target domain using the whois database. Whois information can be used to mount a more precise attack on the target network.
Remedy: | Do not include sensitive information in your whois database entry.
References: |


Linux NIS could treat '+' user as a normal login account

Risk Level: | High risk vulnerability High | Check or Attack Name: LinPlus
Platforms: | Linux
Description: | Some older Linux distributions had a faulty yp/NIS implementation, resulting in the yp/NIS binding user (the + account) being treated as a normal account.
Remedy: | Upgrade your Linux distribution to the current version. Upgrading just your kernel is not sufficient.
References: |


User account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: accountblankpw
Platforms: Windows NT
Description:

An account has been detected with a blank password. Some vendors ship Windows NT pre-installed with a blank password on the Administrator or other user accounts. This misconfiguration is an extremely high risk vulnerability, and should be corrected immediately.

This vulnerability is typically detected on a machine where there is also no minimum password length required. If the Guest account has a blank password, it will allow anyone to log in with any user name and a blank password. If the file and registry permissions are not very tightly restricted, this situation can give any attacker the ability to access sensitive information and systems.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed:

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to disable the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


User account has a password the same as the account name

Risk Level: High risk vulnerability High

Check or Attack Name: accountuserpw
Platforms: Windows NT
Description:

A User account with the password set to the account name was detected. An attacker could use this account to gain access to sensitive information.
Remedy:

Set the user password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. Under Minimum Password Length, configure at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.


Inappropriate user with Add Workstations to Domain privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Add Workstation Privilege
Platforms: Windows NT
Description:

A user has been detected with the Add Workstations to Domain privilege. This right allows users to add computers to the domain database in Server Manager, and is normally only granted to Domain Administrators.
Remedy:

In Windows NT Workstation, check advanced user rights for Add workstations to domain. Remove any names that are disallowed by your security policy.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Add workstations to domain.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.

—OR—

In Windows NT Server, check user rights for Add workstations to domain. Remove any names that are disallowed by your security policy.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Add workstations to domain.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q139365, Capabilities of the "Add Workstations To Domain" Right, http://support.microsoft.com/support/kb/articles/q139/3/65.asp


Administrator account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: adminblankpw
Platforms: Windows NT
Description:

An administrator account with no password was detected. Some vendors ship Windows NT pre-installed with no password on the Administrator or other user accounts. This misconfiguration is an extremely high risk vulnerability, and should be corrected immediately.

This vulnerability is typically detected on a machine where there is also no minimum password length required. If the file and registry permissions are not very tightly restricted, this situation can give any attacker the ability to access sensitive information and systems.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.
References:

Microsoft Knowledge-Pak Desktop Suite, How to: Set minimum password length policy, http://support.microsoft.com/support/ntserver/serviceware/nts40/e9mse5z47.asp


Administrator has no password

Risk Level: High risk vulnerability High

Check or Attack Name: adminnopw
Platforms: Windows NT
Description:

An Administrator account with no password has been detected. Some vendors ship Windows NT pre-installed with no password on the Administrator account. An attacker could use the Administrator account to gain unlimited access and take control of the host. The attacker also has access to other systems where this Administrator account is valid. If the Domain Administrator account is compromised, then the attacker has unlimited access to every workstation in the domain.
Remedy:

Set the Administrator password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.
  6. From the User menu, select Properties to display the User Properties dialog box.
  7. Type and confirm a non-trivial password.
  8. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Administrator username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: adminuserpw
Platforms: Windows NT
Description:

The Administrator account has the password set to the account name. Windows NT 4.0 Service Pack 2 (SP2) contains a password filter that can be installed, and Service Pack 3 allows checking of dictionary passwords. It is strongly recommended that non-trivial passwords be used.
Remedy:

Windows NT 4.0 Service Pack 2 (SP2) or Service Pack 3 (SP3) includes a password filter (PASSFILT.DLL) that allows system administrators to increase password strength. This filter is copied to %system root%\SYSTEM32 when the Service Pack is installed on the system. In networked environments, the password filter should be copied to the primary domain controller for the domain, and to any backup domain controllers in the event the server role in the domain changes.

—AND—

Set the administrator password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length at least seven characters.
  5. Click OK.
  6. From the User menu, select Properties to display the User Properties dialog box.
  7. Type and confirm a non-trivial password.
  8. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the new password.
  6. Click OK.
References:

Microsoft Knowledge Base Article Q152841, Windows NT 4.0 Service Pack 3 Readme.txt File (40-bit), http://support.microsoft.com/support/kb/articles/Q152/8/41.asp

Microsoft Knowledge Base Article Q147798, Windows NT 4.0 Service Pack 3 Readme.txt File (128-bit), http://support.microsoft.com/support/kb/articles/Q147/7/98.asp

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/ntserver/serviceware/10141574.asp


Altered system value

Risk Level: High risk vulnerability High

Check or Attack Name: Altered System Value
Platforms: Windows NT
Description:

The System value under the Winlogon registry key has been altered. This value regulates which processes are started by the system during the boot process. Any process listed in this value will run under the user context of LocalSystem, and can be used to add administrator users, or alter any aspect of the operating system. If this value has been altered by an attacker, the system should be viewed as compromised and reloaded from known media.
Remedy:

Determine if this value has been legitimately altered, or if you detect evidence of an attacker. Recommended permissions are Administrators - Full Access, System - Full Access, and Everyone - Read Access.

Altering this key requires either physical access, or a Server Operator or Administrator level account. If an intruder is involved, consider this machine (and if it is a domain controller, the domain) compromised. If you believe that this computer's security is compromised:

  1. Immediately remove the computer from the network.
  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.
  3. Perform a low-level format of all hard drives on the computer.
  4. Reinstall the operating system.
  5. Configure the computer with the original user names, groups, and applications.
  6. Run Internet Scanner to determine vulnerabilities, and resolve detected vulnerabilities.
  7. Before using the files on the backup, scan all files using an up-to-date antivirus program, and copy only the files you know to be authorized on that computer.
  8. Reconnect the computer to the network.


Autologon is enabled

Risk Level: High risk vulnerability High

Check or Attack Name: autologon
Platforms: Windows NT
Description:

Autologon is enabled. An attacker can access the host as DefaultUser, with the password DefaultPassword.

Remedy:

Disable autologon and apply the latest Windows NT 4.0 Service Pack.

To disable autologon, follow these steps:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. Open the Registry Editor (regedt32). From the Windows NT Start menu, select Run.
  2. Type regedt32 and click OK.
  3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  4. Delete the AutoAdminLogon and DefaultPassword values.

—AND—

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.


Critical key permissions incorrect

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Critical Key Permissions
Platforms: Windows NT
Description:

A registry key that can lead to higher access levels is writable by non-administrators. Each of these keys can be used to insert a Trojan horse program that is then invoked when another user logs in. The AeDebug key can be used to directly gain higher access if the attacker can cause a service running at a privileged user level to crash.

The vulnerable keys under HKEY_LOCAL_MACHINE are:

  • Software\Microsoft\Windows\CurrentVersion\Run
  • Software\Microsoft\Windows\CurrentVersion\RunOnce
  • Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  • Software\Microsoft\Windows NT\CurrentVersion\AeDebug
  • Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Remedy:

Set permissions on each of these keys. Grant Administrators and System users full access, and Everyone read access. To set key permissions, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the registry key listed in the description.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Examine the permissions for the following characteristics:
    • Verify that Administrator and System are Full Access.
    • Verify that Everyone is Read access.
    • Remove unauthorized names, or change the Type of Access to Read.
  5. Click OK when you have completed setting the permissions.
  6. Repeat steps 2 to 5 for all the keys listed above.


FPNWCLNT.DLL not found

Risk Level: High risk vulnerability High

Check or Attack Name: fpnwclnt
Platforms: Windows NT
Description:

The registry key that governs alternate security providers refers to a password processing library that does not exist. If a user has the right to change the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key, then a DLL file can be installed that allows all password changes to be written to cleartext, or even transmitted off site.

Microsoft shipped Windows NT 4.0 Workstation with the Notification Packages registry key set to FPNWCLNT, which allows any user with write permissions to the %systemroot%\system32 directory to insert a DLL that can process password changes. If the FPNWCLNT.DLL file is detected, then its size is verified as the correct size.
Remedy:

Restrict permissions on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key to be written only by the System and Administrators:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To restrict registry access, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—AND—

If the Notification Packages subkey is present, determine if an unauthorized security provider has been installed. If you detect an unauthorized security provider, then this machine should be considered compromised.

—AND—

Choose one of the following options:

  • If the Notification Packages subkey is present and your machine is using FPNW or DSMN, make sure Fpnwclnt.dll in the %SystemRoot%\System32 folder is the version that ships with Windows NT 4.0 Service Pack 3 (05/01/97, 35,088 bytes) and that the NTFS access control list only permits access by administrators and the system.
  • If the Notification Packages subkey is present and FPNWCLNT.DLL is not being used, remove the FPNWCLNT string from this subkey.

To disable FPNWCLNT.DLL, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
  3. Double-click the Notification Packages value.
  4. If the FPNWCLNT string is present, highlight and delete it.
References:

Microsoft Knowledge Base Article Q99885, Security Issues Occur Due to How WinNT Handles FPNWCLNT.DLL, http://support.microsoft.com/support/kb/articles/q99/8/85.asp


FPNWCLNT.DLL has incorrect checksum

Risk Level: High risk vulnerability High

Check or Attack Name: fpnwclnt checksum
Platforms: Windows NT
Description:

The registry key that governs alternate security providers has been altered. If a user has the right to change the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key, then a DLL file can be installed that allows all password changes to be written to plaintext, or even transmitted off site.

Microsoft shipped Windows NT 4.0 Workstation with the Notification Packages registry key set to FPNWCLNT, which allows any user with write permissions to the %systemroot%\system32 directory to insert a DLL that can process password changes. If the FPNWCLNT.DLL file is detected, then its size is verified as the correct size.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, convert to NTFS, verify the ACL allows proper access, and make sure all values for password filter packages are legitimate. Set registry permissions properly. If an unauthorized security provider has been installed, remove FPNWCLNT or validate the FPNWCLNT.DLL.

To apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—AND—

If using a FAT (File Allocation Table) based system, convert to NTFS:

  1. Open a command-line window. From the Windows NT Start menu, select Run, type cmd, and click OK.
  2. Type: convert c: /fs:ntfs and press Enter.
  3. When the command has completed, reboot your system.
  4. From a command line, run chkdsk to make sure no errors are present.

—AND—

Restrict permissions on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key to be written only by the System and Administrators.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To restrict registry access:

  1. Open Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—AND—

To verify password filter packages:

  1. Open Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/Notification Packages key.
  3. Verify that all values in this key are for password filter packages that Setup intended to install.

If the Notification Packages subkey is present, determine if an unauthorized security provider has been installed. If you detect an unauthorized security provider, then this machine should be considered compromised.

If you use FPNW or DSMN, validate the version of FPNWCLNT.DLL dated 05/01/97 at 35,088 bytes.

—OR—

If you do not use FPNW or DSMN, remove the FPNWCLNT value:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/Authentication Packages key.
  3. Select the FPNWCLNT value and click Delete.
  4. Verify the deletion.
References:

Microsoft Knowledge Base Article Q99885, Security Issues Occur Due to How WinNT Handles FPNWCLNT.DLL, http://support.microsoft.com/support/kb/articles/q99/8/85.asp


FPNWCLNT.DLL incorrect size

Risk Level: High risk vulnerability High

Check or Attack Name: fpnwclnt incorrect
Platforms: Windows NT
Description:

The registry key that governs alternate security providers has been altered. If a user has the right to change the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key, then a DLL file can be installed that allows all password changes to be written to plaintext, or even transmitted off site.

Microsoft shipped Windows NT 4.0 Workstation with the Notification Packages registry key set to FPNWCLNT, which allows any user with write permissions to the %systemroot%\system32 directory to insert a DLL that can process password changes. If the FPNWCLNT.DLL file is detected, then its size is verified as the correct size.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, convert to NTFS, verify the ACL allows proper access, and make sure all values for password filter packages are legitimate. Set registry permissions properly. If an unauthorized security provider has been installed, remove FPNWCLNT or validate the FPNWCLNT.DLL.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—AND—

If using a FAT (File Allocation Table) based system, convert to NTFS:

  1. Open a command-line window. From the Windows NT Start menu, select Run, type cmd, and click OK.
  2. Type: convert c: /fs:ntfs and press Enter.
  3. When the command has completed, reboot your system.
  4. From a command line, run chkdsk to make sure no errors are present.

—AND—

Restrict permissions on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key to be written only by the System and Administrators.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To restrict registry access:

  1. Open the Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—AND—

To verify password filter packages:

  1. Open the Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/Notification Packages key.
  3. Verify that all values in this key are for password filter packages that Setup intended to install.

If the Notification Packages subkey is present, determine if an unauthorized security provider has been installed. If you detect an unauthorized security provider, then this machine should be considered compromised.

If you use FPNW or DSMN, validate the version of FPNWCLNT.DLL dated 05/01/97 at 35,088 bytes.

—OR—

If you do not use FPNW or DSMN, remove the FPNWCLNT value:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/Authentication Packages key.
  3. Select the FPNWCLNT value and click Delete.
  4. Verify the deletion.
References:

Microsoft Knowledge Base Article Q99885, Security Issues Occur Due to How WinNT Handles FPNWCLNT.DLL, http://support.microsoft.com/support/kb/articles/q99/8/85.asp


GetAdmin patch not applied

Risk Level: High risk vulnerability High

Check or Attack Name: getadmin
Platforms: Windows NT
Description:

The version of Windows NT is vulnerable to the GetAdmin exploit, allowing a local user to obtain administrator privileges by running getadmin.
Remedy:

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must apply the post-SP3 getadmin patch. For the patch and the Knowledge Base Article, see ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/getadmin-fix/.
References:

Microsoft Knowledge Base Article Q146965, GetAdmin Utility Grants Users Administrative Rights, http://support.microsoft.com/support/kb/articles/q146/9/65.asp


LSA registry key altered

Risk Level: High risk vulnerability High

Check or Attack Name: ntpwdll
Platforms: Windows NT
Description:

This system was found with an altered LSA registry key. This setting may allow access in plaintext to all new passwords. Changing passwords or adding users calls the security provider with the userid and plaintext password. If an unauthorized security provider has been installed, all accounts information may have been re-routed in plaintext to an unauthorized location.
Remedy:

Set write permissions to Administrators or System, or remove the FPNWCLNT.DLL security provider program.

To set permissions for the ACL key, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/ registry key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Verify that the permissions only allow write access to Administrators and System.

—OR—

To remove the FPNWCLNT value, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa/Authentication Packages registry key.
  3. Click the FPNWCLNT value and click Delete.
  4. Verify the deletion.


POSIX subsystem enabled

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Posix Enabled
Platforms: Windows NT
Description:

The POSIX subsystem is enabled. Enabling the POSIX subsystem can subject a host to Trojan Horse attacks, since it is possible to create a file with a lowercase name that will be detected in a search prior to a file with an uppercase name.
Remedy:

Change the registry to remove access to the POSIX subsystem and remove the file that controls the POSIX subsystem.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To remove the POSIX subsystem from Windows NT, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems key.
  3. Locate the Posix value.
  4. Write down the file name that is referenced by the value's data.
  5. Delete the registry value.

To remove the files associated with the POSIX subsystem, follow these steps:

  1. Open Windows NT Explorer or My Computer.
  2. Using the path and file name you noted in step 4 above, delete the file that used to be referenced by the registry.
References:

Microsoft Knowledge Base Article Q101270, Disabling the POSIX Subsystem, http://support.microsoft.com/support/kb/articles/q101/2/70.asp


Account management auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Account Management Audit
Platforms: Windows NT
Description:

Account Management Auditing is not enabled. Account Management auditing records when new users and groups are created or changed. Since these events are highly sensitive, we recommend always auditing these events. These events appear in the Event Viewer Security Log.
Remedy:

Enable User and Group Management auditing.

To enable auditing, follow these steps:

  1. Open the User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Select Audit these events. The audit choices are enabled.
  5. From the User and Group Management field, select the Failure or Success check boxes.
  6. Click OK.


Windows NT default Administrator User ID exists

Risk Level: Low risk vulnerability Low

Check or Attack Name: adminexists
Platforms: Windows NT
Description:

An account named Administrator was found. This default account cannot be locked out by too many incorrect login attempts, and can be vulnerable to a brute force attack if a poor password is chosen.

Remedy:

Rename the Administrator account, create a new Administrator account with only Guest access, remove network access for administrator, and monitor against logon attempts.

To rename the Administrator account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the User menu, select Rename to display the Rename dialog box.
  4. In the Change to field, type the new name of the Administrator account and click OK.

—AND—

To create a new Administrator account:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the User menu, select New User to display the New User dialog box.
  3. In the Username field, type a new user named Administrator.
  4. In the Password field, type a new password for the Administrator account.
  5. In the Confirm Password field, confirm the new password.
  6. Click Groups to display the Group Memberships dialog box.
  7. Verify Administrator is only a member of the Guest group.
  8. Click OK twice to close both the Group Memberships and New User dialog boxes.

—AND—

To remove network access for Administrator, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account from the list.
  3. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  4. From the Right list, select Access this computer from network.
  5. From the Grant to list, select the user account and click Remove.
  6. Click OK.

—AND—

To enable auditing for logon attempts, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Audit to display the Audit Policy dialog box.
  3. Select Audit these events. The audit choices are enabled.
  4. From the Logon and Logoff field, select the Failure check box or the Success check box.
  5. Click OK.
  6. Open the Event Viewer. From the Windows NT Start menu, select Programs, Administrative Tools (Common), Event Viewer.
  7. From the Log menu, select Security.
  8. Carefully monitor attempts to log in as Administrator.


CD-ROM available to all users

Risk Level: Low risk vulnerability Low

Check or Attack Name: Allocate CDRoms
Platforms: Windows NT
Description:

The CD-ROM is available to all users on the system. For best security practice, the CD-ROM should only be available to the user who is logged on at the console.
Remedy:

Edit the registry so that the CD-ROM is available only to the currently logged on user:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run. Type regedt32 and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon registry key.
  3. From the Edit menu, select Add Value to display the Add Value dialog box.
  4. Create a value named AllocateCDRoms with type REG_SZ.
  5. Click OK to display the String Editor.
  6. In the String field, type a value of 1 and click OK.
  7. Reboot your computer for this setting to take effect.


Allocate floppy

Risk Level: Low risk vulnerability Low

Check or Attack Name: Allocate Floppy
Platforms: Windows NT
Description:

The floppy drive is available to all users. For best security practice, the floppy drive should only be available to the user who is logged on at the console.
Remedy:

Edit the registry so that the floppy drive is available only to the currently logged on user. To edit the registry, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run, and type regedt32.
  2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
  3. From the Edit menu, select Add Value to display the Add Value dialog box.
  4. Create a value named AllocateFloppies with type REG_SZ.
  5. Click OK to display the String Editor.
  6. In the String field, type a value of 1 and click OK.
  7. Reboot your computer for this setting to take effect.


Backup domain controller identified

Risk Level: Low risk vulnerability Low

Check or Attack Name: Backup Domain Controller
Platforms: Windows NT
Description:

This machine has been identified as a backup domain controller (BDC). This information could be used by an attacker to focus on domain-wide structured attacks.

False Positives: If this machine is inside the firewall, then this vulnerability is purely informational.
Remedy:

If NetBIOS ports are available, then determining if a host is a domain controller cannot be prevented. If the BDC is outside of a firewall, filter ports 135 through 139.


Guest account enabled

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: guestenabled
Platforms: Windows NT
Description:

The Guest account is enabled. A Guest account typically has too much access to the computer, since Guest is a member of the Everyone group.
Remedy:

Disable the Guest account using User Manager.

To disable the Guest account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account.
  3. From the User menu, click Properties to display the User Properties dialog box.
  4. Select the Accounts Disabled check box.
  5. Click OK.


Logon and Logoff auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Logon Audit
Platforms: Windows NT
Description:

Logon and Logoff auditing is not enabled. It is important to audit logon and logoff success and failure to be able to detect and track unauthorized access attempts.
Remedy:

Enable Logon and Logoff auditing.

To enable auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Select Audit these events. The audit choices are enabled.
  5. From the Logon and Logoff field, select the Failure check box or the Success check box.
  6. Click OK.


File and object access auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Object Audit
Platforms: Windows NT
Description:

File and Object Access Auditing is not enabled. Auditing tracks access to files, directories, registry keys, and other objects (such as printers). Auditing of these events must be enabled both by the security descriptor on the object and in the auditing settings. These events appear in the Event Viewer Security Log.
Remedy:

Enable File and Object Access Auditing and edit the auditing settings for selected directories, files, or other objects.

Note: Object auditing is available only to NTFS objects, not FAT objects. Auditing object access demands large amounts of computing overhead, especially if the object monitored (such as a file or directory) is frequently accessed.

To implement File and Object Access Auditing at the system level, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Choose Audit these events. The audit choices are enabled.
  5. From the File and Object Access field, select the Failure check box or the Success check box.
  6. Click OK.

Note: File and Object Access auditing will produce numerous log entries, most of which are benign. In addition, auditing several objects can degrade system performance. Auditing only occurs on objects that have been marked for auditing. To audit events, implement File and Object Access Auditing at the object level, follow these steps:

  1. Using My Computer or Windows NT Explorer, go to the object that you want to audit.
  2. Right-click the object and select Properties to display the Properties dialog box.
  3. Click the Security tab.
  4. Click Auditing to display the File Auditing, Directory Auditing, or Printer Auditing dialog box.
  5. Select one of these choices:
    • To add a new user or group name, click Add. Add the names from the Add Users and Groups dialog box.
    • To modify auditing, select the name and the Success and Failure audits that are required for your security policy.
    • To remove auditing, select the name and click Remove.
  6. Click OK twice to apply the changes.


Policy change auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Policy Audit
Platforms: Windows NT
Description:

Policy Change Auditing is not enabled. Policy auditing records when security policy changes are made. Since these events have a significant impact on the host and the network, ISS recommends always auditing these events. These events appear in the Event Viewer Security Log.
Remedy:

Enable Security Policy Changes auditing.

To enable auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Enable Security Policy Changes auditing on Success and Failure.
References:

Microsoft Knowledge Base Article Q174074, Security Event Descriptions, http://support.microsoft.com/support/kb/articles/q174/0/74.asp


Privilege auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Privilege Audit
Platforms: Windows NT
Description:

Privilege Auditing is not enabled. Privilege auditing records when any user rights (such as the right to backup and restore files) are granted to a user or process. These events appear in the Event Viewer Security Log.
Remedy:

Enable Use of User Rights auditing.

To enable auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Enable Use of User Rights auditing on Success and Failure.


Process auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Process Audit
Platforms: Windows NT
Description:

Process Auditing is not enabled. Process auditing records when processes are started and stopped. Auditing these events typically produces a large number of log entries, and is not normally enabled. These events appear in the Event Viewer Security Log.
Remedy:

Enable Process Tracking auditing.

To enable auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Enable Process Tracking auditing on Success and Failure.


System auditing not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: System Audit
Platforms: Windows NT
Description:

System Event Auditing is not enabled. System events include logging shutdowns and restarts, in addition to events affecting system security. Without System Event Auditing, there would be no record of when the host was started or stopped. These events appear in the Event Viewer Security Log.
Remedy:

Enable Restart, Shutdown, and System auditing.

To enable auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Enable Restart, Shutdown, and System auditing on Success and Failure.


Alerter service

Risk Level: Low risk vulnerability Low

Check or Attack Name: alerter
Platforms: Windows NT
Description:

The alerter service was detected as running. The Windows NT alerter service lets a user send pop-up messages to other users.

A network administrator may consider this ability as an unnecessary risk because these types of services have been used in social engineering attacks. Some users may respond to a request to change their password, create a share, or otherwise open holes in the network. A side effect of running this service is that it causes the current user name to be broadcasted in the NetBIOS name table, giving an attacker a valid user name to use in brute force attempts.
Remedy:

Disable the Alerter service.

To disable the alerter service, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the Alerter service and click Stop.
  3. To permanently disable the service, click Disabled.


System allocates ports in a sequential or predictable order

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: seqport
Platforms: Any
Description:

The machine is allocating TCP port numbers in a predictable or sequential order. An attacker can spoof, intercept, and hijack your connection, issuing any series of commands as if it were coming from your machine. This type of attack circumvents FTP security.

This vulnerability was generated by connecting to the remote machine's FTP server and issuing a number of PASV (passive mode) commands, requesting that the remote FTP server allocate the data channel port (in contrast to normal active mode operation, in which the FTP client allocates the data channel port). For each PASV command, the FTP server communicates the allocated port number back to the client. The allocated port number makes it possible to check for a predictable port allocation sequence.

Remedy:

Many operating systems do not have the option to change the port range or randomize the port assignment. Following are reports from different vendors addressing the problem:

Microsoft as of Windows NT SP4 has claimed to have corrected this problem. See Knowledge Base Article Q192292 for more information.

Some Linux, FreeBSD, and NetBSD operating systems allow you to select a port range, but do not randomize the port assignments.

Digital Unix 4.x and OpenBSD explicitly allow you to select a port range and randomize the port assignment.


SNMP can reveal possibly sensitive information about hosts

Risk Level: Low risk vulnerability Low

Check or Attack Name: snmp
Platforms: SNMP
Description:

The SNMP service was detected as running. An attacker can use SNMP (Simple Network Management Protocol) to gain valuable information about the machine (such as information on network devices, current open connections, etc.) when SNMP uses default words, such as public or private, for the community word. If no community is specified, then the SNMP server responds to queries from any machine.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names. If SNMP is not required, disable the service:

Windows: To disable SNMP:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select the SNMP service.
  3. Click Stop.

Unix: Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol, ftp://ftp.isi.edu/in-notes/rfc1157.txt


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 107 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Backdoors
Active Modem | Modem detected and active
BackOrifice | Back Orifice default installation
Fsp | FSP daemon running
NetBus | NetBus trojan horse allows complete remote control of Windows systems
PortdCheck | Portd running
Browser
IE ActiveX execution | Internet Explorer allows ActiveX controls to be automatically executed
IE accept cookies | Internet Explorer accept cookies warning disabled
IE active content | Internet Explorer has low active content security enabled
IE active download | Internet Explorer allows active content to be automatically downloaded
IE active scripting | Internet Explorer active scripting is enabled
IE cached pages | Internet Explorer allows secure content to be cached
IE form redirection | Internet Explorer Form redirection enabled
IE java enabled | Internet Explorer has Java enabled
IE non-secure submission | Internet Explorer non-secure form submission warning is disabled
IE outdated | Internet Explorer is outdated
IE secure site | Internet Explorer entering/leaving a secure site warning disabled
IE send certificate | Internet Explorer has the check security certificate before sending option disabled
IE view Certificate | Internet Explorer has check security certificate before viewing option disabled
Nav Java enabled | Netscape Navigator has Java enabled
Nav Javascript enabled | Netscape Navigator has JavaScript enabled
Nav accept cookies | Netscape Navigator accept cookies warning
Nav enter secure site | Netscape Navigator entering a secure site warning is disabled
Nav leave secure site | Netscape Navigator leaving a secure site warning is disabled
Nav mixed document | Netscape Navigator mixed document security warning is disabled
Nav non-secure submission | Netscape Navigator non-secure form submission warning is disabled
Nav outdated | Netscape Navigator is outdated
Brute Force
defftp | FTP default account accessible
defpop | POP3 default account accessible
defrexec | Rexec default account accessible
defrsh | Rsh default account accessible
kerbbf | Kerberos IV brute force
kerbul | Kerberos IV peek accesses user names and information
CGI-Bin
Aglimpse | Glimpse HTTP aglimpse remote execution vulnerability
AnyForm | AnyForm CGI script allows remote execution of arbitrary commands
Campas | Campas cgi-bin file executes remote commands
FormMailExec | FormMail remote execution
FormMailUse | FormMail remote usage
GuestBookCheck | Guestbook could allow execution of commands from remote
HTTP Glimpse Vulnerability | Glimpse HTTP aglimpse remote execution vulnerability
PHPBufferOverflow | php.cgi buffer overflow
PHPread | PHP remote file read vulnerability
ViewSource | HTTP View source vulnerability
cgiexec | CGI program executed an arbitrary command
nphtestcgi | Nph-test-cgi file listing vulnerability
vulncgi | CGI-BIN programs vulnerable
vulnphf | Phone book CGI phf allows remote execution of arbitrary commands
vulntestcgi | Test-cgi sample CGI script allows remote retrieval of file listings
Daemons
DguxFing | DG/UX finger shell metacharacters allowed
LinTftp | Linux TFTP didn't restrict users to tftpboot directory, allowing remote retrieval of files
Sshd 1223 Check | Sshd version 1.2.23 obsolete
Sshd1217 | Obsolete sshd 1.2.17 running
SshdInfo | Sshd advertises information
SshdRhosts | SSH .rhosts weak authentication
echo | Echo service
finger | Finger service
innd vuln | INN control message vulnerable
linkerbug | Dynamic Linker telnet vulnerability
nntppost | NNTP posting
nntpread | NNTP reading
rip | RIP tables modified
rlogin | Rlogin -froot command could allow remote root access
routed | Routed service active
rshequiv | Rsh vulnerable in hosts.equiv
rshnull | Rsh null vulnerable
telnet | Windows NT telnet service installed
tftp | TFTP
uucp | UUCP available
E-mail
identd | Identd remote execution via sendmail
identdresp | SMTP host possibly vulnerable
popimap | Popd buffer overflow vulnerability
Information Gathering
Finger Names | Finger output from common names
Finger Output | Stock fingerd running
IdentdUsers | Ident daemon can be used to remotely gather the username's system servers run under
Whois | Whois information
filesgrabbed | Files obtained
traceroute | Traceroute can be used to map network topologies
NIS
LinPlus Linux NIS could treat '+' user as a normal login account
NT Critical Issues
Add Workstation Privilege | Inappropriate user with Add Workstations to Domain privilege
Altered System Value | Altered system value
Critical Key Permissions | Critical key permissions incorrect
Posix Enabled | POSIX subsystem enabled
accountblankpw | User account has blank password
accountuserpw | User account has a password the same as the account name
adminblankpw | Administrator account has blank password
adminnopw | Administrator has no password
adminuserpw | Administrator username same as password
autologon | Autologon is enabled
fpnwclnt | FPNWCLNT.DLL not found
fpnwclnt checksum | FPNWCLNT.DLL has incorrect checksum
fpnwclnt incorrect | FPNWCLNT.DLL incorrect size
getadmin | GetAdmin patch not applied
ntpwdll | LSA registry key altered
NT Policy Issues
Account Management Audit | Account management auditing not enabled
Allocate CDRoms | CD-ROM available to all users
Allocate Floppy | Allocate floppy
Backup Domain Controller | Backup domain controller identified
Logon Audit | Logon and Logoff auditing not enabled
Object Audit | File and object access auditing not enabled
Policy Audit | Policy change auditing not enabled
Privilege Audit | Privilege auditing not enabled
Process Audit | Process auditing not enabled
System Audit | System auditing not enabled
adminexists | Windows NT default Administrator User ID exists
guestenabled | Guest account enabled
NT Services
alerter Alerter service
Protocol Spoofing
seqport System allocates ports in a sequential or predictable order
NT Critical Issues
snmp SNMP can reveal possibly sensitive information about hosts


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 107 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
Add Workstation Privilege | Inappropriate user with Add Workstations to Domain privilege
Aglimpse | Glimpse HTTP aglimpse remote execution vulnerability
Altered System Value | Altered system value
AnyForm | AnyForm CGI script allows remote execution of arbitrary commands
BackOrifice | Back Orifice default installation
Campas | Campas cgi-bin file executes remote commands
DguxFing | DG/UX finger shell metacharacters allowed
FormMailExec | FormMail remote execution
GuestBookCheck | Guestbook could allow execution of commands from remote
LinPlus | Linux NIS could treat '+' user as a normal login account
LinTftp | Linux TFTP didn't restrict users to tftpboot directory, allowing remote retrieval of files
NetBus | NetBus trojan horse allows complete remote control of Windows systems
PHPBufferOverflow | php.cgi buffer overflow
PortdCheck | Portd running
accountblankpw | User account has blank password
accountuserpw | User account has a password the same as the account name
adminblankpw | Administrator account has blank password
adminnopw | Administrator has no password
adminuserpw | Administrator username same as password
autologon | Autologon is enabled
cgiexec | CGI program executed an arbitrary command
defftp | FTP default account accessible
defpop | POP3 default account accessible
defrexec | Rexec default account accessible
defrsh | Rsh default account accessible
fpnwclnt | FPNWCLNT.DLL not found
fpnwclnt checksum | FPNWCLNT.DLL has incorrect checksum
fpnwclnt incorrect | FPNWCLNT.DLL incorrect size
getadmin | GetAdmin patch not applied
innd vuln | INN control message vulnerable
linkerbug | Dynamic Linker telnet vulnerability
ntpwdll | LSA registry key altered
popimap | Popd buffer overflow vulnerability
rlogin | Rlogin -froot command could allow remote root access
rshequiv | Rsh vulnerable in hosts.equiv
rshnull | Rsh null vulnerable
vulncgi | CGI-BIN programs vulnerable
vulnphf | Phone book CGI phf allows remote execution of arbitrary commands
Low
Account Management Audit | Account management auditing not enabled
Allocate CDRoms | CD-ROM available to all users
Allocate Floppy | Allocate floppy
Backup Domain Controller | Backup domain controller identified
Finger Names | Finger output from common names
Finger Output | Stock fingerd running
FormMailUse | FormMail remote usage
Fsp | FSP daemon running
IE accept cookies | Internet Explorer accept cookies warning disabled
IE active content | Internet Explorer has low active content security enabled
IE active download | Internet Explorer allows active content to be automatically downloaded
IE active scripting | Internet Explorer active scripting is enabled
IE cached pages | Internet Explorer allows secure content to be cached
IE form redirection | Internet Explorer Form redirection enabled
IE java enabled | Internet Explorer has Java enabled
IE non-secure submission | Internet Explorer non-secure form submission warning is disabled
IE outdated | Internet Explorer is outdated
IE secure site | Internet Explorer entering/leaving a secure site warning disabled
IE send certificate | Internet Explorer has the check security certificate before sending option disabled
IE view Certificate | Internet Explorer has check security certificate before viewing option disabled
IdentdUsers | Ident daemon can be used to remotely gather the username's system servers run under
Logon Audit | Logon and Logoff auditing not enabled
Nav Java enabled | Netscape Navigator has Java enabled
Nav Javascript enabled | Netscape Navigator has JavaScript enabled
Nav accept cookies | Netscape Navigator accept cookies warning
Nav enter secure site | Netscape Navigator entering a secure site warning is disabled
Nav leave secure site | Netscape Navigator leaving a secure site warning is disabled
Nav mixed document | Netscape Navigator mixed document security warning is disabled
Nav non-secure submission | Netscape Navigator non-secure form submission warning is disabled
Nav outdated | Netscape Navigator is outdated
Object Audit | File and object access auditing not enabled
Policy Audit | Policy change auditing not enabled
Privilege Audit | Privilege auditing not enabled
Process Audit | Process auditing not enabled
SshdInfo | Sshd advertises information
System Audit | System auditing not enabled
Whois | Whois information
adminexists | Windows NT default Administrator User ID exists
alerter | Alerter service
finger | Finger service
identd | Identd remote execution via sendmail
identdresp | SMTP host possibly vulnerable
nntppost | NNTP posting
nntpread | NNTP reading
snmp | SNMP can reveal possibly sensitive information about hosts
telnet | Windows NT telnet service installed
traceroute | Traceroute can be used to map network topologies
Medium
Active Modem | Modem detected and active
Critical Key Permissions | Critical key permissions incorrect
HTTP Glimpse Vulnerability | Glimpse HTTP aglimpse remote execution vulnerability
IE ActiveX execution | Internet Explorer allows ActiveX controls to be automatically executed
PHPread | PHP remote file read vulnerability
Posix Enabled | POSIX subsystem enabled
Sshd 1223 Check | Sshd version 1.2.23 obsolete
Sshd1217 | Obsolete sshd 1.2.17 running
SshdRhosts | SSH .rhosts weak authentication
ViewSource | HTTP View source vulnerability
echo | Echo service
filesgrabbed | Files obtained
guestenabled | Guest account enabled
kerbbf | Kerberos IV brute force
kerbul | Kerberos IV peek accesses user names and information
nphtestcgi | Nph-test-cgi file listing vulnerability
rip | RIP tables modified
routed | Routed service active
seqport | System allocates ports in a sequential or predictable order
tftp | TFTP
uucp | UUCP available
vulntestcgi | Test-cgi sample CGI script allows remote retrieval of file listings