Simple Unix backdoor that can remotely add a predefined entry into the host's passwd file

Risk Level: | High risk vulnerability High | Check or Attack Name: BackdoorPbbser
Platforms: | Unix
Description: | A simple Unix-based backdoor written by "PBBSER" contains very limited and non-robust functionality to either add a UID 0 account to the host's passwd file or display a predefined message to all the users on the system. By default this backdoor is configured to listen on TCP port 505 and accept commands from an attacker who knows how to use the backdoor.
Remedy: | If a host is found to have this backdoor install, immediately remove the host from your networks and assume the host (and possibly other hosts) are completely compromised.
References: |


SubSeven Backdoor for Windows 9x allows unimpeded remote access to infected machines

Risk Level: | High risk vulnerability High | Check or Attack Name: SubsevenBackdoor
Platforms: | Windows 95, Windows 98, Trojan Horse: Windows
Description: | SubSeven is a backdoor for Windows 9x that allows an attacker to access an affected machine without being detected. Machines with this backdoor can be completely controlled by an attacker from remote.
Remedy: | In your registry, find the keys in HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices for entries that should not be there. Typical entries that should be in Windows98 are: LoadPowerProfile and SchedulingAgent. By default, SubSeven uses a key called KERNEL16, with a value of KERNEL16.DL. The filename and registry key used by SubSeven to start at boot time is easily configurable.
References: | SubSeven Home Page, SubSeven Backdoor, http://come.to/subseven ISS Security Advisory #30, Windows Backdoor Update III, http://xforce.iss.net/alerts/advise30.php3


ColdFusion sample program can be used to confirm existence of arbitrary file

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ColdFusionFileExists
Platforms: | Cold Fusion
Description: | The ColdFusion package distributes with it a number of sample applications one of which, "fileexists.cfm," can be used to remotely confirm the existence of arbitrary files. This information could be used by an attacker to pinpoint further attacks.
Remedy: | Upgrade to ColdFusion 4.0.1 once it becomes available. It is recommended users remove the "fileexists.cfm" program from all production servers.
References: | Allaire Security Bulletin ASB99-02, ColdFusion 4.0 Example Applications and Sample Code Exposes Servers ColdFusion 4.0 Example Applications and Sample Code Exposes Servers, http://www.allaire.com/handlers/index.cfm?ID=8739&Method=Full


ColdFusion sample can reveal source to any CFM file

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ColdFusionSource
Platforms: | Cold Fusion
Description: | ColdFusion 4.0 ships with many sample applications and scripts, which are installed by default. A vulnerability exists in the "viewexample.cfm" program, which allows a remote user to view the source of any CFM file on the server. This could allow an attacker to gain proprietary information contained in the source code, such as usernames and passwords.
Remedy: | Upgrade to ColdFusion 4.0.1 once it becomes available. It is recommended users remove ALL samples, including "viewexample.cfm," from production web servers.
References: | Allaire Security Bulletin ASB99-02, ColdFusion 4.0 Example Applications and Sample Code Exposes Servers, http://www.allaire.com/handlers/index.cfm?ID=8739&Method=Full


ColdFusion sample program can allow remote users to read any file

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ColdFusionFileRead
Platforms: | Cold Fusion
Description: | The ColdFusion sample program "sourcewindow.cfm" contains a vulnerability that could allow remote attackers to read any file on the system.
Remedy: | Upgrade to ColdFusion 4.0 once it becomes available. It is recommended users remove the "sourcewindow.cfm" program from all production servers.
References: | Allaire Security Bulletin ASB99-02, ColdFusion 4.0 Example Applications and Sample Code Exposes Servers, http://www.allaire.com/handlers/index.cfm?ID=8739&Method=Full


ColdFusion syntax checker can cause a system to use all processor resources

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ColdFusionSyntaxChecker
Platforms: | Cold Fusion
Description: | The Syntax Checker is a program shipped with ColdFusion with the purpose of testing older CFML code for compatibility with version 4. A vulnerability in this program allows remote attackers to cause the system to consume all available processor resources.
Remedy: | Upgrade to ColdFusion 4.0.1 once it becomes available. It is recommended users remove the "cfmlsyntaxcheck.cfm" program from all production servers.
References: | Allaire Security Bulletin ASB99-02, ColdFusion 4.0 Example Applications and Sample Code Exposes Servers, http://www.allaire.com/handlers/index.cfm?ID=8739&Method=Full


Long requests to Counter.exe web hit counter can deny further access attempts

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: HttpCgiCounterLong
Platforms: | Common Gateway Interface (CGI)
Description: | A vulnerability exists in the Counter.exe program, which will cause the program to stop responding to requests until an administrator OK's error messages that appear on the console.
Remedy: | Contact the author of this Counter program for fix information.
References: | BUGTRAQ Mailing List, Denial of Service in Counter.exe version 2.70, http://www.netspace.org/cgi-bin/wa?A2=ind9905c&L=bugtraq&F=&S=&P=1571


nph-publish CGI script could allow remote file writing

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: CGI nphpublish
Platforms: | Common Gateway Interface (CGI)
Description: | A vulnerability in the nph-publish script version 1.0 through 1.1 could allow remote attackers to write to files that would normally not be accessible. Under certain circumstances, this hole could be used to gain access to the vulnerable machine.
Remedy: | Remove the vulnerable version of nph-publish from your CGI-BIN directory and upgrade to at least version 1.2, which fixes this problem.
References: | Lincoln D. Stein, nph-publish script, http://stein.cshl.org/~lstein/server_publish/nph-publish.txt


Textcounter CGI program allows remote command execution

Risk Level: | High risk vulnerability High | Check or Attack Name: CGI Textcounter
Platforms: | Common Gateway Interface (CGI)
Description: | Textcounter is a popular tool for adding "hit counters" to web pages. A vulnerability exists in some versions of this program that allows remote attackers to execute arbitrary commands on the hosting server with the privileges of the server process.
Remedy: | Users of the Perl version should upgrade to at least 1.2.1, and users of the C++ version should upgrade to at least 1.3.1 to fix this security problem.
References: | BUGTRAQ Mailing List, textcounter.pl SECURITY HOLE, http://www.netspace.org/cgi-bin/wa?A2=ind9806D&L=bugtraq&P=R755 Matt's Script Archive, Textcounter, http://www.worldwidemart.com/scripts/textcounter.shtml


Novell CGI script files.pl could allow remote file viewing

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Novell Files Script
Platforms: | Common Gateway Interface (CGI)
Description: | A problem in the 'files.pl' script distributed with the Novell WebServer Examples Toolkit v2 could allow a remote attacker to view the contents of any file or directory on vulnerable servers. The attacker would be limited to viewing files accessible to the user owning the server process.
Remedy: | Remove the 'files.pl' script from any production or sensitive servers on your network. It is a good practice to always remove sample scripts from the CGI-BIN directory of your web server before putting it into production.
References: | WWW Security FAQ, Are there any known security problems with Novell WebServer?, http://www.w3.org/Security/Faq/wwwsf8.html#Q87


BIND Inverse-Query buffer overflow allows remote root access

Risk Level: High risk vulnerability High

Check or Attack Name: Bind bo
Platforms: BIND
Description:

A buffer overflow exists in BIND versions prior to 4.9.7, and BIND versions prior to 8.1.2. A malicious remote user can send a specially formatted inverse-query TCP stream that would crash the BIND server and allow the attacker to gain root access.
Remedy:

Disable inverse queries, upgrade to BIND 8.1.2 (or, less desirably, upgrade to BIND 4.9.7), or apply the patch.

The inverse query feature is disabled by default, so only the systems that have been explicitly configured to allow it are vulnerable. In BIND 8, review the "options" block in the configuration file (typically /etc/named.conf). If there is a "fake-iquery yes;" line, then the server is vulnerable. In BIND 4.9, examine the "options" lines in the configuration file (typically /etc/named.boot). If there is a line containing "fake-iquery," then the server is vulnerable.

In addition, unlike BIND 8, inverse query support can be enabled when the server is compiled. Examine conf/options.h in the source. If the line #defining INVQ is not commented out, then the server is vulnerable.

Disabling inverse query support can break ancient versions of nslookup. If nslookup fails, replace it with a version from any BIND 4.9 or BIND 8 distribution.

—OR—

Upgrade to version 8.1.2 or 4.9.7, available at http://www.isc.org/new-bind.html.

—OR—

Obtain patch at for BIND 8 at ftp://ftp.cert.org/pub/cert_advisories/Patches/CA-98.05_Topic.1_BIND8_patch.txt, or BIND 4.9 at ftp://ftp.cert.org/pub/cert_advisories/Patches/CA-98.05_Topic.1_BIND4.9_patch.txt.

—OR—

See CERT Advisory CA-98.05 for vulnerable systems and vendor-specific patches.
References:

CERT Advisory CA-98.05, Multiple Vulnerabilities in BIND, http://www.cert.org/ftp/cert_advisories/CA-98.05.bind_problems

CIAC Information Bulletin I-044A, BIND Vulnerabilities, http://ciac.llnl.gov/ciac/bulletins/i-044a.shtml

Sun Microsystems, Inc. Security Bulletin #00180, BIND, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/180&type=0&nav=sec.sba

SCO Security Bulletin 98-03, Security Vulnerability in named, ftp://ftp.sco.com/SSE/security_bulletins/SB-98.03a

Hewlett-Packard Security Bulletin HPSBUX9808-083, Security Vulnerability in BIND on HP-UX, http://us-support.external.hp.com/

Silicon Graphics Inc. Security Advisory 19980603-02-PX, IRIX BIND DNS Vulnerabilities, ftp://sgigate.sgi.com/security/19980603-02-PX

Silicon Graphics Inc. Security Advisory 19980603-01-PX, IRIX BIND DNS Vulnerabilities, ftp://sgigate.sgi.com/security/19980603-01-PX


Illegally formatted DNS request can crash some BIND servers

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Bind DoS
Platforms: BIND
Description:

A malicious remote user can format a DNS message that would cause BIND 4.9 and BIND 8 servers to read from invalid memory locations. This action will crash the BIND server. This vulnerability does not provide the attacker access to the system.

Any system running BIND 4.9 prior to 4.9.7 or BIND 8 prior to 8.1.2 is vulnerable.
Remedy:

Upgrade to BIND 8.1.2 and BIND 4.9.7 at http://www.isc.org/new-bind.html.

Vendor-specific instructions for resolving this issue are as follows:

Caldera Corporation: Upgrade to the bind-8.1.1-5 packages. They can be found on Caldera's FTP site at ftp://ftp.caldera.com/pub/OpenLinux/updates/1.2/006/RPMS. The corresponding source code can be found at ftp://ftp.caldera.com/pub/OpenLinux/updates/1.2/006/SRPMS.

Data General: Fixed in revision R4.20MU04 of DG/UX. Patches are available for earlier revisions. R4.20MU01: tcpip_R4.20MU01.p10; R4.20MU02: tcpip_R4.20MU02.p09; R4.20MU03: tcpip_R4.20MU03.p01; R4.11MU05: tcpip_R4.11MU05.p09; R4.12MU03: tcpip_R4.12MU03.p02.

Hewlett-Packard Company: HP9000 Series 700/800 running HP-UX releases 9.X, 10.X, and 11.00 are vulnerable. Patches are as follows: HP-UX 9.0, 9.01, 9.03, 9.04, 9.05, and 9.07: PHNE_13187; HP-UX 10.00, 10.01, 10.10, and 10.20: PHNE_14617; HP-UX 10.16: PHNE_16232; HP-UX 10.24: PHNE_16204; HP-UX 11.00: PHNE_12957.

IBM: Obtain and install patches for these operating system versions: AIX 4.1.x: IX76958; AIX 4.2.x: IX76959; AIX 4.3.x: IX76962 (this is BIND 8.1.2).

NEC: Patches are available at ftp://ftp.meshnet.or.jp/pub/48pub/security. Read the README file for FTP server file structure and the location of the patch for your operating system and version.

Red Hat Software, Inc.: Patches are available for Red Hat 4.2 for alpha (ftp://ftp.redhat.com/redhat/updates/4.2/alpha/bind-4.9.7-0.alpha.rpm), sparc (ftp://ftp.redhat.com/redhat/updates/4.2/sparc/bind-4.9.7-0.sparc.rpm), and i386 (ftp://ftp.redhat.com/redhat/updates/4.2/i386/bind-4.9.7-0.i386.rpm). Patches are available for Red Hat 5.0 for alpha (ftp://ftp.redhat.com/redhat/updates/5.0/alpha/bind-4.9.7-1.alpha.rpm) and i386 (ftp://ftp.redhat.com/redhat/updates/5.0/i386/bind-4.9.7-1.i386.rpm). Patches are available for Red Hat 5.1 for alpha (ftp://ftp.redhat.com/redhat/updates/5.1/alpha/bind-4.9.7-1.alpha.rpm), i386 (ftp://ftp.redhat.com/redhat/updates/5.1/i386/bind-4.9.7-1.i386.rpm), and sparc (ftp://ftp.redhat.com/redhat/updates/5.1/sparc/bind-4.9.7-1.sparc.rpm).

Santa Cruz Operation, Inc.: Binary versions of BIND 4.9.7 are available from the SCO ftp site at ftp://ftp.sco.com/SSE/sse012.ltr (cover letter) and ftp://ftp.sco.com/SSE/sse012.tar.Z (replacement binaries for SCO Open Desktop/Open Server 3.0, SCO Unix 3.2v4, SCO OpenServer 5.0, SCO UnixWare 2.1, and SCO UnixWare 7).

Silicon Graphics, Inc.: IRIX 3.x, IRIX 4.x, IRIX 5.0.x, IRIX 5.1.x, IRIX 5.2, IRIX 6.0.x, IRIX 6.1: upgrade to currently supported IRIX operating system. Install indicated patch ID for these OS versions: IRIX 5.3 (3123), IRIX 6.2 (3117), IRIX 6.3 (2740), IRIX 6.4 (2741). IRIX 6.5 is not vulnerable.
References:

CERT Advisory CA-98.05, Multiple Vulnerabilities in BIND, http://www.cert.org/ftp/cert_advisories/CA-98.05.bind_problems

Hewlett-Packard Security Bulletin HPSBUX9808-083, Security Vulnerability in BIND on HP-UX, http://us-support.external.hp.com/

Silicon Graphics Inc. Security Advisory 19980603-01-PX, IRIX BIND DNS Vulnerabilities, ftp://sgigate.sgi.com/security/19980603-01-PX


CDDB service detected

Risk Level: | Low risk vulnerability Low | Check or Attack Name: CDDBD detect
Platforms: | CDDB Server
Description: | A CD Database daemon was detected as running. CDDB is a server program that fields requests from remote CD players and returns information about CDs currently being played on those systems such as artist, title, album, etc.
Remedy: | If this is an unneeded service, it should be disabled.
References: | CDDB, Inc., CDDB: Developers, http://www.cddb.com/developers.html


ICQ is distributed network of Internet chat clients and servers

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ICQClient
Platforms: | ICQ
Description: | ICQ is a very popular distributed chat system that offers many features not offered by other chat systems. ICQ has been the source of holes that have allowed an attacker to transfer data (which would otherwise not be available, or was not originally intended to be available) from the ICQ user's machine. ICQ has also been the target of Denial of Service attacks and is vulnerable to message spoofing.
Remedy: | If your site's policy forbids programs like ICQ, you should locate the offending machine and remove the ICQ client software.
References: | ICQ, Inc., ICQ - World's Largest Internet Online Communications Network, http://www.mirabilis.com/ BUGTRAQ Mailing List, Vulnerabilities in ICQ, http://geek-girl.com/bugtraq/1997_4/0470.html BUGTRAQ Mailing List, Re: Vulnerabilities in ICQ, http://geek-girl.com/bugtraq/1997_4/0475.html SecuriTeam.com, Another ICQ 98a Bug, http://www.securiteam.com/exploits/Another_ICQ_98a_bug.html


iParty server shuts down by sending characters to port

Risk Level: | Low risk vulnerability Low | Check or Attack Name: iParty denial of service
Platforms: | iParty
Description: | A denial of service attack exists against iParty servers. If a remote user connects to the iParty port (port 6004 is default) and sends a large amount of ^? Characters, the iParty server will shut itself down and disconnect all users. No event of this shows up in the iParty log.
Remedy: | There is no workaround for this vulnerability until a patch is available from iParty.
References: | BUGTRAQ Mailing List, iParty can be shut down remotely, http://www.netspace.org/cgi-bin/wa?A2=ind9812a&L=bugtraq&F=&S=&P=68


mSQL Database server is running

Risk Level: | Low risk vulnerability Low | Check or Attack Name: mSQLDetect
Platforms: | mSQL
Description: | An instance of the mSQL Database server has been detected. mSQL is a popular freely-available SQL database server for Unix systems. mSQL has had security problems in the past and access to the server should be restricted to authorized and trusted users.
Remedy: | Unauthorized of unneeded mSQL server processes should be terminated on affected hosts. If the server is determined to be legitimate, it would be wise to consider allowing connections only from trusted hosts as the integrated security in mSQL is not very robust.
References: | Hughes Technologies Pty. Ltd., The Home of miniSQL (mSQL), http://www.hughes.com.au/


perl fingerd program allows remote users to execute commands

Risk Level: | High risk vulnerability High | Check or Attack Name: Perl fingerd
Platforms: | Perl fingerd: old versions
Description: | A certain, widely distributed, implementation of the finger daemon in Perl could allow remote attackers to execute arbitrary commands on the server with the privileges of the daemon, usually "nobody." This flaw was present through version 0.2 of this program.
Remedy: | This vulnerability existed in the Perl finger daemon through version 0.2, later versions should have corrected this problem.
References: | BUGTRAQ Mailing List, perl fingerd stupidity, http://geek-girl.com/bugtraq/1997_3/0214.html


Rwho daemon overflow

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: rwhod - vulnerable
Platforms: Linux, AIX: 4.2, FreeBSD, NetBSD
Description:

The rwhod daemon was detected running, and is vulnerable to a buffer overflow. The rwhod daemon does not properly validate the information it receives, and presents a potential vulnerability by overflowing the hostname sent to it. On some machines, this results in rwhod crashing. On others, the result is a change in process status information for rwhod. You can check the status of most Unix machines by executing ps -a.

Rwhod fails to do bounds checking on data it receives from a UDP packet before copying it into a buffer. This results in a buffer overflow condition that can be used to modify or disrupt the daemon's operation, or possibly to execute code as root.

Note: This check may yield false positives under some conditions. Testing for the rwhod vulnerability explicitly relies on the Internet Control Message Protocol (ICMP) for positive identification. However, ICMP is by definition not a reliable protocol. Although the software takes many precautions to minimize false positives, some may still exist. Refer to your ISS software documentation for more information.
Remedy:

Most modern distributions of the affected systems include whod daemons that fix this buffer overflow. Sites that do not use the rwho services should disable this service by commenting it out of the inetd.conf file or appropriate RC scripts. AIX users should obtain and install the following patch: AIX 4.2: IX61127
References:

BUGTRAQ Mailing List, rwhod buffer overflow, http://www.netspace.org/cgi-bin/wa?A2=ind9608D&L=bugtraq&P=R472


Syslog flood

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: syslogflood
Platforms: | Unix
Description: | This system was found to be vulnerable to Syslog Flood. Sending a large number of messages to the system log daemon can be used to cause a denial of service attack by exhausting disk space. This attack can lead to the syslog service terminating, or possibly a system deadlock, putting the host in an inoperable state.
Remedy: | If you are not using remote logging, use the -r option (or -l in BSDI) to turn remote logging off in your syslog daemon. You must then recompile the daemon. Contact your vendor or refer to your vendor's documentation for more information.
References: |


A Virtual Network Computing server was detected

Risk Level: | Low risk vulnerability Low | Check or Attack Name: VNCDetect
Platforms: | Virtual Network Computing
Description: | Virtual Network Computing is a freely available remote control package for many architectures. If an attacker can gain access to such a service they could take complete administrative control over the machine.
Remedy: | If VNC is not needed or authorized then it should be removed.
References: | AT&T Laboratories Cambridge, Virtual Network Computing, http://www.uk.research.att.com/vnc/


VNC No Authentication Required

Risk Level: | Low risk vulnerability Low | Check or Attack Name: VNCNoAuth
Platforms: | Virtual Network Computing
Description: | If VNC is running and is configured to accept connections without authentication, anyone can connect to the VNC server and control your machine. Usually, VNC will not allow connections if no password is set, but you can configure it to accept connections with no password.
Remedy: | If VNC is not needed or authorized, then it should be removed.
References: | AT&T Laboratories Cambridge, Virtual Network Computing, http://www.uk.research.att.com/vnc/


VNC detect no connections accepted

Risk Level: | Low risk vulnerability Low | Check or Attack Name: VNCDetectNoConn
Platforms: | Virtual Network Computing
Description: | VNC server is running, but it is not configured to allow remote connections.
Remedy: | If VNC is not needed or authorized, then it should be removed.
References: | AT&T Laboratories Cambridge, Virtual Network Computing, http://www.uk.research.att.com/vnc/


IMail IMAP service contains a buffer overflow

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: IMailIMAPOverflow
Platforms: Imail
Description:

IMail is a popular multi-protocol mail server for Windows NT environments. A buffer overflow in the login command of the IMAP server could allow a remote attacker to crash the service. It is not known whether this overflow can be manipulated to gain access to the machine.
Remedy:

This vulnerability has been demonstrated through version 5.0, and later versions may be vulnerable as well. Users are encouraged to contact IPSwitch for fix information.
References:

Ipswitch, Inc. Product Information, IMail Server by Ipswitch, http://www.ipswitch.com/Products/IMail_Server/index.asp

eEye Digital Security Team Alert AD03011999, Multiple IMail Vulnerabilities Multiple IMail Vulnerabilites, http://www.eeye.com/database/advisories/ad03011999/ad03011999.html


IMail's whois32 service can be remotely crashed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: IMailWhoisOverflow
Platforms: Imail
Description:

IMail is a popular multi-protocol mail server for Windows NT environments. The Whois32 service included in the IMail package contains a buffer overflow vulnerability that could allow remote attackers to crash the service. It isn't known whether this hole can be manipulated to execute arbitrary code on the victim machine.
Remedy:

This vulnerability has been demonstrated through version 5.0, and later versions may be vulnerable as well. Users are encouraged to contact IPSwitch for fix information.
References:

Ipswitch, Inc. Product Information, IMail Server by Ipswitch, http://www.ipswitch.com/Products/IMail_Server/index.asp

eEye Digital Security Team Alert AD03011999, Multiple IMail Vulnerabilites, http://www.eeye.com/database/advisories/ad03011999/ad03011999.html


Sendmail decode/uudecode alias could allow remote attackers to create files on the system

Risk Level: High risk vulnerability High

Check or Attack Name: smtpdecode
Platforms: Unix, Sendmail
Description:

A common configuration for older mail transfer agents (MTAs) is to include an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. This configuration could allow an attacker to remotely overwrite files on the system, which could possibly be used to leverage remote access. The uudecode alias might also exist in some configurations.
Remedy:

Disable mail aliases for decode and uudecode. If the /etc/aliases or /usr/lib/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the newaliases command. For more information on Unix mail aliases, refer to the man page for aliases. Disabled aliases would be similar to these examples:

# decode: "|/usr/bin/uudecode"
# uudecode: "|/usr/bin/uuencode -d"
References:

CIAC Information Bulletin A-14, Additional information on the vulnerability in the UNIX DECODE alias, http://ciac.llnl.gov/ciac/bulletins/a-14.shtml

CIAC Information Bulletin A-13, Vulnerability in DECODE alias, http://ciac.llnl.gov/ciac/bulletins/a-13.shtml


SMTP in debug mode

Risk Level: | High risk vulnerability High | Check or Attack Name: smtpdebug
Platforms: | Sendmail: Old
Description: | Sendmail was found in debug mode. Debug mode allows an attacker to gain access to a machine through the sendmail port. This option looks for old versions of sendmail that allow debug mode and could provide an attacker access to the machine.
Remedy: | Obtain and install a more recent version of Sendmail, which does not implement the DEBUG feature.
References: | CERT Advisory CA-93.14, Internet Security Scanner (ISS), http://www.cert.org/advisories/CA-93.14.Internet.Security.Scanner.html Sendmail Consortium, Sendmail Homepage, http://www.sendmail.org


SMTP EXPN command

Risk Level: Low risk vulnerability Low

Check or Attack Name: smtpexpn
Platforms: SMTP servers, Solaris: 2.5.1
Description:

Simple Mail Transfer Protocol (SMTP)-compliant applications, such as the sendmail program EXPN, allow an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. EXPN provides additional information concerning users on the system, such as if they exist and their full names.
Remedy:

If you are running Sendmail, add the line Opnoexpn to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the expand command.

Newer versions of sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail.
References:

Sendmail Consortium, Sendmail FAQ, http://www.sendmail.org/faq


SMTP EXPN buffer overflow can crash or obtain access

Risk Level: High risk vulnerability High

Check or Attack Name: SMTP EXPN Buffer Overflow Attempt
Platforms: SLMail: v2.6 or earlier, Mercury Mail Server, AppleShare IP Mail Server
Description:

Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows.
Remedy:

Determine if your SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of your vulnerability.

You can use Internet Scanner to determine if your SMTP server is vulnerable. If the Sendmail outdated or SMTP Host possibly vulnerable messages appear, then one or more hosts on your network is vulnerable.

—OR—

You can manually test by connecting to port 25 on your machine and sending the appropriate command (HELO, VRFY, or EXPN) followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then you are not vulnerable. If your connection closes immediately, then the system is most likely vulnerable.

If your system is vulnerable, then it may have already been compromised. If the attack was a denial of service attack, restart your SMTP server. Watch for further attacks from the source address. If your machine is not vulnerable, then you have not been compromised, but the attack may be a sign of an attacker probing your network for vulnerabilities.
References:

BUGTRAQ Mailing List, Steven (steven@EFNI.COM), SLMail 2.6 DoS, http://geek-girl.com/bugtraq/1998_1/0380.html

BUGTRAQ Mailing List, Jon Beaton (steven@EFNI.COM), smtp overflows, http://geek-girl.com/bugtraq/1998_2/0046.html

BUGTRAQ Mailing List, David Luyer (luyer@UCS.UWA.EDU.AU), Re: AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0040.html

BUGTRAQ Mailing List, Chris Wedgwood (chris@CYBERNET.CO.NZ), AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0039.html

Seattle Labs, Inc., SLmail Overview, http://www.seattlelabs.com/slmail/


SMTP HELO buffer overflow can crash or obtain access

Risk Level: High risk vulnerability High

Check or Attack Name: SmtpHeloBo
Platforms: SLMail: v2.6 or earlier, Mercury Mail Server, AppleShare IP Mail Server
Description:

Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server software contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows.
Remedy:

Determine if your SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of your vulnerability.

You can use Internet Scanner to determine if your SMTP server is vulnerable. If the Sendmail outdated or SMTP Host possibly vulnerable messages appear, then one or more hosts on your network is vulnerable.

—OR—

You can manually test by connecting to port 25 on your machine and sending the appropriate command (HELO, VRFY, or EXPN) followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then you are not vulnerable. If your connection closes immediately, then the system is most likely vulnerable.

If your system is vulnerable, then it may have already been compromised. If the attack was a denial of service attack, restart your SMTP server. Watch for further attacks from the source address. If your machine is not vulnerable, then you have not been compromised, but the attack may be a sign of an attacker probing your network for vulnerabilities.
References:

BUGTRAQ Mailing List, Steven (steven@EFNI.COM), SLMail 2.6 DoS, http://geek-girl.com/bugtraq/1998_1/0380.html

BUGTRAQ Mailing List, Jon Beaton (steven@EFNI.COM), smtp overflows, http://geek-girl.com/bugtraq/1998_2/0046.html

BUGTRAQ Mailing List, David Luyer (luyer@UCS.UWA.EDU.AU), Re: AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0040.html

BUGTRAQ Mailing List, Chris Wedgwood (chris@CYBERNET.CO.NZ), AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0039.html

Seattle Labs, Inc., SLmail Overview, http://www.seattlelabs.com/slmail/


SMTP server allows fake hostnames in HELO

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SMTPforgery
Platforms: | Any, Sendmail
Description: | The SMTP server was found to accept any hostname issued to it in the HELO command. This lack of authorization could allow users to more easily forge mail from your server.
Remedy: | Upgrade your Mail Transfer Agent (MTA) to a package or version that supports more rigorous validation of hostnames. It may be possible to configure your server to do this; refer to your server's documentation.
References: |


SMTP daemons allow addresses to be verified via RCPT

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SMTPrcpt
Platforms: | Sendmail, SMTP servers
Description: | A side affect of many implementations of the RCPT command within SMTP servers is the ability to use this command to verify which addresses are valid. Disabling the VRFY and EXPN commands is often thought to be sufficient in preventing such information gathering attacks. This method is often used in e-mail "harvesting" applications run by direct e-mail marketers.
Remedy: | This issue does not directly indicate any type of vulnerability. No effective solutions have been developed to prevent this method from being exploited. Mail administrators should pay close attention to their log files and report any obvious abuses to the appropriate person(s).
References: |


Sendmail %style blind relaying can be used to obfuscate the origin of e-mails

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: smtprelay
Platforms: Sendmail
Description:

An SMTP server supports third-party or %style mail relaying. Third-party mail relaying occurs when a mail server processes a mail message where neither the sender nor the recipient is local to the server's mail domain.

While third party relaying has some legitimate purposes, such as allowing mail messages to be routed around known mail problems, e-mail hijackers (or spammers) primarily use it to obscure their identity while sending large amounts of junk mail.
Remedy:

Re-configure your SMTP server to enforce that all mail messages must either originate or terminate locally (on the mail host).
References:

Sendmail Consortium, Anti-Spam Provisions in Sendmail 8.8, http://www.sendmail.org/antispam.html

Mail Abuse Protection System (MAPS), , http://maps.vix.com

Fight Spam on the Internet!, , http://spam.abuse.net/

, Anti-Relay: Stop Third-Party Mail Relay, http://maps.vix.com/tsi/ar-fix.html


SMTP verify (VRFY) command can be used to validate users

Risk Level: Low risk vulnerability Low

Check or Attack Name: smtpvrfy
Platforms: SMTP servers, Solaris: 2.5.1
Description:

The SMTP VRFY command is enabled. The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY provides additional information about users on the system, such as if they exist and their full names.
Remedy:

If you are running Sendmail, add the line Opnovrfy to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the verify command.

Newer versions of sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail.
References:

Sendmail Consortium, Sendmail FAQ, http://www.sendmail.org/faq

Sendmail Consortium, Latest software version, http://www.sendmail.org

Sendmail Consortium, Latest software version, ftp://ftp.cs.berkeley.edu/ucb/sendmail


SMTP VRFY buffer overflow can crash or obtain access

Risk Level: High risk vulnerability High

Check or Attack Name: SMTP VRFY Buffer Overflow Attempt
Platforms: SLMail: v2.6 or earlier, Mercury Mail Server, AppleShare IP Mail Server
Description:

Several freeware, shareware, and commercial SMTP servers contain buffer overflows. Different SMTP commands can cause the SMTP server to crash or to execute arbitrary byte-code that could lead to a system compromise. For example, the Seattle Lab SLMail SMTP server contains overflows in the VRFY and EXPN commands. AppleShare, Stalker, and Mercury SMTP servers contain overflows in the HELO command as well. Other lesser-known SMTP servers may also contain overflows.
Remedy:

Determine if your SMTP server is vulnerable to the attack and take appropriate actions depending on the extent of your vulnerability.

You can use Internet Scanner to determine if your SMTP server is vulnerable. If the Sendmail outdated or SMTP Host possibly vulnerable messages appear, then one or more hosts on your network is vulnerable.

—OR—

You can manually test by connecting to port 25 on your machine and sending the appropriate command (HELO, VRFY, or EXPN) followed by at least 1024 X's. If the SMTP server returns an OK or an error message, then you are not vulnerable. If your connection closes immediately, then the system is most likely vulnerable.

If your system is vulnerable, then it may have already been compromised. If the attack was a denial of service attack, restart your SMTP server. Watch for further attacks from the source address. If your machine is not vulnerable, then you have not been compromised, but the attack may be a sign of an attacker probing your network for vulnerabilities.
References:

BUGTRAQ Mailing List, Steven (steven@EFNI.COM), SLMail 2.6 DoS, http://geek-girl.com/bugtraq/1998_1/0380.html

BUGTRAQ Mailing List, Jon Beaton (steven@EFNI.COM), smtp overflows, http://geek-girl.com/bugtraq/1998_2/0046.html

BUGTRAQ Mailing List, David Luyer (luyer@UCS.UWA.EDU.AU), Re: AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0040.html

BUGTRAQ Mailing List, Chris Wedgwood (chris@CYBERNET.CO.NZ), AppleShare IP Mail Server, http://geek-girl.com/bugtraq/1998_2/0039.html

Seattle Labs, Inc., SLmail Overview, http://www.seattlelabs.com/slmail/


Sendmail wizard (WIZ) backdoor allows anonymous remote root access

Risk Level: High risk vulnerability High

Check or Attack Name: smtpwiz
Platforms: Sendmail: Old
Description:

Very old installations of the Sendmail mailing system contained a feature whereby a remote user connecting to the SMTP port can enter the "WIZ" command and be given an interactive shell with root privileges.
Remedy:

If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (note that it must be typed in uppercase).

OW*

For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process.
References:

CERT Advisory CA-93.14, Internet Security Scanner (ISS), http://www.cert.org/advisories/CA-93.14.Internet.Security.Scanner.html

Sendmail Consortium, Sendmail Homepage, http://www.sendmail.org


Startech POP3 proxy contains a buffer overflow that can crash the service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Startech POP3
Platforms: Windows NT, Windows 95, Windows 98, Startech Proxy
Description:

A vulnerability exists in the Startech POP3 proxy server that could allow a remote attacker to issue a very long argument to the USER command and overflow an internal buffer. This attack will crash the proxy service and deny further connections. It is unknown whether this overflow can be manipulated to execute arbitrary code on vulnerable hosts.

False Negative: In Internet Scanner, Windows 95 systems report a false negative. In order to cause a denial of service while running this check, click the Close button for the popup message box that appears on the scanning machine.
Remedy:

Download the latest version from www.startech.com.
References:

BUGTRAQ Mailing List, Windows95 Proxy DoS Vulnerabilites, http://www.netspace.org/cgi-bin/wa?A2=ind9807A&L=bugtraq&P=R2159


FTP remote buffer overflows allow root access

Risk Level: High risk vulnerability High

Check or Attack Name: Palmetto FTP
Platforms: wu-ftpd, ProFTPD
Description:

A vulnerability exists in ProFTPD through version 1.2.0pre1 and wu-ftpd through 2.4.2 BETA 18 and 2.4.2 BETA 18 VR9 that could allow a remote attacker to cause these services to execute arbitrary commands as root. These servers are installed by default on many operating systems, including Slackware and Red Hat Linux distributions.
Remedy:

Users of ProFTPD should upgrade to 1.2.0pre2 and users of wuftpd should upgrade to 2.4.2 BETA 18 VR10 or later. This vulnerability relies on the presence of long directory path structures. A suitable temporary workaround is to restrict access to world writable directories to FTP users.
References:

Netect, Inc. General Public Security Advisory, palmetto.ftpd, http://www.netect.com/advisory_0209_2.html

Debian GNU/Linux - Security Information, Debian FTP packages: Buffer overflow in some ftp servers, http://www.debian.org/security/1999/19990210

Red Hat, Inc. Linux 5.2 (Apollo) General Errata, wu-ftpd: Security Fix, http://www.redhat.com/support/docs/rhl/rh52-errata-general.html#wu-ftpd

Caldera Systems, Inc. Security Advisory CSSA-1999:004.0, Buffer overflow in wu-ftpd, http://www.calderasystems.com/news/security/CSSA-1999:004.0.txt

CIAC Information Bulletin J-029, Buffer Overflows in Various FTP Servers, http://www.ciac.org/ciac/bulletins/j-029.shtml

Caldera Systems, Inc. Security Advisory CSSA-1999:004.0, Buffer overflow in wu-ftpd, http://www.calderasystems.com/news/security/CSSA-1999:004.0.txt

CERT Advisory CA-99-03, Remote buffer overflows in various FTP servers leads to potential root compromise, http://www.cert.org/advisories/CA-99-03-FTP-Buffer-Overflows.html


Winroute allows unrestricted access to proxy configuration

Risk Level: | High risk vulnerability High | Check or Attack Name: WinRouteConfig
Platforms: | WinRoute
Description: | The procedure used to authenticate users for access to the admin configuration menu on Winroute servers contains a flaw that allows users to bypass the authentication and gain direct access. This access could be used to change the configuration of the proxy from remote.
Remedy: | Contact Tiny Software for fix information.
References: | BUGTRAQ Mailing List, Bug in Winroute 3.04g, http://www.netspace.org/cgi-bin/wa?A2=ind9904B&L=bugtraq&P=R1283 Tiny Software Inc., WinRoute, http://www.winroute.com/


ICMP netmask request response

Risk Level: | Low risk vulnerability Low | Check or Attack Name: IcmpNmask
Platforms: | Any
Description: | A response was received to an ICMP netmask request. By determining the netmasks of various machines in your network, an attacker can better map your subnet structure and infer trust relationships.
Remedy: | Configure your firewall or filtering router to block outgoing ICMP packets.
References: |


ICMP timestamp requests

Risk Level: | Low risk vulnerability Low | Check or Attack Name: IcmpTstamp
Platforms: | Any
Description: | The target machine responded to an ICMP timestamp request. By accurately determining the target's clock state, an attacker can more effectively attack certain time-based pseudorandom number generators (PRNGs) and the authentication systems that rely on them.
Remedy: | Configure your firewall or filtering router to block outgoing ICMP packets. Block ICMP packets of type 13 or 14 and/or code 0.
References: |


Data flood

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: dataflood
Platforms: | Any
Description: | Sending a large amount of data to a system can be used as a denial of service attack. This attack exhausts available computer resources so that the system cannot respond to other user requests.
Remedy: | As of December 1998, there is currently no fix for the Data Flood vulnerability.
References: |


Ping of Death

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: pingbomb
Platforms: Any
Description:

The "Ping of Death" attack involves transmitting an ICMP echo packet greater than 65535 bytes in length to a vulnerable machine. The IP specification prohibits packets this large from being created, however, fragmentation allows this packet to be transmitted. The vulnerability exists in the reassembly code of the victim system's networking stack. Once the packet has been reassembled the packet may be too large to fit in the allocated buffer causing an overflow. This can cause certain systems to crash, reboot, or behave in unpredictable ways. This attack is not limited to ICMP and can be exploited with any protocol that uses IP.
Remedy:

Obtain a patch from your vendor. It may be possible to deny packets of this nature from entering your network; refer to your router's documentation.
References:

Mike Bremford's Web Site, The Ping o' Death Page, http://www.sophist.demon.co.uk/ping/

IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:006.1, Newly Available Patches for IBM AIX(r) Address `SYN Flood' and `Ping o' Death' Vulnerabilities, http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories

Silicon Graphics Inc. Security Advisory 19961202-01-PX, TCP SYN and Ping Denial of Service Attacks, ftp://sgigate.sgi.com/security/19961202-01-PX

CERT Advisory CA-96.26, Denial-of-Service Attack via ping, http://www.cert.org/advisories/CA-96.26.ping.html


UdpScan

Lists the UDP services for the scanned host.

Internet Scanner sends a collection of UDP packets to each UDP port to check if it is active, and then listens for a response. The type of response (or the lack of a particular type of response) indicates if the port is active. As the UDP port scanner uses the UDP and ICMP protocols, which are classified as unreliable protocols, results can vary between scans. Furthermore, many operating systems limit the rate at which they send ICMP error messages, which can further limit the effectiveness of this scan.


ColdFusion Expression Evaluator allows remote file manipulation, including creation

Risk Level: High risk vulnerability High

Check or Attack Name: ColdFusionEvaluator
Platforms: Cold Fusion
Description:

The Expression Evaluator is a sample script included with ColdFusion (through version 4.0) to demonstrate to users how to use the expression evaluation features of ColdFusion. A vulnerability exists in this script, which could allow remote attackers to view or delete arbitrary files on the server. Normally this program is only accessible from the localhost machine (127.0.0.1), but when accessed directly allows connections from any host.

It was later found that in addition to reading and deleting files on the server that it is possible to upload (create) files on the server, which could be used to further compromise the system.
Remedy:

Upgrade to ColdFusion version 4.0.1 at http://www1.allaire.com/handlers/index.cfm?ID=10712&Method=Full.

—OR—

Obtain and install the appropriate ColdFusion Expression Evaluator Security Patch, available at http://www.allaire.com/handlers/index.cfm?ID=8727&Method=Full.

—OR—

Users who do not wish to patch their systems should remove the applications from //CFDOCS/expeval (namely "evaluate.cfm").
References:

Allaire Security Bulletin ASB99-01, Expression Evaluator Security Issues Expression Evaluator Security Issues, http://www.allaire.com/handlers/index.cfm?ID=8727&Method=Full

L0pht Security Advisory, Cold Fusion Application Server, http://www.l0pht.com/advisories/cfusion.txt

Phrack Magazine Volume 8, Issue 54, NT Web Technology Vulnerabilities, http://www.phrack.com/search.phtml?view&article=p54-8

Allaire Corporation, ColdFusion 4.0.1 Update Now Available, http://www.allaire.com/handlers/index.cfm?ID=10712&Method=Full


IIS servers can be manipulated to execute arbitrary code from remote via an overflow in HTR requests

Risk Level: High risk vulnerability High

Check or Attack Name: IIS HTR Overflow
Platforms: IIS: 4.0
Description:

Internet Information Server 4.0 contains the ability to perform various server-side processing via specific file types. A vulnerability exists in the way that .HTR, .STM, and .IDC files are processed. Requests for files ending with these file name extensions are passed to the appropriate external DLL for processing. These DLLs contain unchecked buffers that could allow a long request to overflow these buffers and crash the IIS service. This hole has also been demonstrated to allow remote execution of arbitrary code and exploits have been made widely available.
Remedy:

Apply the Internet Information Server 4.0 ext-fix update.

Internet Information Server 4.0 users, apply the ext-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/IIS/iis-public/fixes/usa/ext-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

eEye Digital Security Team Alert AD06081999, Retina vs. IIS4, Round 2, http://www.eeye.com/database/advisories/ad06081999/ad06081999.html

Microsoft Security Bulletin MS99-019, Workaround Available for "Malformed HTR Request" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-019.asp

CIAC Information Bulletin J-048, J-048: Malformed HTR Request Vulnerability, http://ciac.llnl.gov/ciac/bulletins/j-048.shtml

Microsoft Knowledge Base Article Q234905, An Improperly Formatted HTTP Request Can Cause The Inetinfo Process To Fail, http://support.microsoft.com/support/kb/articles/q234/9/05.asp

CERT Advisory CA-99-07, IIS Buffer Overflow, http://www.cert.org/advisories/CA-99-07-IIS-Buffer-Overflow.html


SiteServer 3.0 AdSamples installation could expose SQL server login information

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: SiteServerCSC
Platforms: Microsoft SiteServer
Description:

Microsoft SiteServer 3.0 ships with an optional AdSamples directory that demonstrates the use of the Ad Server component of Site Server. If this directory is left open, it could be possible for remote attackers to retrieve a "SITE.CSC" file, which may contain database DSN's, logins, and passwords.
Remedy:

Remove the AdSamples directory from all production web servers.
References:

BUGTRAQ Mailing List, [ALERT] Site Server 3.0 May Expose SQL IDs and PSWs, http://www.netspace.org/cgi-bin/wa?A2=ind9905B&L=bugtraq&P=R1947

NT Security News, AdSamples Reveal ID and PSW, http://www.ntsecurity.net/scripts/loader.asp?iD=/security/siteserver-2.htm


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 46 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Backdoors
BackdoorPbbser | Simple Unix backdoor that can remotely add a predefined entry into the host's passwd file
SubsevenBackdoor | SubSeven Backdoor for Windows 9x allows unimpeded remote access to infected machines
CGI-Bin
CGI Textcounter | Textcounter CGI program allows remote command execution
CGI nphpublish | nph-publish CGI script could allow remote file writing
ColdFusionFileExists | ColdFusion sample program can be used to confirm existence of arbitrary file
ColdFusionFileRead | ColdFusion sample program can allow remote users to read any file
ColdFusionSource | ColdFusion sample can reveal source to any CFM file
ColdFusionSyntaxChecker | ColdFusion syntax checker can cause a system to use all processor resources
HttpCgiCounterLong | Long requests to Counter.exe web hit counter can deny further access attempts
Novell Files Script | Novell CGI script files.pl could allow remote file viewing
DNS
Bind DoS | Illegally formatted DNS request can crash some BIND servers
Bind bo | BIND Inverse-Query buffer overflow allows remote root access
Daemons
CDDBD detect | CDDB service detected
ICQClient | ICQ is distributed network of Internet chat clients and servers
Perl fingerd | perl fingerd program allows remote users to execute commands
VNCDetect | A Virtual Network Computing server was detected
VNCDetectNoConn | VNC detect no connections accepted
VNCNoAuth | VNC No Authentication Required
iParty denial of service | iParty server shuts down by sending characters to port
mSQLDetect | mSQL Database server is running
rwhod - vulnerable | Rwho daemon overflow
syslogflood | Syslog flood
E-mail
IMailIMAPOverflow | IMail IMAP service contains a buffer overflow
IMailWhoisOverflow | IMail's whois32 service can be remotely crashed
SMTP EXPN Buffer Overflow Attempt | SMTP EXPN buffer overflow can crash or obtain access
SMTP VRFY Buffer Overflow Attempt | SMTP VRFY buffer overflow can crash or obtain access
SMTPforgery | SMTP server allows fake hostnames in HELO
SMTPrcpt | SMTP daemons allow addresses to be verified via RCPT
SmtpHeloBo | SMTP HELO buffer overflow can crash or obtain access
Startech POP3 | Startech POP3 proxy contains a buffer overflow that can crash the service
smtpdebug | SMTP in debug mode
smtpdecode | Sendmail decode/uudecode alias could allow remote attackers to create files on the system
smtpexpn | SMTP EXPN command
smtprelay | Sendmail %style blind relaying can be used to obfuscate the origin of e-mails
smtpvrfy | SMTP verify (VRFY) command can be used to validate users
smtpwiz | Sendmail wizard (WIZ) backdoor allows anonymous remote root access
FTP
Palmetto FTP FTP remote buffer overflows allow root access
Firewalls
WinRouteConfig Winroute allows unrestricted access to proxy configuration
Information Gathering
IcmpNmask | ICMP netmask request response
IcmpTstamp | ICMP timestamp requests
Network
dataflood | Data flood
pingbomb | Ping of Death
UDP
UdpScan User Datagram Protocol (UDP) scan for active ports
Information Gathering
ColdFusionEvaluator | ColdFusion Expression Evaluator allows remote file manipulation, including creation
IIS HTR Overflow | IIS servers can be manipulated to execute arbitrary code from remote via an overflow in HTR requests
SiteServerCSC | SiteServer 3.0 AdSamples installation could expose SQL server login information


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 46 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
BackdoorPbbser | Simple Unix backdoor that can remotely add a predefined entry into the host's passwd file
Bind bo | BIND Inverse-Query buffer overflow allows remote root access
CGI Textcounter | Textcounter CGI program allows remote command execution
ColdFusionEvaluator | ColdFusion Expression Evaluator allows remote file manipulation, including creation
IIS HTR Overflow | IIS servers can be manipulated to execute arbitrary code from remote via an overflow in HTR requests
Palmetto FTP | FTP remote buffer overflows allow root access
Perl fingerd | perl fingerd program allows remote users to execute commands
SMTP EXPN Buffer Overflow Attempt | SMTP EXPN buffer overflow can crash or obtain access
SMTP VRFY Buffer Overflow Attempt | SMTP VRFY buffer overflow can crash or obtain access
SmtpHeloBo | SMTP HELO buffer overflow can crash or obtain access
SubsevenBackdoor | SubSeven Backdoor for Windows 9x allows unimpeded remote access to infected machines
UdpScan | User Datagram Protocol (UDP) scan for active ports
WinRouteConfig | Winroute allows unrestricted access to proxy configuration
smtpdebug | SMTP in debug mode
smtpdecode | Sendmail decode/uudecode alias could allow remote attackers to create files on the system
smtpwiz | Sendmail wizard (WIZ) backdoor allows anonymous remote root access
Low
CDDBD detect | CDDB service detected
ColdFusionFileExists | ColdFusion sample program can be used to confirm existence of arbitrary file
ICQClient | ICQ is distributed network of Internet chat clients and servers
IcmpNmask | ICMP netmask request response
IcmpTstamp | ICMP timestamp requests
SMTPforgery | SMTP server allows fake hostnames in HELO
SMTPrcpt | SMTP daemons allow addresses to be verified via RCPT
VNCDetect | A Virtual Network Computing server was detected
VNCDetectNoConn | VNC detect no connections accepted
VNCNoAuth | VNC No Authentication Required
iParty denial of service | iParty server shuts down by sending characters to port
mSQLDetect | mSQL Database server is running
smtpexpn | SMTP EXPN command
smtpvrfy | SMTP verify (VRFY) command can be used to validate users
Low
Bind DoS | Illegally formatted DNS request can crash some BIND servers
CGI nphpublish | nph-publish CGI script could allow remote file writing
ColdFusionFileRead | ColdFusion sample program can allow remote users to read any file
ColdFusionSource | ColdFusion sample can reveal source to any CFM file
ColdFusionSyntaxChecker | ColdFusion syntax checker can cause a system to use all processor resources
HttpCgiCounterLong | Long requests to Counter.exe web hit counter can deny further access attempts
IMailIMAPOverflow | IMail IMAP service contains a buffer overflow
IMailWhoisOverflow | IMail's whois32 service can be remotely crashed
Novell Files Script | Novell CGI script files.pl could allow remote file viewing
SiteServerCSC | SiteServer 3.0 AdSamples installation could expose SQL server login information
Startech POP3 | Startech POP3 proxy contains a buffer overflow that can crash the service
dataflood | Data flood
pingbomb | Ping of Death
rwhod - vulnerable | Rwho daemon overflow
smtprelay | Sendmail %style blind relaying can be used to obfuscate the origin of e-mails
syslogflood | Syslog flood