Chip 2001 May/W2KPRK.iso/apps/InternetScanner/data1.cab/Program_Files/readme.txt

Text File | 1999-11-22 | 32KB | 805 lines

INTERNET SCANNER VERSION 6.0 RELEASE NOTES

=============================================================================

    CONTENTS
    --------

  1.  NEW FEATURES
    1.1 New Structured Scanning Methodology and Default Scan Policies
    1.2 Policy Editor
    1.3 X-Press Updates
    1.4 Database Scanner Integration
    1.5 Internet Scanner 5.3 to 6.0 Migration Kit
    1.6 New Vulnerability Checks
    1.7 UDP Port Scanning
    1.8 New Reports
    1.9 New Help System

  2.  SYSTEM REQUIREMENTS
    2.1 Processor
    2.2 Operating System
    2.3 Other software
    2.4 Memory (RAM)
    2.5 Memory (RAM) required for large scans
    2.6 Hard Disk
    2.7 User privileges
    2.8 Network
    2.9 Protocol
    2.10 Display

  3.  SUGGESTIONS
    3.1 Reviewing Configuration When Enabling Vulnerabilities
    3.2 Reviewing Configuration of Scan Policies from earlier versions
    3.3 Scanner 6.0 Beta Policies
    3.4 Exporting Scanner Reports to PDF
    3.5 Interpreting the Results of UDP Port Scans
    3.6 Maximum Parallel Scan Threads

  4.  INSTALLING THE RAW PACKET DRIVER

  5.  SETUP

  6.  TOOLS
    6.1 Internet Scanner 5.3 to 6.0 Migration Utilities
    6.2 Pinger Utility

  7.  KNOWN ISSUES
    7.1 Windows NT Problem with Large Scans
    7.2 Raw Packet Driver with PGP 6.5
    7.3 Traceroute Check
    7.4 TelnetOpen Check
    7.5 Rwhod and Rwhod-vuln
    7.6 ICQ Client
    7.7 FlexChecks
    7.8 RipAppend Check
    7.9 Error Exiting Scanner with Multiple Sessions Open

  8.  SCANNER 5.81 ISSUES RESOLVED in 6.0
    8.1 Cwdleak Check
    8.2 SNMPShowInterface Check

=============================================================================

1.  NEW FEATURES
    ------------
WhatÆs New in Internet Scanner 6.0:

1.1 New Structured Scanning Methodology and Default Scan Policies

Internet Scanner 6.0 embodies a structured approach to scanning that will
increase the accuracy of the information obtained, reduce network load
during the scan, ensure that security fix efforts are strongly focused on
the most important systems in the organization, and make it much easier to
target reports to individual system administrators.  To facilitate this,
Internet Scanner includes many new scan policies targeted towards specific
security "Levels".  Five levels are defined in the default policies, and are
explained below.  Versions of scan policies are provided for various
operating systems, system types, or system use. Internet Scanner uses the
following security levels to define and to implement the most important
tasks for the security program:

Level 1 policies identify which devices are on the network, and what
Operating System they are running.

    * L1 Inventory

Level 2 policies classify the systems based on the application services they
offer.

    * L2 Classification
    * L2 Database Discovery

Level 3 policies test susceptibility to external system compromise
from trivial attacks used by unsophisticated adversaries, or detect signs
that the system is already compromised.

    * L3 Desktop
    * L3 NT Server
    * L3 NT Web Server
    * L3 Router & Switch
    * L3 Unix Server
    * L3 Unix Web Server

Level 4 policies test susceptibility to external system compromise
from automated attack tools.

    * L4 NT Server
    * L4 NT Web Server
    * L4 Router & Switch
    * L4 Unix Server
    * L4 Unix Web Server

Level 5 policies test resistance to password cracking attacks and
susceptibility to external system compromise from very knowledgeable
adversaries.

    * L5 NT Server
    * L5 NT Web Server
    * L5 Unix Server
    * L5 Unix Web Server

These security levels are cumulative, that is, all Level 3 checks are
included in the Level 4 and Level 5 policies.  Using cumulative tools
allows your organization to add increased security attention to the
systems that warrant increased attention, without spending increased
effort on less valuable assets.

IMPORTANT NOTE: The old standard policies (Heavy, Medium, and Light) are
obsolete and will no longer be updated by ISS.  This is because they
do not directly support the goals of increased accuracy, minimized network
load, incremental application of security to specific systems, and more
targeted report output.  Existing 5.x scan policies have been migrated
forward to 6.0. Adding specific checks to these policies is much easier
with the new policy editor, described below.

See the help file, ISS_NT.chm, for detailed descriptions about each
default scan policy included with Internet Scanner 6.0.


1.2 Policy Editor

The new Policy Editor arranges configurable properties in a folder tree,
letting you sort, group, and browse through global settings, vulnerability
checks, services, and accounts that you can enable for your policy. This
Policy Editor replaces the tabbed Configuration dialog box that was used
in Internet Scanner 5.x.

Because of the tree structure, it is now simple to do some tasks that were
very tedious in the previous versions of Internet Scanner.  In particular,
selecting a branch of the tree enables all checks that reside in this branch.
For example, clicking the selection box next to the CGI-Bin tree will enable
all 23 checks in that category.  Previous versions of Internet Scanner
required the user to select each check individually.

The folder tree settings include:

    * Common Settings (brute force options, ports to scan, etc)
    * FlexChecks
    * Vulnerabilities
    * Services
    * Accounts

You can arrange the Policy EditorÆs folder tree in four different views:

    * Standard View (separates the Denial of Service exploits from the
      rest of the vulnerabilities, but still maintains the vulnerability
      categories)

    * Risk View (sorts the vulnerabilities by High, Medium, and Low, but
      does not separate the Denial of Service exploits in the category
      list).  Note that this view makes it very easy to add new high-risk
      checks to existing policies.

    * Category View (works like the Standard View, but does not separate
      the Denial of Service exploits in the category list)

    * Built-In/Plug-Ins View (shows categories of the vulnerability
      checks, but distinguishes between Built-In Exploits or Plug-In
      Exploits)

The Policy Editor also contains a browser-enabled window used for:

    * Viewing information on each vulnerability check, such as the
      vulnerabilityÆs description, the platforms affected by the
      vulnerability, the vulnerabilityÆs risk level, the vulnerabilityÆs
      remedy information, and additional reference information.

    * Accessing external Web sites that may contain additional fix
      information, patches, or updates.

    * Linking directly to the X-Force Knowledge Base.

If you want to build a very targeted policy or look for certain kinds of
checks based on similar data, use the Policy Editor's powerful new searching
features to search through names, short descriptions, full descriptions, and
fix information in the vulnerability database.

To perform focused Boolean searches on the vulnerability checks in the
Policy Editor, use the search engine of the Vulnerability Catalog help file
(VulnCatalog.chm) located in Scanner6/Help or access the help file directly
from the help file, ISS_NT.chm. For example, searching on the text string
"cert" would find all checks that referenced a CERT advisory.


1.3 X-Press Updates

X-Press Updates automatically update your system with the latest plug-in
checks and the latest product updates available for Internet Scanner,
without having to download and to re-install a new version of Internet
Scanner.

X-Press Updates are available from a secure server on the ISS Web site, and
can be installed on your system automatically via the Web using the X-Press
Updates install program. Or, you can download the X-Press Updates from the
ISS Web site using the X-Press Updates install program to your local
directory or to a network share and then choose from either of those
locations which updates you would like to install on your system.

Please note that the X-Press Update install program does not automatically
execute when you run Internet Scanner.  You must run this program manually,
or schedule execution of the program.  ISS does not use or recommend the
use of "push" technologies for security-enforcing products.

For information on how to use X-Press Updates, view the X-Press Updates
help file (XPressUpdate.chm) in Scanner6/XPressUpdate or in Scanner6/Help.

NOTE: These updates must be installed sequentially and removed in reverse
order, which is automatically enforced by the X-Press Updates install program.

There are two e-mail forums that provide information on X-Press Updates and
automatically e-mail you when there are new X-Press Updates for you to
install on your system. See the  product for details on subscribing to these
services.


1.4 Database Scanner Integration

Internet Scanner 6.0 operationally integrates functions of Database Scanner
(Microsoft SQL Server, Oracle, or Sybase Adaptive Server) that have been
deployed in your organization, and assesses the risk associated with those
servers. Through the built in Database Discovery checks for the above
servers, Internet Scanner locates the various database servers on your
network and then will automatically configure and scan those servers by
launching Database Scanner.

ISS is offering a free, full function Database Scanner license for one each
Oracle, Sybase, and SQL Server database to all users of Internet Scanner
currently under software maintenance.  Contact your ISS sales representative,
send email to [e-mail], or visit the ISS Web site at http://www.iss.net
for information on getting this Database Scanner license. To get your Database
Scanner license key, visit the ISS web site at http://www.iss.net/prod/dbspromo.


1.5 Internet Scanner 5.3 to 6.0 Migration Kit

Internet Scanner provides capabilities for easily moving Unix vulnerability
data and 5.3 scan policies to 6.0. The command-line migration kit
executables, db2u.exe and u2db.exe, are located in the Scanner6 Tools
directory. The help file, ISS_NT.chm, provides the reference topic "IS 5.3
Unix checks in IS 6.0" that maps the check names from 5.3 into 6.0. Use db2u
and u2db to import and to export data in CSV format to and from Internet
ScannerÆs database. To migrate policies from Internet Scanner 5.3 to
Internet Scanner 6.0, copy the 5.3 policy file to Scanner6/Policy, and then
open the policy in the 6.0 Policy Editor.

Note: the vulnerability migration tools db2u.exe and u2db.exe can also be
used to move vulnerability data between different instances of Internet
Scanner 6.0, or to export the Internet Scanner 6.0 data to an external
database system like Oracle for post-scan processing.  The tools translate
between Internet Scanner native database format and comma separated value
(CSV) format.


1.6 New Vulnerability Checks

Internet Scanner 6.0 includes 67 new vulnerability checks, including more
than 30 new checks for malicious backdoor programs (such as BackOrifice
2000) that attackers use to remotely control computers:

Risk    VulnID    Check Name                Category

High    625    Perl fingerd                Daemons
High    886    SmtpHeloBo                E-mail
High    887    SMTP VRFY Buffer Overflow Attempt    E-mail
High    888    SMTP EXPN Buffer Overflow Attempt    E-mail
High    895    Bind bo                    DNS
High    1212    IIS RDS                    Web Scan
High    1400    CgiPerlMailPrograms            Web Scan
High    1728    Palmetto FTP                FTP
High    1740    ColdFusionEvaluator            Web Scan
High    1890    QpopperPASSOverflow            E-mail
High    2052    CGI Textcounter                CGI-Bin
High    2079    WinRouteConfig                Firewalls
High    2178    BackdoorPbbser                Backdoors
High    2240    CMailCommandBO                E-mail
High    2245    SubsevenBackdoor            Backdoors
High    2281    IIS HTR Overflow            Web Scan
High    2310    EvilFTP Backdoor            Backdoors
High    2321    NetSphere Backdoor            Backdoors
High    2322    GateCrasher Backdoor            Backdoors
High    2324    GirlFriend Backdoor            Backdoors
High    2325    Hack'a'tack Backdoor            Backdoors
High    2326    BackdoorPhasezero            Backdoors
High    2343    BackdoorBo2k                Backdoors
High    2384    NetscapeGetBo                Web Scan
High    2386    BackdoorComa                Backdoors
High    2387    BackdoorForcedentry            Backdoors
High    2389    BackdoorBackdoor2            Backdoors
High    2390    BackdoorNetmonitor            Backdoors
High    3099    BackdoorBlazer5                Backdoors
High    3100    BackdoorFrenzy                Backdoors
High    3110    BackdoorHvlrat                Backdoors
High    3111    BackdoorMillenium            Backdoors
High    3112    BackdoorProsiak                Backdoors
High    3113    BackdoorHackersparadise            Backdoors
High    3118    BackdoorSchwindler            Backdoors
High    3119    BackdoorProgenic            Backdoors
High    3120    BackdoorTheThing            Backdoors
High    3122    BackdoorDeltasource            Backdoors
High    3130    BackdoorDoly15                Backdoors
High    3131    BackdoorAolAdmin            Backdoors
Medium    896    Bind DoS                DNS
Medium    1630    UnityMail web server dos        Web Scan
Medium    1741    ColdFusionSource            CGI-Bin
Medium    1742    ColdFusionSyntaxChecker            CGI-Bin
Medium    1744    ColdFusionFileRead            CGI-Bin
Medium    1895    IMailIMAPOverflow            E-mail
Medium    1899    IMailWhoisOverflow            E-mail
Medium    2054    Novell Files Script            CGI-Bin
Medium    2055    CGI nphpublish                CGI-Bin
Medium    2088    Startech POP3                E-mail
Medium    2196    HttpCgiCounterLong            CGI-Bin
Medium    2229    IIS ExAir DoS                Web Scan
Medium    2239    CmailFileread                E-mail
Medium    2241    FTGateRead                E-mail
Medium    2242    NTMailFileRead                E-mail
Medium    2270    SiteServerCSC                Web Scan
Low    1416    iParty denial of service        Daemons
Low    1743    ColdFusionFileExists            CGI-Bin
Low    1894    VNCDetect                Daemons
Low    1921    SMTPforgery                E-mail
Low    1928    SMTPrcpt                E-mail
Low    1986    VNCDetectNoConn                Daemons
Low    1988    VNCNoAuth                Daemons
Low    2210    ICQClient                Daemons
Low    2211    mSQLDetect                Daemons
Low    2227    CDDBD detect                Daemons
Low    2388    OracleDetect                Daemons

Note that Internet Scanner can now produce a report of all checks that are
installed (from the View/Installed X-Press Modules menu option), and can list
all checks that are enabled in any policy (from the Policy/Properties menu
option).  This information can be printed, or copied to the Windows clipboard
via a right mouse click.


1.7 UDP Port Scanning

Internet Scanner Version 6.0 performs an exhaustive UDP port scan by using
various UDP packets to determine the status of a port.


1.8 New Reports

In addition to many improvements to existing reports, Internet Scanner
6.0 now includes Executive level reports in Italian and condensed Host
Vulnerability Summary reports at the Line Management and Technical level.
Improvements have been made to reports that are exported to HTML
or Microsoft Word, allowing more effective distribution of security
information in the organization.


1.9 New Help System

The help system now uses HTML pages to display the help information. The
help information for each vulnerability check is taken directly out of
the X-Force database to ensure consistency and accuracy.


2.  SYSTEM REQUIREMENTS
    -------------------

Internet Scanner 6.0 system requirements are:

2.1 Processor

200 MHz Pentium Pro (300 MHz Pentium recommended)

2.2 Operating System

Windows NT 4.0 Workstation (with ServicePack 4).  ISS strongly recommends
using a dedicated system for scanning.

ISS is providing beta support for users running Windows 2000 Workstation
(Beta 3). The device driver will not work on Windows NT 2000, meaning a small
number of checks that require access to raw IP sockets (spoofing, etc) will
not work, but other checks and functionality will be unaffected.

IMPORTANT: Internet Scanner is not supported on Windows NT 3.51 or
Windows NT 4.0 Server.

(FOR INTERNATIONAL USERS: ISS does not formally support scanning from
localized versions of Windows NT 4.0 or Windows 2000. If you attempt to
scan from these systems, please report your results to [e-mail].
The US English version of Windows NT 4.0 supports the display of other
language groups (based on different codepages) shipped with those versions.
(For example, the US version does not ship with character-based Asian
languages or Arabic). If you are an international user, you can run US
English Windows NT 4.0 as your OS and still run non-Unicode, non-ISS
applications localized for your area.)

2.3 Other software

Microsoft Internet Explorer 4.x or later required to run HTML Help.

2.4 Memory (RAM)

80 MB

2.5 Memory (RAM) required for large scans

128 MB (Console mode or command line scans recommended)
NOTE: See Known Issue 7.1, Windows NT Problem with Large Scans.

2.6 Hard Disk

180 MB for installation from file
60 MB for installation from CD-ROM
Running: 55 MB plus 2.5 MB per 100 hosts
NTFS partition recommended

2.7 User privileges

Local or Domain Administrator

2.8 Network

Ethernet or Token Ring connected to an active network.

CAUTION: Internet Scanner on a Token Ring network does not perform
some vulnerability checks - see the Internet Scanner 6.0 Getting Started
Guide or the Internet Scanner 6.0 User Guide for more details.

2.9 Protocol

TCP/IP

2.10 Display

Monitor that supports 800x600 resolution with a minimum of 256 colors.


3.  Suggestions
    -----------

3.1 Reviewing Configuration When Enabling Vulnerabilities

When you enable a new vulnerability in a policy, review the policy's
configuration settings.


3.2 Reviewing Configuration of Scan Policies from earlier versions

Some of your 5.x migrated policies may not have all the configuration
variables set that are required to make the policies actually execute once
they have been migrated to 6.0. ISS recommends that you visually inspect your
migrated policies, especially the following variables:

        Web Zone Checks
    Sun CMSD BO FlexCheck
    IIS HTR Overflow
    Linux Inetd

If necessary, turn the variables on or set the appropriate configuration
variables.


3.3 Scanner 6.0 Beta Policies

Scan policies created by Internet Scanner 6.0 Beta may not load or
function properly with the version 6.0 production release. You should
re-enter these policies.


3.4 Exporting Scanner Reports to PDF

Exporting Internet Scanner 6.0 Reports to PDF format allows distribution
of reports in a widely supported format, as well as preserves the quality
of the original documents and avoids common problems that are associated
with exporting directly from Crystal Reports to Microsoft Word or HTML
format. ISS has identified a tool from Adobe Software called PDFWriter
that allows this capability.  PDFWriter acts like a printer driver to Windows
applications, but actually outputs the print job to a file in PDF format.
Selecting Acrobat PDFWriter Assistant as the printer driver in the
printers Control Panel, print the document using this print driver.
PDFWriter then generates a PostScript file, launches Acrobat Distiller,
asks you to specify a name and location for your PDF file, converts the
PostScript file into a PDF file, and opens the PDF file in an Acrobat viewer.
Acrobat 3.0x and above for Windows includes Acrobat Writer Assistant. The
file can be viewed with any Acrobat reader.

PDFWriter is available from Adobe, at http://www.adobe.com.


3.5 Interpreting the Results of UDP Port Scans

UDP port scanning is subject to possible variable results, due to the
fundamental differences between UDP and TCP.  Since UDP is an unreliable
(datagram) protocol, there is no equivalent of the TCP 3 Way handshake that
can be used to identify the existence of services listening on particular
ports.  Instead, the target system will respond with ICMP Port Unreachable
messages (ICMP type 3, code 3).  However, ICMP itself is an unreliable
protocol, so these packets can be dropped or lost due to host or network
contention.  Further complicating the matter is technology built into certain
operating systems to throttle the generation of ICMP unreachable messages -
Linux and Solaris in particular implement this technology.

ISS recommends analyzing the results reported from UDP port scans.  If it
appears that an excessive number of ports are reported as active, ISS
recommends scanning individual hosts to verify the results, and tuning the
UDP port scan parameters down (i.e. increase the wait between UDP packets
sent by the scanner) to lessen the load on the network or host, and to avoid
operating system security mechanisms that will degrade the accuracy of the
results.  ISS recommends that the UDP Smart Filter be disabled for these
verification tests.

See the Help section for the UDP port scan for details on tuning the UDP
scan parameters.


3.6 Maximum Parallel Scan Threads

The Maximum Parallel Scan Threads default setting is 128. To reduce the
impact of Internet Scanner on system resource consumption, reduce this
setting to 64 in the Internet Scanner Tools Menu, Options.


4. Installing the Raw Packet Driver
   --------------------------------

To install the ISS Raw Packet Driver, follow these steps:

1. From the Windows NT desktop, right-click the Network Neighborhood
icon and select Properties. This action is a shortcut to the Network
control panel.
2. Click the Services tab to display the installed network services.
3. Click Add to display the Select Network Service window.
4. Click Have Disk to display the Insert Disk window.
5. The Insert Disk window requests the location of the driver software.
The default path is C:\Program Files\ISS\Scanner6\Driver. Otherwise, the
ISS Raw Packet Driver is located in the Driver folder where Internet
Scanner was installed.
6. Click OK to display the Select OEM Options window.
7. Select the ISS Raw Packet Driver software and click OK. The ISS
Raw Packet Driver appears in the Network control panel.
8. Click OK to close this window.
9. Reboot your NT system.


5.   Setup
     -----

Setting TCP/IP Parameters

When Windows NT attempts to make a socket connection, it sends out a SYN
packet to the remote computer, and waits for a reply. If no reply occurs
within the time out period (three seconds by default), it then doubles
the time out period, and retries the connection attempt.

Every socket left open in this state consumes non-pageable kernel
memory, and if too many sockets are not resolved, the host can run out
of RAM. Since the problem is caused by non-pageable RAM consumption,
Windows NT will essentially halt, and you will experience approximately
two minute waits on response to toggling a caps lock key. The system will
eventually recover, but it could take hours. ISS has advised Microsoft
of this problem, and advised them that the amount of non-page pool that
open sockets can consume should be a tunable parameter. However, Microsoft
has not (to the best of ISS' knowledge) conceded that this is actually a
problem, and to be fair, only an extremely intensive application such as
Internet Scanner may be capable of reproducing this problem.

This problem typically occurs while scanning a network where ICMP traffic is
filtered. If ICMP traffic is not filtered, the host machine can reply to a
connection attempt with either a SYN-ACK (success), or an ICMP port
unreachable. In either case, the connection attempt can be resolved.

To avoid this potential performance degradation, open the Registry editor
(either regedit.exe, or regedt32.exe), locate the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters key,
and insert the following values:

TcpMaxConnectAttempts, with type REG_DWORD, and a value of 3,
TcpMaxConnectRetransmissions, with type REG_DWORD, and a value of 3

You must restart your system before these changes will take effect. For
additional information regarding these parameters, please consult your
Windows NT Resource Kit.

If you want to see how the scan is progressing, run a tail -f on the
temporary log files (located in the .\tmp directory with a .tmplog
extension).  If you do not have UNIX CLI utilities, these utilities may
be available at ftp://ftp.cc.utexas.edu/microlib/nt/gnu/. Or, you can type
the file to a command prompt. In the GUI version, you can view the status
window.

Internet Scanner lets you scan the local host without a key. If you want
to evaluate the product further and scan other machines on your network,
you can obtain an expanded key from [e-mail] or by calling
1-800-776-2362.

WARNING: Internet Scanner can inflict various denial of service
attacks. Be very careful when you enable these scans. ISS has run into
instances where scans that were not known to cause denial of service
actually did so. This situation is unusual, but has been known to occur.

WARNING: The OOB check WILL crash your host if you have not patched it.

Remember to reboot your system or the Raw Packet Driver won't work.


6.  Tools
    -----

Internet Scanner tools and utilities are located in the Scanner6 Tools
directory.

The following tools are developed and supported by ISS:

6.1 Internet Scanner 5.3 to 6.0 Migration Utilities

Internet Scanner provides capabilities for easily moving 5.3 vulnerability
data and 5.3 scan policies to Windows NT. The command-line migration kit
executables, db2u.exe and u2db.exe, are located in the Scanner6 Tools
directory. The help file, ISS_NT.chm, provides a reference topic "IS 5.3
Unix checks in IS 6.0" that maps the checks from 5.3 into 6.0.

Use db2u and u2db to import and to export data in CSV format to and from
Internet ScannerÆs database. To migrate policies from Internet Scanner 5.3
to Internet Scanner 6.0, copy the 5.3 policy file to Scanner6/Policy, and
then load the policy in the Policy Editor.

Db2u v1.0 will take an entry in NT Internet Scanner 6.0 database and convert
the entry to CSV files that the UNIX Internet Scanner 5.3 can read and
create reports with. Usage:

db2u "list"
or
db2u <jobid | "last"> <directory>

"db2u list" will print out a table of all the current scans that are in the
6.0 database. The table contains the job ID of the scan, the date and time
the scan started, session file name and any comment entered for that scan.
If the jobid is known or discovered by doing a list, then it is easy to
extract the information. For example, if the jobid of the scan you want
to extract is 4 and you want to put it in a directory named "CSVScan4",
type:

"db2u 4 C:\CSVScan4"

The directory will now contain the CSV files necessary for the UNIX
scanner to create a report. "db2u last C:\CSVScanLast" will put the latest
scan that is in the NT Internet Scanner 6.0 database and put it into CSV
format in the directory CSVScanLast.

NOTE: The program db2u will not auto create the destination directory. The
directory needs to exist before the program is run.

U2db v1.0 will take a directory that contains CSV files generated by the
UNIX Internet Scanner 5.3 and import them into the NT Internet Scanner
6.0 database. Usage:

u2db <directory>

The program u2db works by entering the directory that contains the CSV
files that you would like to import into the NT Internet Scanner 6.0.
Once successful, a report can be made by using the NT Internet Scanner 6.0.

NOTE: Currently the program u2db will only look for scans with the prefix
"iss". If the scan you are attempting to import has a different prefix, it
will not work.


6.2 Pinger Utility

The pinger utility, pinger.exe, will send ICMP echo requests to a range of
IP addresses and track the hosts that respond. See the document
pingerdoc.txt located in the Scanner6 Tools directory for instructions.


7.  Known Issues
    ------------

7.1 Windows NT Problem with Large Scans

Certain scanning situations have been found to exercise a bug in Windows NT
which causes Windows NT to crash with an error in the RDR.SYS driver.  If
you want to run large scans, please follow these recommendations:

    * Refrain from using multiple concurrent sessions.

    * Use the Ping all Hosts in Range option when scanning from the GUI.

    * Use the PINGER.EXE found in the tools directory to screen out
       inactive hosts when performing command-line scans.

    * Break up large scans into multiple smaller sessions.

    * Use a dedicated scan machine with no other applications running.

This problem has been reported to Microsoft.  ISS is working with Microsoft to
resolve this situation.  If you are unable to follow these recommendations,
please contact ISS technical support for further assistance.


7.2 Raw Packet Driver with PGP 6.5

PGPnet application of PGP 6.5 is present on the PC and Internet
Scanner 6.0 Raw Packet Driver is installed:   Since PGPnet is a
"network-based" sub-application of PGP, it will effectively impose its
adapter configuration settings on the machine if:  (1) You elect to proceed
on with the PGPnet installation prompts after installing the ISS raw packet
driver and re-booting, and (2) The installation host has only one available
network card installed.  This means that any previous network card definitions
and settings will be suppressed, and the administrator will not be given the
option to select his previous adapter settings while in the "TCP/IP
properties" panel in Control Panel/Network. The result is that you will lose
previous network connectivity to/from the host.
To avoid this issue: (1) Disable PGPnet control of the network card under the
"Programs -> PGP - > PGPnet -> Set Adapter " menu option (if PGPnet is already
in control) or (2) After you have installed the ISS Raw Packet driver and
re-booted, "cancel" out of the PGPnet configuration prompts to 'Secure a
Network Card' (This means that you will not be able to use PGPnet on a host
with a single network card).


7.3 Traceroute Check

TraceRoute is based on ICMP and UDP, which are known to be unreliable
protocols. This check may potentially lose packets, resulting in false
negatives when combined in a policy with other checks that produce high
amounts of network traffic (UDP Port Scan, synflood, etc.).


7.4 TelnetOpen Check

The telnetOpen check may result in a Denial of Service if you run it against a
machine that is running the Startech POP3 server. This machine will remain in
a functioning state but the service is disabled.


7.5 Rwhod and Rwhod-vuln

In previous releases, rwhod and rwhod-vuln were separate vulnerabilities. In
version 6.0, rwhod will show up as a service found, not a vulnerability, and
rwhod-vuln will remain a vulnerability.


7.6 ICQ Client

The ICQClient may bind at any port, causing inconsistent behavior from one
boot to the next. The ICQClient check has been configured to scan the most
likely ports, using a default port range from 1024 to 2124. Scanning this
entire port range could take a considerable amount of time, as the check
determines if the client is bound to a port somewhere within the default
range.  However, it is possible that the client may be bound outside the
port range entered, which could result in a false negative.


7.7 FlexChecks

The 3 FlexChecks: SUN CMSD BO, Lotus LDAP BO, and AMD-BO are not included
during installation, and instead have been placed on ISS' Web site at
www.iss.net.


7.8 RipAppend Check

The RipAppend check has been disabled due to false positives.  This issue
will be resolved in the next release.


7.9 Error Exiting Scanner with Multiple Sessions Open

It has been reported that when exiting the Scanner program with multiple
sessions still open an exception error may sometimes occur. This will not
affect your machine or your data. If you experience this please email ISS
technical support with a screen shot of the exception.


8.  Scanner 5.81 Issues Resolved in 6.0
    -----------------------------------

8.1 Cwdleak Check

The cwdleak check, which consistently returned false positives in the 5.x
releases, has been fixed in 6.0.


8.2 SNMPShowInterface Check

The SNMPShowInterface caused an exception in 5.x; this has been
corrected in 6.0.