🚀 go-pugleaf

Bin zwar nicht selber betroffen, wurde aber vorgewarnt und habe einige
Scans laufen lassen:

Happy Hacking, wenn der wieder online geht ;-)

magma:~ # nmap -O line608-basel.datacomm.ch

Starting nmap V. 2.51 by fyodor@insecure.org ( www.insecure.org/nmap/ )
Interesting ports on line608-basel.datacomm.ch (212.254.34.188):
(The 1493 ports scanned but not shown below are in state: closed)
Port       State       Service
9/tcp      open        discard
13/tcp     open        daytime
21/tcp     open        ftp
23/tcp     open        telnet
25/tcp     open        smtp
37/tcp     open        time
79/tcp     open        finger
80/tcp     open        http
109/tcp    open        pop-2
110/tcp    open        pop-3
111/tcp    open        sunrpc
113/tcp    open        auth
139/tcp    open        netbios-ssn
143/tcp    open        imap2
512/tcp    open        exec
513/tcp    open        login
514/tcp    open        shell
515/tcp    open        printer
540/tcp    open        uucp
825/tcp    open        unknown
901/tcp    open        samba-swat
948/tcp    open        unknown
949/tcp    open        unknown
1000/tcp   open        cadlock
1024/tcp   open        unknown
3306/tcp   open        mysql
6000/tcp   open        X11

TCP Sequence Prediction: Class=random positive increments
                         Difficulty=3674984 (Good luck!)
Remote operating system guess: Linux 2.1.122 - 2.2.14

Nmap run completed -- 1 IP address (1 host up) scanned in 51 seconds

Nessus Scan Report
------------------



SUMMARY

 - Number of hosts which were alive during the test : 1
 - Number of security holes found : 5
 - Number of security warnings found : 22
 - Number of security notes found : 37



TESTED HOSTS

 212.254.34.188 (Security holes found)



DETAILS

+ 212.254.34.188 :
 . List of open ports :
   o discard (9/tcp) (Security notes found)
   o discard (9/udp)
   o daytime (13/tcp) (Security warnings found)
   o daytime (13/udp) (Security warnings found)
   o ftp (21/tcp) (Security hole found)
   o telnet (23/tcp) (Security warnings found)
   o smtp (25/tcp) (Security warnings found)
   o time (37/tcp) (Security notes found)
   o time (37/udp)
   o finger (79/tcp) (Security notes found)
   o www (80/tcp) (Security hole found)
   o pop2 (109/tcp) (Security hole found)
   o pop3 (110/tcp) (Security notes found)
   o sunrpc (111/tcp) (Security warnings found)
   o sunrpc (111/udp) (Security warnings found)
   o auth (113/tcp) (Security warnings found)
   o netbios-ns (137/udp) (Security warnings found)
   o netbios-dgm (138/udp)
   o netbios-ssn (139/tcp) (Security warnings found)
   o imap2 (143/tcp) (Security notes found)
   o xdmcp (177/udp)
   o exec (512/tcp) (Security warnings found)
   o login (513/tcp) (Security warnings found)
   o shell (514/tcp) (Security warnings found)
   o printer (515/tcp) (Security notes found)
   o talk (517/udp)
   o ntalk (518/udp) (Security notes found)
   o uucp (540/tcp) (Security notes found)
   o unknown (800/udp)
   o unknown (825/tcp) (Security warnings found)
   o unknown (826/udp) (Security hole found)
   o swat (901/tcp) (Security notes found)
   o unknown (914/udp) (Security warnings found)
   o unknown (948/tcp) (Security warnings found)
   o unknown (949/tcp) (Security warnings found)
   o unknown (1000/tcp) (Security warnings found)
   o unknown (1022/udp)
   o unknown (1023/udp) (Security warnings found)
   o unknown (1024/tcp) (Security notes found)
   o mysql (3306/tcp) (Security notes found)
   o unknown (6000/tcp) (Security notes found)
   o general/tcp (Security notes found)
   o general/udp (Security notes found)
   o general/icmp (Security warnings found)

 . Information found on port discard (9/tcp)


    This service is owned by user root

 . Warning found on port daytime (13/tcp)


    The daytime service is running.
    The date format issued by this service
    may sometimes help an attacker to guess
    the operating system type. 
    
    In addition to that, when the UDP version of
    daytime is running, an attacker may link it 
    to the echo port using spoofing, thus creating
    a possible denial of service.
    
    Solution : disable this service in /etc/inetd.conf.
    
    Risk factor : Low
    CVE : CVE-1999-0103

 . Information found on port daytime (13/tcp)


    This service is owned by user root

 . Warning found on port daytime (13/udp)


    The daytime service is running.
    The date format issued by this service
    may sometimes help an attacker to guess
    the operating system type. 
    
    In addition to that, when the UDP version of
    daytime is running, an attacker may link it 
    to the echo port using spoofing, thus creating
    a possible denial of service.
    
    Solution : disable this service in /etc/inetd.conf.
    
    Risk factor : Low
    CVE : CVE-1999-0103

 . Vulnerability found on port ftp (21/tcp) : 


    It was possible to get the listing of the remote root
    directory by issuing the command
    
    LIST C:\
    The data we could get is :
    0
    An attacker may use this flaw to retrieve arbitrary files on this
    server.
    Solution : if you are using broker ftp, upgrade to the latest version, or
    contact your vendor for a patch
    Risk factor :
     High

 . Vulnerability found on port ftp (21/tcp) : 


    
    The remote ftp server does not sanitize properly the argument of
    the SITE EXEC command.
    It may be possible for a remote attacker
    to gain root access.
    
    Solution : Upgrade your wu-ftpd server (<= 2.6.0 are vulnerables)
    or disable any access from untrusted users (especially anonymous).
    
    Risk factor : Serious
    CVE : CVE-2000-0573

 . Warning found on port ftp (21/tcp)


    The FTP service allows anonymous logins. If you do not
     want to share data with anyone you do not know, then you should deactivate
     the anonymous account, since it can only cause troubles.
     Under most Unix system, doing : 
     	echo ftp >> /etc/ftpusers
     will correct this.
     
     Risk factor : Low
    CVE : CAN-1999-0497

 . Information found on port ftp (21/tcp)


    This service is owned by user root

 . Information found on port ftp (21/tcp)


    Remote FTP server banner :
     rossa.localhost ftp server (version wu-2.5.0(1) mon feb 21 16:21:03 mst
     2000) ready.

 . Warning found on port telnet (23/tcp)


    The Telnet service is running.
    This service is dangerous in the sense that
    it is not ciphered - that is, everyone can sniff
    the data that passes between the telnet client
    and the telnet server. This includes logins
    and passwords.
    
    You should disable this service and use OpenSSH instead.
    (www.openssh.com)
    
    Solution : Comment out the 'telnet' line in /etc/inetd.conf.
    
    Risk factor : Low
    CVE : CAN-1999-0619

 . Information found on port telnet (23/tcp)


    This service is owned by user root

 . Information found on port telnet (23/tcp)


    Remote telnet banner :
    
    
    Caldera OpenLinux(TM)
    



 . Warning found on port smtp (25/tcp)


    The remote SMTP server
    answers to the EXPN and/or VRFY commands.
    
    The EXPN command can be used to find 
    the delivery adress of mail aliases, or 
    even the full name of the recipients, and 
    the VRFY command may be used to check the 
    validity of an account.
    
    
    Your mailer should not allow remote users to
    use any of these commands, because it gives
    them too much informations.
    
    
    Solution : if you are using sendmail, add the 
    option
    	O PrivacyOptions=goaway
    in /etc/sendmail.cf.
    
    Risk factor : Low
    CVE : CAN-1999-0531

 . Information found on port smtp (25/tcp)


    This service is owned by user root

 . Information found on port smtp (25/tcp)


    Remote SMTP server banner :
    rossa.localhost ESMTP Sendmail 8.9.3/8.9.3
     Sat, 30 Dec 2000 00:04:08 +0100
    502 Sendmail 8.9.3 -- HELP not
     implemented


 . Information found on port time (37/tcp)


    This service is owned by user root

 . Information found on port finger (79/tcp)


    This service is owned by user root

 . Vulnerability found on port www (80/tcp) : 


    We could DELETE the file '/index.html'on your web server
    This allows an attacker to destroy some of your pages
    Solution : disable this method
    Risk factor :
     Serious


 . Information found on port www (80/tcp)


    This service is owned by user nobody

 . Information found on port www (80/tcp)


    The remote web server type is :
    Apache/1.3.11 (Unix) mod_perl/1.21 PHP/3.0.14
    
    
    We recommend that you configure your web server to return
    bogus versions, so that it makes the cracker job more difficult

 . Vulnerability found on port pop2 (109/tcp) : 


    
    The remote pop2 server allows the reading of arbitrary
    files for authenticated users, using the 'fold' command.
    
    Solution : upgrade
    Risk factor :
     Serious


 . Information found on port pop2 (109/tcp)


    This service is owned by user root

 . Information found on port pop3 (110/tcp)


    This service is owned by user root

 . Information found on port pop3 (110/tcp)


    The remote POP server banner is :
    +OK POP3 line608-basel.datacomm.ch v7.64 server ready

 . Warning found on port sunrpc (111/tcp)


    The RPC service rpcbind V2 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port sunrpc (111/tcp)


    This service is owned by user bin

 . Warning found on port sunrpc (111/udp)


    The RPC service rpcbind V2 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Warning found on port auth (113/tcp)


    The 'ident' service provides sensitives informations
    to the intruders : it mainly says which accounts are running which
    services. This helps attackers to focus on valuable services [those
    owned by root]. If you don't use this service, disable it.
    
    Risk factor : Low.
    
    Solution : comment out the 'auth' line in /etc/inetd.conf
    CVE : CAN-1999-0629

 . Information found on port auth (113/tcp)


    This service is owned by user root

 . Warning found on port netbios-ns (137/udp)


    . The following 7 NetBIOS names have been gathered :
     ROSSA          
     ROSSA          
     ROSSA          
     
__MSBROWSE__
     LAVORA         
     LAVORA         
     LAVORA         
    
    . This SMB server seems to be a SAMBA server (this is not a security
    risk, this is for your information). This can be told because this server 
    claims to have a null MAC address
    
    If you do not want to allow everyone to find the NetBios name
    of your computer, you should filter incoming traffic to this port.
    
    Risk factor :
     Medium


 . Warning found on port netbios-ssn (139/tcp)


    A 'rfpoison' packet has been sent to the remote host.
    This packet is supposed to crash the 'services.exe' process,
    rendering the system instable.
    If you see that this attack was successful, have a look
    at this page : 
       http://www.wiretrip.net/rfp/p/doc.asp?id=23&iface=2
    CVE : CVE-1999-0721

 . Information found on port netbios-ssn (139/tcp)


    This service is owned by user root

 . Information found on port imap2 (143/tcp)


    This service is owned by user root

 . Warning found on port exec (512/tcp)


    
    The rexecd service is open. 
    Because rexecd does not provide any good
    means of authentification, it can be
    used by crackers to scan a third party
    host, giving you troubles or bypassing
    your firewall.
    
    Solution : comment out the 'exec' line 
    in /etc/inetd.conf.
    
    Risk factor : Medium
    CVE : CAN-1999-0618

 . Information found on port exec (512/tcp)


    This service is owned by user root

 . Warning found on port login (513/tcp)


    The rlogin service is running.
    This service is dangerous in the sense that
    it is not ciphered - that is, everyone can sniff
    the data that passes between the rlogin client
    and the rlogin server. This includes logins
    and passwords.
    
    You should disable this service and use openssh instead
    (www.openssh.com)
    
    Solution : Comment out the 'rlogin' line in /etc/inetd.conf.
    
    Risk factor : Low
    CVE : CAN-1999-0651

 . Information found on port login (513/tcp)


    This service is owned by user root

 . Warning found on port shell (514/tcp)


    The rsh service is running.
    This service is dangerous in the sense that
    it is not ciphered - that is, everyone can sniff
    the data that passes between the rsh client
    and the rsh server. This includes logins
    and passwords.
    
    You should disable this service and use ssh instead.
    
    Solution : Comment out the 'rsh' line in /etc/inetd.conf.
    
    Risk factor : Low
    CVE : CAN-1999-0651

 . Information found on port shell (514/tcp)


    This service is owned by user root

 . Information found on port printer (515/tcp)


    This service is owned by user daemon

 . Information found on port ntalk (518/udp)


    
    talkd is running (talkd is the server that notifies a user 
    that someone else wants to initiate a conversation) 
    
    Malicious hackers may use it to abuse legitimate
    users by conversing with them with a false identity
    (social engineering). 
    In addition to this, crackers may use this service
    to execute arbitrary code on your system.
    
    Solution: Disable talkd access from the network by adding the 
    approriate rule on your firewall. If you do not
    need talkd, comment out the relevant line in /etc/inetd.conf.
    
    See aditional information regarding the dangers of keeping 
    this port open:
    http://www.cert.org/advisories/CA-97.04.talkd.html
    
    Risk factor : Medium
    CVE : CVE-1999-0048

 . Information found on port ntalk (518/udp)


    talkd protocol version: 1
    CVE : CVE-1999-0048

 . Information found on port uucp (540/tcp)


    This service is owned by user root

 . Warning found on port unknown (825/tcp)


    The RPC service nfs V2 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port unknown (825/tcp)


    This service is owned by user root

 . Vulnerability found on port unknown (826/udp) : 


    
    The amd RPC service is running. 
    There is a bug in older versions of
    this service that allow an intruder to
    execute arbitrary commands on your system.
    
    Please check :
    http://www.redhat.com/corp/support/errata/RHSA1999032_O1.html
    
    To determine whether you are vulnerable.
    
    Risk factor :
     High


 . Warning found on port unknown (826/udp)


    The RPC service amd V1 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port swat (901/tcp)


    This service is owned by user root

 . Warning found on port unknown (914/udp)


    The RPC service rstatd V1-5 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk

 . Warning found on port unknown (914/udp)


    
    The rstatd RPC service is running. 
    It provides an attacker interesting
    informations such as :
    
    	- the CPU usage
    	- the system uptime
    	- its network usage
    	- and more
    	
    It usually not a good idea to let this
    service open
    
    
    Risk factor : Low
    CVE : CAN-1999-0624

 . Warning found on port unknown (948/tcp)


    The RPC service RPC (Unknown Prog # is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port unknown (948/tcp)


    This service is owned by user root

 . Warning found on port unknown (949/tcp)


    The RPC service RPC (Unknown Prog # is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port unknown (949/tcp)


    This service is owned by user root

 . Warning found on port unknown (1000/tcp)


    a web server is running on this
     port


 . Information found on port unknown (1000/tcp)


    This service is owned by user root

 . Information found on port unknown (1000/tcp)


    The remote web server type is :
    MiniServ/0.01
    
    
    We recommend that you configure your web server to return
    bogus versions, so that it makes the cracker job more difficult

 . Warning found on port unknown (1023/udp)


    The RPC service nfs V2 is running on this port
    If you do not use it, disable it, as it is
    a potential security
     risk


 . Information found on port unknown (1024/tcp)


    This service is owned by user root

 . Information found on port mysql (3306/tcp)


    This service is owned by user root

 . Information found on port unknown (6000/tcp)


    This service is owned by user root

 . Information found on port general/tcp


    Nmap found that this host is running Linux 2.1.122 - 2.2.14

 . Information found on port general/udp


    For your information, here is the traceroute to 212.254.34.188 : 
    194.230.2.197
    194.230.2.193
    ?
    212.254.32.64
    212.254.34.188

 . Warning found on port general/icmp


    
    The remote host answers to an ICMP timestamp
    request. This allows an attacker to know the
    date which is set on your machine. 
    
    This may help him to defeat all your 
    time based authentifications protocols.
    
    Solution : filter out the icmp timestamp
    requests (13), and the outgoing icmp 
    timestamp replies (14).
    
    Risk factor : Low
    CVE : CAN-1999-0524




------------------------------------------------------
This file was generated by the Nessus Security Scanner

-- 
Benoit Panizzon

ASCII-Ribon Campaign
""""""""""""""""""""
No HTML or WORD in Mails
HTML is for WEB, Word is for Micro$oft.
** Get stoned - drink wet concrete