Tenable NeWT Security Reports
Start Time: Tue May 04 16:05:43 2004 Finish Time: Tue May 04 16:17:53 2004
localhost
7 Open Ports, 18 Notes, 7 Infos, 1 Holes.
127.0.0.1 [Return to top]
http (80/tcp)
Port is open
Plugin ID : 11219

A web server is running on this port
Plugin ID : 10330

The following directories require authentication:
/files
Plugin ID : 11032

Nessus was not able to reliably identify this server. It might be:
Ipswitch-IMail/8.02
The fingerprint differs from these known signatures on 10 point(s)

Plugin ID : 11919

The remote web server type is :

Tontito's Mirc Web Server v4.31.2

Solution : We recommend that you configure (if possible) your web server to return
a bogus Server header in order to not leak information.

Plugin ID : 10107

epmap (135/tcp)
Distributed Computing Environment (DCE) services running on the remote host
can be enumerated by connecting on port 135 and doing the appropriate queries.

An attacker may use this fact to gain more knowledge
about the remote host.

Solution : filter incoming traffic to this port.
Risk factor : Low

Plugin ID : 10736

Port is open
Plugin ID : 11219

microsoft-ds (445/tcp)
It was possible to log into the remote host using the following
login/password combinations :
'administrator'/''
'administrator'/'administrator'
'guest'/''
'guest'/'guest'

It was possible to log into the remote host using a NULL session.
The concept of a NULL session is to provide a null username and
a null password, which grants the user the 'guest' access

To prevent null sessions, see MS KB Article Q143474 (NT 4.0) and
Q246261 (Windows 2000).
Note that this won't completely disable null sessions, but will
prevent them from connecting to IPC$
Please see http://msgs.securepoint.com/cgi-bin/get/nessus-0204/50/1.html

The remote host defaults to guest when a user logs in using an invalid
login. For instance, we could log in using the account 'nessus/nessus'


All the smb tests will be done as 'administrator'/'' in domain WORKGROUP
CVE : *******
BID : 494, 990
Plugin ID : 10394

Here is the list of the SMB shares of this host :

DRIVERS -
IPC$ - Remote IPC
G$ - Default share
Downloads -
F$ - Default share
ADMIN$ - Remote Admin
C$ - Default share


This is potentially dangerous as this may help the attack
of a potential hacker.

Solution : filter incoming traffic to this port
Risk factor : Medium

Plugin ID : 10395

The remote registry can be accessed remotely using the login / password
combination used for the SMB tests.

Having the registry accessible to the world is not a good thing as it gives
extra knowledge to a hacker.

Solution : Apply service pack 3 if not done already, and set the key
HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
to restrict what can be browsed by non administrators.

In addition to this, you should consider filtering incoming packets to this
port.

Risk factor : Low
CVE : CAN-1999-0562

Plugin ID : 10400

The host Security Identifier (SID) can be obtained remotely. Its value is :

****** : ***********

An attacker can use it to obtain the list of the local users of this host

Solution : filter the ports 137-139 and 445
Risk factor : Low

CVE : CVE-2000-1200
BID : 959

Plugin ID : 10859

Here is a list of files which have been found on the remote SMB shares.
Some of these files may contain copyrighted materials, such as commercial
movies or music files.

If any of this file actually contains copyrighted material and if
they are freely swapped around, your organization might be held liable
for copyright infrigement by associations such as the RIAA or the MPAA.

+ C$ :



+ ADMIN$ :



+ F$ :



+ Downloads :



+ G$ :



+ IPC$ :



+ DRIVERS :





Solution : Delete all the copyrighted files

Plugin ID : 11777

Port is open
Plugin ID : 11219

A CIFS server is running on this port
Plugin ID : 11011

The remote native lan manager is : Windows 2000 LAN Manager
The remote Operating System is : Windows 5.1
The remote SMB Domain Name is : WORKGROUP

Plugin ID : 10785

Nessus did not access the remote registry completely,
because this needs to be logged in as administrator.

If you want the permissions / values of all the sensitive
registry keys to be checked for, we recommend that
you fill the 'SMB Login' options in the
'Prefs.' section of the client by the administrator
login name and password.

Risk factor : None

Plugin ID : 10428

blackjack (1025/tcp)
Port is open
Plugin ID : 11219

Distributed Computing Environment (DCE) services running on the remote host
can be enumerated by connecting on port 135 and doing the appropriate queries.

An attacker may use this fact to gain more knowledge
about the remote host.


Here is the list of DCE services running on this port:

UUID: *********, version 1
Endpoint: ncacn_ip_tcp:127.0.0.1[1025]

UUID: **********, version 1
Endpoint: ncacn_ip_tcp:127.0.0.1[1025]

UUID: **********, version 1
Endpoint: ncacn_ip_tcp:127.0.0.1[1025]



Solution : filter incoming traffic to this port.
Risk Factor : Low

Plugin ID : 10736

mysql (3306/tcp)
The remote host is running Remote PC Access Server.

This service could be used by an attacker to partially take control of the remote
system if they obtain the credentials necessary to log in (through a brute force
attack or by sniffing the network, as this protocol transmits usernames and
passwords in plain text).

An attacker may use it to steal your password or prevent your system from working
properly.


Solution : Disable this service if you do not use it.
Risk factor : Medium

Plugin ID : 11673

Port is open
Plugin ID : 11219

An unknown service is running on this port.
It is usually reserved for MySQL
Plugin ID : 10330

Remote MySQL version : 4.0.17-nt
Plugin ID : 10719

commplex-main (5000/tcp)
The remote host is running Microsoft UPnP TCP helper.

If the tested network is not a home network, you should disable
this service.

Solution : Set the following registry key :
Location : HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
Key : Start
Value : 0x04


Risk Factor : Low
CVE : CVE-2001-0876
BID : 3723

Plugin ID : 11765

Port is open
Plugin ID : 11219

general/tcp
127.0.0.1 resolves as localhost.
Plugin ID : 12053

ntp (123/udp)
A NTP (Network Time Protocol) server is listening on this port.

Risk factor : Low

Plugin ID : 10884