abel.mat.ufpb.br

Repartition of the level of the security problems :

List of open ports :

• ftp (21/tcp) (Security warnings found)
• smtp (25/tcp) (Security notes found)
• domain (53/tcp) (Security hole found)
• www (80/tcp) (Security notes found)
• pop3 (110/tcp) (Security notes found)
• netbios-ssn (139/tcp)
• unknown (1351/tcp) (Security hole found)
• unknown (3128/tcp) (Security warnings found)
• postgres (5432/tcp)
• general/tcp (Security warnings found)
• netbios-ns (137/udp) (Security warnings found)
• general/udp (Security notes found)
• snmp (161/udp) (Security hole found)
• general/icmp (Security warnings found)

Warning found on port ftp (21/tcp)

The FTP service allows anonymous logins. If you do not
want to share data with anyone you do not know, then you should deactivate
the anonymous account, since it can only cause troubles.
Under most Unix system, doing :
echo ftp >> /etc/ftpusers
will correct this.

Risk factor : Low
CVE : CAN-1999-0497

Information found on port ftp (21/tcp)

Remote FTP server banner :
abel.mat.ufpb.br ftp server ready.

Information found on port smtp (25/tcp)

Remote SMTP server banner :
0
0

Vulnerability found on port domain (53/tcp)

The remote BIND server, according to its
version number, is vulnerable to various buffer
overflows that may allow an attacker to
gain a shell on this host.

Solution : upgrade to bind 8.2.3 or 4.9.8
Risk factor : High

Vulnerability found on port domain (53/tcp)

The remote BIND server, according to its
version number, is vulnerable to the ZXFR
bug that allows an attacker to disable it
remotely.

Solution : upgrade to bind 8.2.2-P7
Risk factor : High

Warning found on port domain (53/tcp)

The remote name server allows recursive queries to be performed
by the host running nessusd.

If this is your internal nameserver, then forget this warning.

If you are probing a remote nameserver, then it allows anyone
to use it to resolve third parties names (such as www.nessus.org).
This allows hackers to do cache poisoning attacks against this
nameserver.


Solution : Restrict recursive queries to the hosts that should
use this nameserver (such as those of the LAN connected to it).
If you are using bind 8, you can do this by using the instruction
'allow-recursion' in the 'options' section of your named.conf

If you are using another name server, consult its documentation.

Risk factor : Serious

Information found on port domain (53/tcp)

The remote bind version is : 8.2.2-P3

Information found on port www (80/tcp)

The remote web server type is :
Apache/1.3.6 (Unix) (Red Hat/Linux) PHP/3.0.7


We recommend that you configure your web server to return
bogus versions, so that it makes the cracker job more difficult

Information found on port pop3 (110/tcp)

The remote POP server banner is :
+OK POP3 abel.mat.ufpb.br v7.59 server ready

Vulnerability found on port unknown (1351/tcp)

You are running a version of SSH which is
older than version 1.2.32,
or a version of OpenSSH which is older than
2.3.0.

This version is vulnerable to a flaw which
allows an attacker to insert arbitrary commands
in a ssh stream.

Solution :
Upgrade to version 1.2.32 of SSH which solves this problem,
or to version 2.3.0 of OpenSSH

More information:
http://www.core-sdi.com/english/ssh/

Risk factor : High

Warning found on port unknown (1351/tcp)

a ssh server is running on this port

Warning found on port unknown (1351/tcp)

You are running a version of SSH which is
older than (or as old as) version 1.2.27.
If this version was compiled against the
RSAREF library, then it is very likely to
be vulnerable to a buffer overflow which
may be exploited by a cracker to gain
root on your system.

To determine if you compiled ssh against
the RSAREF library, type 'ssh -V' on the
remote host.

Risk factor : High
Solution : Use ssh 2.x, or do not compile ssh
against the RSAREF library
CVE : CVE-1999-0834

Warning found on port unknown (1351/tcp)

You are running a version of SSH which is
older than (or as old as) version 1.2.27.

If you compiled ssh with kerberos support,
then an attacker may eavesdrop your users
kerberos tickets, as sshd will set
the environment variable KRB5CCNAME to
'none', so kerberos tickets will be stored
in the current working directory of the
user, as 'none'.

If you have nfs/smb shared disks, then an attacker
may eavesdrop the kerberos tickets of your
users using this flaw.

** If you are not using kerberos, then
ignore this warning.

Risk factor : Serious
Solution : use ssh 1.2.28 or newer
CVE : CAN-2000-0575

Information found on port unknown (1351/tcp)

Remote SSH version : ssh-1.5-1.2.27

Warning found on port unknown (3128/tcp)

a web server is running on this port

Warning found on port unknown (3128/tcp)

an HTTP proxy is running on this port

Warning found on port unknown (3128/tcp)

The Sambar webserver is running. It provides a webinterface for sending emails.
You may simply pass a POST request to /session/sendmail and by this send mails to anyone you want.
Due to the fact that Sambar does not check HTTP referers you do not need direct access to the server!

See http://www.toppoint.de/~hscholz/sambar for more information.

Solution : Try to disable this module. There might be a patch in the future.

Risk factor : High

Information found on port unknown (3128/tcp)

The remote web server type is :
Squid/2.1.PATCH2


We recommend that you configure your web server to return
bogus versions, so that it makes the cracker job more difficult

Warning found on port general/tcp

The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host.

An attacker may use this feature to determine if the remote
host sent a packet in reply to another request. This may be
used for portscanning and other things.

Solution : Contact your vendor for a patch
Risk factor : Low

Information found on port general/tcp

Nmap found that this host is running Linux 2.1.122 - 2.2.16

Warning found on port netbios-ns (137/udp)

. The following 5 NetBIOS names have been gathered :
ABEL
ABEL
ABEL
DM
DM

. This SMB server seems to be a SAMBA server (this is not a security
risk, this is for your information). This can be told because this server
claims to have a null MAC address

If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.

Risk factor : Medium

Information found on port general/udp

For your information, here is the traceroute to 150.165.135.1 :
150.165.250.100
150.165.254.254
150.165.254.35
150.165.135.1

Vulnerability found on port snmp (161/udp)

SNMP Agent responded as expected with community name: public
CVE : CAN-1999-0517

Warning found on port snmp (161/udp)

It was possible to obtain the list of Lanman shares of the
remote host via SNMP :

.




An attacker may use this information to gain more knowledge about
the target host.
Solution : disable the SNMP service on the remote host if you do not
use it, or filter incoming UDP packets going to this port
Risk factor : Low

Warning found on port snmp (161/udp)

SNMP Agent port open, it is possible to execute
SNMP GET and SET, (with the proper community names)

Warning found on port snmp (161/udp)

It was possible to obtain the list of SMB users of the
remote host via SNMP :

.




An attacker may use this information to set up brute force
attacks or find an unused account.

Solution : disable the SNMP service on the remote host if you do not
use it, or filter incoming UDP packets going to this port
Risk factor : Medium

Warning found on port general/icmp

The remote host answers to an ICMP timestamp
request. This allows an attacker to know the
date which is set on your machine.

This may help him to defeat all your
time based authentifications protocols.

Solution : filter out the icmp timestamp
requests (13), and the outgoing icmp
timestamp replies (14).

Risk factor : Low
CVE : CAN-1999-0524