Telnet available with no login

Risk Level: High risk vulnerability High

Check or Attack Name: TelnetOpen
Platforms: Any
Description:

Users can Telnet to this machine without a login. An attacker can access sensitive information through default accounts or easily guessed passwords.
Remedy:

Disable the Telnet account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed.

To remove login access for a Unix account, follow these steps:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled Guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Change the password on this account to something difficult to guess, or disable login access to this Windows account.

To change a password on a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. In the Password field, type a new password.
  4. In the Confirm Password field, confirm the new password.
  5. Click OK.

—OR—

To disable login access to a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager
  2. Double-click the account to display the User Properties dialog box.
  3. Select the Account Disabled check box.
  4. Click OK.
References:


Telnet default account accessible

Risk Level: High risk vulnerability High

Check or Attack Name: deftel
Platforms: Any
Description:

An accessible default account was detected through Telnet. Default accounts through Telnet allow attackers easy access to remote systems.

Warning: Software that scans some Unix systems may cause the system to halt if the shutdown/shutdown or halt/halt accounts/password pairs exist. For a good security policy, these accounts should be removed, renamed, or at the very least contain a difficult to guess password.
Remedy:

Disable the Telnet account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed.

To remove login access for a Unix account, follow these steps:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled Guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Change the password on this account to something difficult to guess, or disable login access to this Windows account.

To change a password on a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the account to display the User Properties dialog box.
  3. In the Password field, type the new password.
  4. In the Confirm Password field, confirm the new password.
  5. Click OK.

—OR—

To disable login access to a Windows account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager./LI>
  2. Double-click the account to display the User Properties dialog box.
  3. Select the Account Disabled check box.
  4. Click OK.
References:


DNS bad sequence

Risk Level: | Low risk vulnerability Low | Check or Attack Name: dnsbadseq
Platforms: | DNS
Description: | An attempt to send a reply to a DNS server with a bad sequence number has been made. DNS servers should not accept out of sequence replies.
Remedy: | Update your DNS server.
References: |


DNS server inverse queries

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: iquery
Platforms: | DNS
Description: | The Inverse Query (iquery) feature supported on some DNS servers should not be used. An attacker can use this feature to obtain a zone transfer. Zone transfers identify every machine registered with your DNS server and can be used by attackers to better understand your network. The zone transfer occurs even if you've disabled zone transfers on your DNS server.
Remedy: | Configure your DNS server to disable inverse queries. For more information on inverse queries, see RFC 1035, "Domain Names - Implementation and Specification" available from ftp://ftp.isi.edu/in-notes/rfc1035.txt.
References: | Request for Comment document RFC 1035, Domain Names - Implementation and Specification, ftp://ftp.isi.edu/in-notes/rfc1035.txt Acme Byte & Wire LLC, Securing Your Name Server, http://www.acmebw.com/securing/index.htm


DNS service reverse lookup

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: DnsRev
Platforms: | Any
Description: | One or more services on a machine use DNS for either logging or authentication. Services that use DNS for authentication are vulnerable to DNS spoofing attacks.
Remedy: | Verify your DNS servers are fully patched in order to minimize your exposure to DNS spoofing attacks.
References: |


DNS allow updates can corrupt name server

Risk Level: | Low risk vulnerability Low | Check or Attack Name: dnsupdates
Platforms: | BIND
Description: | The BIND name server is compiled to allow dynamic updates via the -DALLOW_UPDATES define. Allowing dynamic updates permits an attacker to corrupt your server.
Remedy: | Recompile your name server without the -DALLOW_UPDATES option. Refer to your vendor's documentation for more information. For more information or an updated version of BIND, see the Internet Software Consortium's (ISC) BIND page at http://www.isc.org/bind.html.
References: | Internet Software Consortium (ISC), BIND (Berkeley Internet Name Domain) page, http://www.isc.org/bind.html


DNS honors zone transfer requests

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: zonexfer
Platforms: | Any
Description: | The DNS server honors zone transfer requests. Zone transfers identify every machine registered with your DNS server, and can be used by attackers to better understand your network.
Remedy: | Configure your DNS server to prevent zone transfers. Refer to your DNS server's documentation for details.
References: |


Windows NT DNS denial of service attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: ntdnsdos
Platforms: Windows NT, DNS
Description:

The DNS server that ships with Windows NT 4.0 is vulnerable to a number of denial of service attacks.
Remedy:

Update your DNS server. See Microsoft's FTP site for details at ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/.
References:

Fyodor's Exploit World, Another way to crash NT DNS server, http://www.insecure.org/sploits/NT.DNS.character_flood.html

Microsoft Knowledge Base Article Q169461, Access Violation in DNS.EXE Caused by Malicious Telnet Attack, http://support.microsoft.com/support/kb/articles/Q169/4/61.asp

Microsoft Knowledge Base Article Q142047, Bad Network Packet May Cause Access Violation (AV) on DNS Server, http://support.microsoft.com/support/kb/articles/Q142/0/47.asp

Microsoft Knowledge Base Article Q154984, DNS Server May Not Recursively Resolve Some Names, http://support.microsoft.com/support/kb/articles/Q154/9/84.asp

Microsoft Knowledge Base Article Q154985, DNS Registry Key Not Updated When Changing Zone Type, http://support.microsoft.com/support/kb/articles/Q154/9/85.asp

Microsoft Knowledge Base Article Q167629, Predictable Query IDs Pose Security Risks for DNS Servers, http://support.microsoft.com/support/kb/articles/Q167/6/29.asp

, ,


DNS version denial of service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DNS version
Platforms: Windows NT
Description:

This version of Windows NT 4.0 DNS is vulnerable to denial of service and spoofing attacks. These attacks can allow an attacker to access sensitive information.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or the post-SP2 dns-fix patch.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

If Windows NT 4.0 Service Pack 3 (SP3) or later cannot be applied, Windows NT 4.0 SP2 users must obtain and install the post-SP2 dns-fix hotfix available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/dns-fix.
References:

Fyodor's Exploit World, Another way to crash NT DNS server, http://www.insecure.org/sploits/NT.DNS.character_flood.html

Microsoft Knowledge Base Article Q169461, Access Violation in DNS.EXE Caused by Malicious Telnet Attack, http://support.microsoft.com/support/kb/articles/Q169/4/61.asp

Microsoft Knowledge Base Article Q142047, Bad Network Packet May Cause Access Violation (AV) on DNS Server, http://support.microsoft.com/support/kb/articles/Q142/0/47.asp

Microsoft Knowledge Base Article Q154984, DNS Server May Not Recursively Resolve Some Names, http://support.microsoft.com/support/kb/articles/Q154/9/84.asp

Microsoft Knowledge Base Article Q154985, DNS Registry Key Not Updated When Changing Zone Type, http://support.microsoft.com/support/kb/articles/Q154/9/85.asp

Microsoft Knowledge Base Article Q167629, Predictable Query IDs Pose Security Risks for DNS Servers, http://support.microsoft.com/support/kb/articles/Q167/6/29.asp


Chargen service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: chargen
Platforms: Any
Description:

The chargen service was detected as running. The chargen (port 19) service can be spoofed into sending data from one service on one machine to another service on another machine. This action causes an infinite loop and creates a denial of service attack. The attack can consume increasing amounts of network bandwidth, causing loss of performance or a total shutdown of the affected network segments.

In addition, URLs such as "http://localhost:19" could cause a similar denial of service to a system running Lynx and chargen. Netscape Navigator disallows access to port 19 and is not vulnerable.
Remedy:

Disable the service, unless it is needed.

Unix: To disable chargen when started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the chargen daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

Windows: The chargen service is not native to Windows, but may be present. To disable only the chargen service, follow these steps:

  1. Open the registry editor.
  2. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SimpTcp\Parameters.
  3. Double-click the EnableTcpChargen key to display the DWORD Editor.
  4. Replace the value in the Data field with 0.
  5. Click OK.
  6. Repeat steps 3 through 5 for the EnableUdpChargen key.
  7. To implement your changes, stop and restart the Simple TCP/IP Service.
References:

CERT Advisory CA-96.01, UDP Port Denial-of-Service Attack, http://www.cert.org/advisories/CA-96.01.UDP_service_denial.html

BUGTRAQ Mailing List, Doctor Who (drwho@L0PHT.COM), Lynx/MSIE denial-of-service, http://www.geek-girl.com/bugtraq/1997_1/0264.html

CERT Advisory CA-96.01, UDP Port Denial-of-Service Attack, ftp://info.cert.org/pub/cert_advisories/CA-96.01.UDP_service_denial


Finger bomb recursive request

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: fingerbomb
Platforms: Finger Service
Description:

The system is vulnerable to the Finger Bomb. Finger Bomb allows an attacker to disrupt your network using the redirection capability in the finger daemon.

Some finger daemons allow redirecting a finger request to remote sites using the form finger username@hostname1@hostname2. The finger will go through hostname2, then to hostname1. This technique helps attackers cover their tracks, because hostname1 will see a finger coming from hostname2 instead of from the original service. This technique has been used to go through firewalls, if they are not properly configured. This can happen by using the command finger user@host@firewall.

An attacker could also use a recursive finger, such as finger username@hostname@hostname@hostname. Finger will call itself repeatedly, using more resources until the machine has consumed all its resources. A similar denial of service attack may happen when an attacker types finger username@@@@@@@@@@@@@@@@@@@@@hostname1. The repeated @ causes finger to repeatedly finger the same machine until the memory and hard drive swap space fill up. This causes the machine to stop or slow to an unusable speed.
Remedy:

Disable finger, or install a version of finger that turns off redirection. GNU Finger can be configured to not allow redirection.

Unix: Disable the finger daemon. To disable a Unix daemon started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

To turn off finger redirection, Unix systems can use GNU finger available from ftp://prep.ai.mit.edu/pub/gnu/finger-1.37.tar.gz.

Windows: Fingerd is not native to Windows, but may be present. To disable fingerd, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.
References:


Netstat Inet service

Risk Level: Low risk vulnerability Low

Check or Attack Name: netstat
Platforms: Unix, Solaris: 2.5.1
Description:

Some systems are configured to run the netstat program as a network service. This allows remote users to view the networking status, including running services and connected clients, of the machine by connecting to the netstat port, generally TCP port 15.
Remedy:

Disable the daemon:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls netstat.
  3. Type a # at the beginning of the line to comment out netstat.
  4. Restart inetd.
References:


Open/Close connection flood

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: openclose
Platforms: Any
Description:

The Open/Close connection flood attack opens and closes connections at a high rate to a port serviced by an external service through inetd. An attacker can cause some services to slow or disallow incoming connections, resulting in a denial of service attack.

Most inetd servers set a limit to the number of connections allowed in a short period of time in order to prevent an out of control client from overrunning the system resources. If this number is quickly exceeded, the inetd server will shut off incoming connections for some amount of time (usually 6 minutes). The number of connections allowed before inetd shuts off is hard-coded into the inetd source code.
Remedy:

Increase the number of connections permitted before inetd shuts down the connection.

The number of connections allowed before inetd shuts off is hard-coded into the inetd source code. If you have source code available, you can increase the value of the number in the line: #define TOOMANY at the top of the inetd.c code.

If you do not have access to inetd source code, or do not feel comfortable making this change, contact your vendor for information on how to increase this value.
References:


Sysstat

Risk Level: | Low risk vulnerability Low | Check or Attack Name: sysstat
Platforms: | Unix
Description: | The sysstat service was detected as running. Sysstat gives an attacker information, such as who is online and the identity of trusted hosts.
Remedy: | Disable the sysstat daemon by commenting it out of /etc/inetd.conf and restarting inetd.
References: |


IMAP-4.1BETA server can be crashed with a core file containing hashed passwords

Risk Level: | High risk vulnerability High | Check or Attack Name: imapd Core Vulnerability
Platforms: | Internet Message Access Protocol (IMAP)
Description: | IMAP-4.1BETA from the University of Washington's IMAP 4.1 toolkit contains a vulnerability that allows a remote attacker to cause the service to core dump. The core file contains the shadow password file, which can then be used to break into accounts on the system. The attacker is required to have an account on the system to exploit this hole.
Remedy: | Upgrade to the latest stable IMAP server package available from your vendor.
References: | L0pht Security Advisory, imapd (imap-4.1BETA from the IMAP 4.1 toolkit from University of Washington), http://www.l0pht.com/advisories/imapd.txt


Qmail length denial of service attack

Risk Level: Low risk vulnerability Low

Check or Attack Name: qmailswap
Platforms: Qmail: 1.01 and earlier
Description:

This attack starves the target of swap resources by sending a large number of bytes of filler as an SMTP command.

False Positive: It's possible that a very large e-mail on a single line will trigger this signature, but not represent an attack.
Remedy:

Upgrade your version of qmail to 1.02 or later. See http://www.qmail.org/.
References:


Qmail RCPT denial of service attack

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: qmailrecipient
Platforms: | Qmail: 1.01 and earlier
Description: | A vulnerability exists within Qmail that could render the server unusable. By sending a RCPT command to the server with an extremely large number of recipients it is possible to cause the Qmail server to exhaust all the system's resources and crash.
Remedy: | Upgrade your version of Qmail to 1.02 or later.
References: | QMAIL Mailing List, qmail-dos-2.c, another denial of service attack, http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/msg00322.html Qmail Home Page, qmail: a replacement for sendmail, http://www.qmail.org/top.html


SMTP daemon supports EHLO

Risk Level: | Low risk vulnerability Low | Check or Attack Name: EhloCheck
Platforms: | SMTP servers
Description: | SMTP daemons that support Extended HELO (EHLO) will release useful information to potential attackers. Attackers have been known to use the EHLO command to determine configuration information on SMTP daemons.
Remedy: | Reconfigure your SMTP server to not support these extended features if you are not comfortable with the information they reveal.
References: |


SMTP Exchange denial of service

Risk Level: High risk vulnerability High

Check or Attack Name: SMTP DoS for MS Exchange
Platforms: Microsoft Exchange: 4.0, Microsoft Exchange: 5.0
Description:

Microsoft Exchange Server 4.0 and 5.0 contain a buffer overflow in multiple commands (HELO, RCPT TO, and MAIL FROM) that could allow a remote attacker to crash the server and under some circumstances possibly execute arbitrary code on the system. The attack itself does not directly have any impact on the integrity of data stored by the Exchange Server.
Remedy:

Upgrade to Microsoft Exchange 5.5.

—OR—

Microsoft Exchange 5.0 users must apply Microsoft Exchange Service Pack 1 (SP1) available at http://support.microsoft.com/support/downloads/LNP489.asp.
References:

Microsoft Knowledge Base Article Q169174, XFOR: IMS Halts if RFC821 Address Over 1k in Size is Received, http://support.microsoft.com/support/kb/articles/q169/1/74.asp

Microsoft Personal Support Center, Support Downloads for Exchange Server, http://support.microsoft.com/support/downloads/LNP489.asp


Sendmail remote execution

Risk Level: High risk vulnerability High

Check or Attack Name: smtpexec
Platforms: Unix
Description:

The sendmail program allows commands to be remotely executed. An attacker can gain access through sendmail and execute commands on the system.
Remedy:

Obtain and install a patch from your vendor for the sendmail pipe bug, or obtain and install a newer version of sendmail available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail. For specific patch IDs and detailed information, see the appropriate manufacturer or CERT Advisory listed in the References.

References:

CERT Advisory CA-96.20, Sendmail Vulnerabilities, http://www.cert.org/advisories/CA-96.20.sendmail_vul.html

CERT Advisory CA-96.24, Sendmail Daemon Mode Vulnerability, http://www.cert.org/advisories/CA-96.24.sendmail.daemon.mode.html

Hewlett-Packard Security Bulletin HPSBUX9602-029, Security Vulnerability in HP-UX syslog(3) subroutine, http://us-support.external.hp.com/

SCO Document ID TA107704, What is the SLS OSS449F Network Maintenance Supplement?, http://www.sco.com/ta/

CERT Advisory CA-95.13, Syslog Vulnerability - A Workaround for Sendmail, http://www.cert.org/ftp/cert_advisories/CA-95:13.syslog.vul

CIAC Information Bulletin G-09b, Unix sendmail vulnerability, http://ciac.llnl.gov/ciac/bulletins/g-09b.shtml

CERT Advisory CA-96.25, Sendmail Group Permissions Vulnerability, http://www.cert.org/advisories/CA-96.25.sendmail_groups.html


User .forward file found

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: badforwards
Platforms: | SMTP servers
Description: | Selected e-mail accounts may contain dangerous .forward files. The ability to forward (or pipe ) the delivered mail message to add-on programs or scripts can result in undesired or dangerous outcomes. These programs and scripts may contain security loopholes, and an attacker sending e-mail could take advantage of the exploit.
Remedy: | Thoroughly check your user's .forward files to see if any of them allow messages to be piped to add-on programs or scripts. Examine each .forward file for the pipe (|) character. An example of a potentially bad forward is: \user, "| /usr/local/bin/filter user"
References: |


Sendmail daemon outdated

Risk Level: | High risk vulnerability High | Check or Attack Name: smtp_outdated
Platforms: | Sendmail: Old
Description: | The sendmail version on the machine is no longer actively supported. All versions of sendmail prior to 8.7.0 are considered vulnerable. This vulnerability is derived from the version string in the sendmail banner.
Remedy: | Obtain and install a newer version of sendmail available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail.
References: | Sendmail Consortium, Sendmail FAQ, http://www.sendmail.org/faq


Syslog buffer overflow allows remote execution through network daemons

Risk Level: High risk vulnerability High

Check or Attack Name: smtpsyslog
Platforms: Sendmail, Ultrix, AIX: 3.2, AIX: 4.1, HPUX: 10.00, HPUX: 10.09, HPUX: 8.x, HPUX: 9.x, IRIX: 3.x, IRIX: 4.x, IRIX: 5.x, IRIX: 6.0.1, IRIX: 6.1, SCO OpenServer, Solaris: 2.3, Solaris: 2.4, SunOS: 4.1.3, HPUX: 10.01, IRIX: 6.0, Solaris: 2.4 x86, OSF: 1.0, SunOS: 4.1.4, SunOS: 4.1.3_U1
Description:

In many older Unix systems, a buffer overflow exists in the syslog shared libraries. A process or attacker that logs user-supplied strings to the system log files could execute arbitrary programs on the target machine as root.

The syslog libraries use an internal buffer to build messages that are sent to the syslogd daemon. The subroutines within these libraries do not perform range checking on data stored in this buffer. It is possible to overflow the internal buffer, rewrite the subroutine call stack, and thus execute arbitrary programs.

The sendmail program uses the syslog library subroutines. It is therefore possible to exploit this bug from a remote machine and gain root access on a machine running sendmail.

This bug affects any sendmail versions prior to v8.8.5.
Remedy:

Contact your vendor for patches for the Syslog buffer overflow bug, or upgrade to the latest version of sendmail. Sendmail is available at http://www.sendmail.org. For specific patch IDs, see the CERT Advisory listed in the References.

See the following sites:

  • Newer versions of sendmail are available at http://www.sendmail.org or from ftp://ftp.cs.berkeley.edu/ucb/sendmail.
  • BSDI Patches are available from ftp://ftp.bsdi.com/bsdi/patches.
  • Ultrix and DEC OSF/1 Patches are available at http://www.service.digital.com/html/patch_service.html.
  • HP/UX Patches are available at http://us-support.external.hp.com/. Note: Requires no-cost password to access Patch Database.
  • SCO Patches are available from ftp://ftp.sco.com/Supplements/net100.
  • IRIX Patches are available from ftp://sgigate.sgi.com/Security.
  • Sun patches are available at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References:

CERT Advisory CA-95.13, Syslog Vulnerability - A Workaround for Sendmail, http://www.cert.org/advisories/CA-95.13.syslog.vul.html

8lgm, [8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995, http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-22.html

Hewlett-Packard Security Bulletin HPSBUX9602-029, Security Vulnerability in HP-UX syslog(3) subroutine, http://us-support.external.hp.com/

Silicon Graphics Inc. Security Advisory 19951001-01-P825, sendmail issues with syslog vulnerability, ftp://sgigate.sgi.com/security/19951001-01-P825


FTP Getcwd() file descriptor leak

Risk Level: | High risk vulnerability High | Check or Attack Name: Cwdleak
Platforms: | IRIX
Description: | The FTP daemon exhibits a descriptor leak in the getcwd() (get current working directory) function.
Remedy: | Upgrade your libc C library to the current version.
References: |


Anonymous FTP enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: ftpanon
Platforms: Any
Description:

Anonymous FTP is enabled. If FTP services are present, allowing only anonymous access prevents valid user-password pairs from being passed across the network.
Remedy:

Disable the FTP service or confirm that anonymous FTP is set up correctly.

Unix: To disable the FTP service:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the ftpd daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

—OR—

Proper configuration of the FTP server is critical. If an anonymous login is permitted, be certain to:

  • Create the correct home directories for exclusive use of ftpd, such as ~ftp/bin, ~ftp/etc, and ~ftp/pub.
  • Place actual files (rather than symbolic links) in the ftp home directories.
  • Create a special ftp account that points to the ftp home directory.
  • Alter the ftp passwd file to contain entries only for root and ftp.
  • Alter the group file to contain only the ftp group.
  • Use chown to apply the appropriate owners to the directories.
  • Use chmod to apply the correct permissions to all directories and files.
  • Secure any open repository directories so they cannot be used as drop points.

For the appropriate values and permissions for your FTP server, refer to your FTP documentation.

Windows: Stop or disable the FTP service from the Services control panel:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. To permanently disable the service, click Disabled.
  6. Click OK, then click Close.
References:


Ftpd args core dump

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Ftpd Args Core Dump
Platforms: | FTP
Description: | An FTP daemon is vulnerable to the PASV (Passive) buffer overflow core dump. This vulnerability can cause some FTP daemons to crash with a core dump when a PASV command is followed by a large amount of data. FTP core dumps can be used to salvage encrypted passwords, bypassing any shadow passwd scheme.
Remedy: | Update your FTP server. The latest version of wu-ftp is available from ftp://ftp.academ.com/pub/wu-ftpd/ or at http://ftp.academ.com/academ/wu-ftpd/release.html.
References: | Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html


FTP bounce attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: ftpbounce
Platforms: FTP
Description:

A vulnerability exists in many FTP implementations regarding the use of the PORT command. An attacker could potentially use this command to connect to sites through the vulnerable host, effectively "bouncing" such connections.
Remedy:

Upgrade to the latest release of your FTP server, which should include fixes for this problem.
References:

Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html

CERT Advisory CA-97.27, FTP Bounce, http://www.cert.org/advisories/CA-97.27.FTP_bounce.html

Hewlett-Packard Security Bulletin HPSBUX9511-028, Security Vulnerability in FTP, http://us-support.external.hp.com/


FTP CWD ~root login

Risk Level: | High risk vulnerability High | Check or Attack Name: ftpcd
Platforms: | FTP
Description: | Very old versions of the FTP daemon contained a bug that allowed a malicious user to issue a "CWD ~root" command that would result in the attacker gaining root privileges on the system.
Remedy: | Replace the vulnerable FTP daemon with a more recent package, like wuftpd. FTP daemons that are vulnerable to this attack shipped with older distributions of OS's. You should upgrade to the latest OS supported by your hardware..
References: | CERT Advisory CA-88.01, ftpd vulnerability, http://www.cert.org/advisories/CA-88.01.ftpd.hole.html


Wu-ftp site exec command could compromise root privileges

Risk Level: High risk vulnerability High

Check or Attack Name: ftpexec
Platforms: wu-ftpd: 2.4.1 and earlier.
Description:

A vulnerable version of wu-ftp daemon was found. Site Exec in older versions of the wu-ftp daemon allowed remote root access, without using anonymous FTP or a regular account to exploit the system.
Remedy:

Upgrade your FTP server.

To upgrade to the latest version of Wu-FTP, follow these steps:

  1. Open a web browser.
  2. Go to http://ftp.academ.com/academ/wu-ftpd/release.html or ftp://ftp.academ.com/pub/wu-ftpd/.
  3. Download the Wu-FTP patch.
  4. Locate the patch on your system and execute it.
  5. Follow the directions to apply the patch.
References:

CERT Advisory CA-93.06, wuarchive ftpd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-93:06.wuarchive.ftpd.vulnerability

Hewlett-Packard Security Bulletin HPSBUX9405-010, ftpd: SITE CHMOD / race condition vulnerability, http://us-support.external.hp.com/

CERT Advisory CA-94.08, ftpd Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94:08.ftpd.vulnerabilities

Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html


FTP home directory bug

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ftphome
Platforms: | FTP
Description: | The FTP daemon revealed the true path to the FTP user's home directory by issuing a quote cwd command. This information gathering probe may give an attacker clues as to the basic structure of the victim's file system. Many modern FTP server packages have removed this flaw, but some (like wu-ftp) are still vulnerable.
Remedy: | This feature is built in to many FTP servers; refer to your server's documentation on how to disable the CWD command.
References: | Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html


FTP PASV port denial of service attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: FTP PASV Denial of Service
Platforms: FTP
Description:

A vulnerability exists in many FTP server packages that allows an attacker to endlessly request PASV (passive) connections to the server. Eventually, this attack depletes all the ports on the system, denying legitimate traffic to the machine.
Remedy:

Update your FTP server.

Wu-FTP: The latest version of wu-ftp is available from ftp://ftp.academ.com/pub/wu-ftpd/ or at http://ftp.academ.com/academ/wu-ftpd/release.html.

Windows NT: Apply the latest Windows NT 4.0 Service Pack, or the ftp-fix patch:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Download and apply the ftp-fix patch from ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/ftp-fix/.
References:

Microsoft Knowledge Base Article Q189262, FTP Passive Mode May Terminate Session, http://support.microsoft.com/support/kb/articles/q189/2/62.asp


Premature PASV command could cause some FTP servers to crash possibly compromising system passwords

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: ftppasvcore
Platforms: FTP, wu-ftpd
Description:

An FTP daemon allows a premature PASV command, which can cause some FTP daemons to crash with a core dump. FTP core dumps can be used to salvage encrypted passwords, bypassing any shadow password scheme.
Remedy:

Update your FTP server.

The latest version of wu-ftp is available from ftp://ftp.academ.com/pub/wu-ftpd/ or at http://ftp.academ.com/academ/wu-ftpd/release.html.
References:

Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html

BUGTRAQ Mailing List, another two bugs in ftpd, http://www.netspace.org/cgi-bin/wa?A2=ind9610C&L=bugtraq&P=R472


FTP daemon with no password

Risk Level: High risk vulnerability High

Check or Attack Name: ftppwless
Platforms: FTP
Description:

The File Transfer Protocol (FTP) daemon ftpd allowed a login using a nonsensical username and password. An FTP daemon that does not require a username and password may allow attackers access to unauthorized areas of the computer.
Remedy:

Update your FTP server.

The latest version of wu-ftp is available from ftp://ftp.academ.com/pub/wu-ftpd/ or at http://ftp.academ.com/academ/wu-ftpd/release.html.

Windows: Microsoft FTP is available from the Internet Information Server (IIS for Windows NT Server) or Personal Web Services (PWS for Windows NT Workstation or Windows 95/98). Updates are available at http://support.microsoft.com/Support/iis/iisfixes.asp.
References:

Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html

Microsoft Personal Support Center, IIS and Related Products' Fixes & Updates, http://support.microsoft.com/Support/iis/iisfixes.asp


Wu-ftp RNFR command vulnerable

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ftprnfr
Platforms: | wu-ftpd
Description: | Some versions of wu-ftp allow RNFR commands to overwrite or rename files even when these commands have violated file permissions. This issue occurs in wu-ftpd version 2.4 and earlier.
Remedy: | Upgrade to the latest release of Wu-FTPd available.
References: | Academ Consulting Services, WU-FTP Server Software Release Information, http://ftp.academ.com/academ/wu-ftpd/release.html


FTP CWD buffer overflow

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ftpservu
Platforms: | Windows 95, FTP
Description: | A buffer overflow is present in the ftpd's CWD command. Windows 95 Serv-U FTP servers are known to have this problem.
Remedy: | Upgrade to the latest version of the ftpd program. The latest version of wu-ftp is available from ftp://ftp.academ.com/pub/wu-ftpd/ or at http://ftp.academ.com/academ/wu-ftpd/release.html.
References: |


FTP directories writable

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: ftpwrite
Platforms: | FTP
Description: | Writable FTP directories were detected. These directories can be used as drop points for unauthorized or illegal material. An attacker can write files, such as .rhosts, that could provide access to the machine. It is also possible to inflict a denial of service attack by filling up the hard disk.
Remedy: | Remove main directory write permissions.
References: | CIAC Information Bulletin D-19, Wide-spread Attacks on Anonymous FTP Servers, http://ciac.llnl.gov/ciac/bulletins/d-19.shtml


WarFTPD buffer overflow vulnerability

Risk Level: | High risk vulnerability High | Check or Attack Name: WarFTPD
Platforms: | Windows NT, Windows 95
Description: | WarFTPD is a popular FTP server for Windows 95/98 and Windows NT machines. A buffer overflow exists in the way WarFTP handles the USER and PASS commands, allowing a remote attacker to execute arbitrary commands on the server. Versions 1.65 and previous, in addition to 1.66x3 and previous, are vulnerable to this flaw.
Remedy: | Upgrade to the latest version of WarFTPD.
References: | Jgaa's Internet - Bugreports and bugfixes: R0046, War FTP Daemon v. 1.* R0046, http://war.jgaa.com:8080/bugreport/r0046.html Jgaa's Internet, Download Software, http://www.jgaa.com/downloadpage.htm#locations


NFS mount daemon could allow remote attackers to determine whether files exist on a system

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Mountd File Exists
Platforms: | Linux, Solaris, Ultrix
Description: | This exploit can be used to determine what files exist on a machine running a vulnerable version of the RPC mountd service. The mountd service is used when mounting an NFS volume. A user using the mount or mount_nfs command can try to mount files on the remote host, and mountd will return a Permission denied error if it can't access the file, but will return a No such files or directory error if the file doesn't exist. An attacker can systematically scan a victim's system to see what software is running.
Remedy: | Upgrade your system's rpc.mountd daemon to a newer version.
References: | BUGTRAQ Mailing List, Serious security flaw in rpc.mountd on several operating systems, http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.3.96.970824065001.7193A-100000@slartibartfast.sp.org


NFS mount daemon operating on an unreserved port

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: MountdReserved
Platforms: | NFS
Description: | The mountd daemon is running over a non-reserved port. This daemon is probably vulnerable to port hijacking and should be moved to a reserved port.
Remedy: | If possible, only allow this service to run on a privileged port. Users are recommended to contact their vendor on patch or workaround information.
References: |


NFS exports outside domain

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: nfsbugadmin
Platforms: | NFS
Description: | A machine is exporting file systems to a domain other than its own. Exported file systems pose a serious security concern and should be considered carefully.
Remedy: | Pending.
References: |


NFS cache poisoning

Risk Level: | Low risk vulnerability Low | Check or Attack Name: nfsCache
Platforms: | BSD, Linux, SunOS: 4.1.3 and earlier, Solaris: 2.5.1 and below
Description: | Unauthorized data insertion in the NFS cache has either been attempted or was successful. For performance reasons, NFS servers cache responses to old queries in the event the same query is received twice. Typically, NFS servers only check the RPC program number, procedure number, source address, and transaction ID. Since the authentication parameters and the procedure arguments are not checked, in some cases, an attacker can taint the cache, enabling NFS servers to insert malicious information.
Remedy: | No fix information is available at this time.
References: |


NFS CD accesses non-exported files

Risk Level: High risk vulnerability High

Check or Attack Name: nfscd
Platforms: Unix
Description:

The NFS CD command allows access to files that were not exported. Some older mount daemons are supposed to restrict a client machine's access to a certain server directory. Instead, the client can gain full access to the rest of the server's file system.

The original NFS implementation using cd .. on an exported file system (where the exported file is not the physical root) provides you with the parent directory handle even if it was not exported. This is particularly worrisome on diskless clients where you have root access to your own NFS mounted root, but also to all other physical directories above and below the mounted root (for example, the root file systems of other workstations).
Remedy:

Contact your vendor for a patch. For specific patches, see the CERT Advisories listed in the References.

Sun users should also see Patch IDs 100173-13. All Sun patches are available from SunSolve Online Public Patch Access at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References:

CERT Advisory CA-91.21, NFS Jumbo and fsirand Patches, http://www.cert.org/advisories/CA-91.21.SunOS.NFS.Jumbo.and.fsirand.html

CERT Advisory CA-91.21, NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91%3a21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/advisories/CA-92.15.Multiple.SunOS.vulnerabilities.patched.html

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/ftp/cert_advisories/CA-92%3a15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/advisories/CA-93.15.SunOS.and.Solaris.vulnerabilities.html

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93%3a15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/advisories/CA-94.02.REVISED.SunOS.rpc.mountd.vulnerability.html

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-94%3a02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/advisories/CA-94.15.NFS.Vulnerabilities.html

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94%3a15.NFS.Vulnerabilities


NFS exports

Risk Level: Low risk vulnerability Low

Check or Attack Name: nfsexp
Platforms: Unix running NFS
Description:

NFS was found to be mountable. The security of NFS relies heavily on who is allowed to mount the files that a server exports, and whether they are exported read-only. Through NFS, an attacker can gain access to files in the export directory. Some administrators purposefully export directories for everyone to be able to gain access to the data.
Remedy:

Disable NFS if exports are not required on this host. To safely create an empty netgroup entry, type ngname (-,-,-). This is a netgroup that matches no one on no host on no NIS domain.

Note: The Windows NT fix depends on what NFS server you are running. Refer to your NFS documentation for more information.
References:

SunSolve Online Public Patch Access, SunSolve Online Public Patch Access, http://sunsolve.sun.com/sunsolve/pubpatches/patches.html

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94:15.NFS.Vulnerabilities

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/advisories/CA-94.15.NFS.Vulnerabilities.html

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/advisories/CA-91.21.SunOS.NFS.Jumbo.and.fsirand.html

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/advisories/CA-93.15.SunOS.and.Solaris.vulnerabilities.html

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/advisories/CA-94.02.REVISED.SunOS.rpc.mountd.vulnerability.html


Guessable NFS filehandles

Risk Level: | High risk vulnerability High | Check or Attack Name: nfsguess
Platforms: | SunOS
Description: | The NFS Guess vulnerability was found, which allows an attacker to access the file system, bypassing mountd security by guessing a file handle.
Remedy: | Obtain the NFS jumbo patch from your vendor. After you install the latest NFS security patch, be sure to run fsirand on your entire file system. The new fsirand program makes it difficult for a remote system user to guess NFS filehandles, preventing the user from conducting unauthorized mounts and accessing your NFS file systems. See SunOS Patch ID# 100173-13 at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References: |


NFS mknod

Risk Level: High risk vulnerability High

Check or Attack Name: nfsmknod
Platforms: NFS: old versions
Description:

The NFS MKNOD vulnerability has been detected as running. Found on some older NFS servers, this vulnerability allows normal users to create special devices that could require root access. When non-administrative users can do this, then an attacker could create a kmem (kernel memory) device and change access to root and circumvent system security.

Warning: Vulnerable machines running the Pyramid operating environment will create an illegal device in the \dev directory, causing the kernel to panic when it accesses the device. Do not run NFS mknod on networks that include Pyramid systems.
Remedy:

Obtain the latest version of the NFS server from your vendor. Many mountd programs support a -nodev option that turns off the ability to create a device. For more information, see your OS documentation.

For specific patch IDs, see the CERT Advisories listed in the References. Sun users apply Patch ID# 100173-13 at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References:

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/advisories/CA-91.21.SunOS.NFS.Jumbo.and.fsirand.html

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/advisories/CA-94.15.NFS.Vulnerabilities.html

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/advisories/CA-92.15.Multiple.SunOS.vulnerabilities.patched.html

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/advisories/CA-93.15.SunOS.and.Solaris.vulnerabilities.html

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/advisories/CA-94.02.REVISED.SunOS.rpc.mountd.vulnerability.html

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, ftp://info.cert.org/pub/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, ftp://info.cert.org/pub/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, ftp://info.cert.org/pub/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, ftp://info.cert.org/pub/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, ftp://info.cert.org/pub/cert_advisories/CA-94:15.NFS.Vulnerabilities


NFS mountable

Risk Level: High risk vulnerability High

Check or Attack Name: nfsmount
Platforms: Unix running NFS
Description:

NFS was found to be mountable. The security of NFS relies heavily upon who is allowed to mount the files that a server exports, and whether or not they are exported read-only.

Through NFS, an attacker can gain access to files in the export directory. Some administrators purposefully export directories for everyone to be able to gain access to the data. This check attempts to mount the exports. If the attempt is successful, the check continues by trying to test for the NFS UID, NFS Mknod, and NFS cd bugs. Further, the check searches for a writable directory and reports if it finds these files: .rhosts, .cshrc, .login, .profile, or .netrc.

These files typically appear in an account's home directory. An attacker can modify the files to obtain access to the machine.

The Risk Level can range from Low to High. The type of data exported should determine the risk level. If it is a read/writable home directory, it is a high risk. If the exported directory is /cdrom, it is probably low risk.
Remedy:

Check the configuration of the /etc/exports on your host. Export file systems only to hosts that require them. Export only to fully qualified hostnames. Make sure export lists do not exceed 256 characters. Use the showmount utility to check that exports are correct. Wherever possible, mount file systems to be exported read only and export file systems read only.

If NFS is not needed, consider disabling it, or verify and set permissions to approved users on exported volumes or shared directories. Where possible, mount file systems to be exported read-only and export file systems read-only.

Unix: Check permissions on exported volumes using the showmount -e command. If the exported directories look like the listing that follows, anyone can use mount /usr - to possibly replace files and gain access:

/usr (everyone)

/export/hosta hosta

/export/hostb hostb

The hosta and hostb systems appear to be clients to this server. In such a case, /usr can be mounted by anyone. Instead, this access should be restricted. You should also check hosta and hostb for other security vulnerabilities. When either system is vulnerable, then so is the server.

Windows: NFS is not native to Windows, but may be present. To verify permissions:

  1. Open Server Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), Server Manager.
  2. Select the server.
  3. From the Computer menu, select Shared Directories.
  4. Set permissions to allow access only to approved users.

Note: The Windows NT fix depends on what NFS server you are running. Refer to your NFS documentation for more information.
References:

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/advisories/CA-91.21.SunOS.NFS.Jumbo.and.fsirand.html

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/advisories/CA-92.15.Multiple.SunOS.vulnerabilities.patched.html

CERT Advisory CA-93.15 CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/advisories/CA-93.15.SunOS.and.Solaris.vulnerabilities.html

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/advisories/CA-94.02.REVISED.SunOS.rpc.mountd.vulnerability.html

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/advisories/CA-94.15.NFS.Vulnerabilities.html

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, ftp://info.cert.org/pub/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, ftp://info.cert.org/pub/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-93.15 CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, ftp://info.cert.org/pub/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, ftp://info.cert.org/pub/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, ftp://info.cert.org/pub/cert_advisories/CA-94:15.NFS.Vulnerabilities


Unix running NFS

Risk Level: | Low risk vulnerability Low | Check or Attack Name: mountd
Platforms: | NFS
Description: | This system was found to support mounting of NFS file systems. The security of NFS relies heavily upon who is allowed to mount the volumes that a server exports, and whether or not they are exported read-only. Improperly configured access permissions on exported volumes can permit an attacker to gain access to critical files.
Remedy: | Disable NFS, or check permissions on exported volumes.
References: |


NFS Service

Risk Level: Low risk vulnerability Low

Check or Attack Name: nfsd
Platforms: Any
Description:

The NFS service was found. Security of NFS relies heavily upon who is allowed to mount the volumes that a server exports, and whether or not they are exported read-only. Improperly configured access permissions on exported volumes can permit an attacker to gain access to critical files.

Remedy:

Unix: Check permissions on exported volumes.

Windows: Set permissions to allow access only to approved users:

  1. Open the Server Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), Server Manager.
  2. Select the server.
  3. From the Computer menu, select Shared Directories.
  4. Set permissions to allow access only to approved users.
References:


NFS portmapper export

Risk Level: High risk vulnerability High

Check or Attack Name: nfspmap
Platforms: NFS
Description:

NFS was found to be mountable via portmapper. An attacker can mount the system through the portmapper, gaining access to a restricted host. To the portmapper, it seems as if the local host is mounting, since the local host is permitted to mount itself.

Remedy:

Check the configuration of /etc/exports on your host:

  • Do not self-reference an NFS server in its own exports file.
  • Do not allow the exports file to contain a \localhost\ entry.
  • Export file systems only to hosts that require them.
  • Export only to a fully qualified host name.
  • Ensure that export lists do not exceed 256 characters.
  • Use the showmount utility to check that exports are correct.

Wherever possible, mount file systems to be exported as read-only and export file systems as read-only.

For specific patch IDs, see the CERT Advisories listed in the References.
References:

SunSolve Online Public Patch Access, Patch IDs 100173-13 "SunOS 4.1.3: NFS Jumbo Patch (191274 bytes)" and 102034-05 "SunOS 5.3: usr/sbin/rpcbind patch (106355 bytes)", http://sunsolve.sun.com/sunsolve/pubpatches/patches.html

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94:15.NFS.Vulnerabilities

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/ftp/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand


NFS .Rhosts

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: nfsrhosts
Platforms: NFS
Description:

A directory on an exported file system has been detected as writable. Via NFS, this condition can lead to attackers gaining access to the machine by modifying certain files.

Note: This issue does not indicate that the export is read-writable, but that the directory on the file system has write permission.
Remedy:

Verify that these files and export directories are not accessible by unauthorized hosts through proper NFS export lists. For more information, see your NFS documentation.

For specific patch IDs, see the appropriate CERT Advisory listed in the References.
References:

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/ftp/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94:15.NFS.Vulnerabilities

SunOS/Solaris Patch ID 100173-13, SunOS 4.1.3: NFS Jumbo Patch (191274 bytes), http://sunsolve.sun.com/sunsolve/pubpatches/patches.html


Superfluous NFS daemon

Risk Level: High risk vulnerability High

Check or Attack Name: nfssuper
Platforms: NFS
Description:

The target machine is running an nfsd daemon, but is not exporting any file systems. You should verify the configuration of the target machine.
Remedy:

Disable the NFS daemon if it is not needed. Nfsd is most often started from an rc script, but may also be started from the \etc\inetd.conf file.

To disable the daemon from an rc script, comment it out as appropriate for your operating system. As an example for disabling nfsd under SunOS 5.5, execute the following commands:

# /etc/init.d/nfs.server stop

# mv /etc/init.d/nfs.server /etc/init.d/DISABLED_nfs.server

To disable the daemon from inetd.conf:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


NFS does not properly identify UID

Risk Level: High risk vulnerability High

Check or Attack Name: nfsuid
Platforms: NFS: old versions
Description:

Some NFS servers do not properly check the UID. Technically, because of improper masking with UIDs (a UID is 16 bit, and the value passed is 32 bits; the root check is performed on the 32-bit value before masking) it very easy to masquerade as root. An attacker can take advantage of the UID bug to masquerade as root and read and write root owned files.
Remedy:

Obtain a NFS patch from your vendor.

SunOS Patch ID# 100173-13 available at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.

For specific patch IDs, see the appropriate CERT Advisory listed in the References.
References:

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/advisories/CA-94.15.NFS.Vulnerabilities.html

CERT Advisory CA-94.02, Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-94:02.REVISED.SunOS.rpc.mountd.vulnerability

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/ftp/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand


NFS mountable via Ultrix remount bug

Risk Level: | High risk vulnerability High | Check or Attack Name: nfsultrix
Platforms: | Ultrix
Description: | NFS was found to be mountable via the NFS Ultrix bug. An attacker can access NFS Exports without being in the access list.
Remedy: | Obtain a patch from your vendor.
References: |


NFS writable

Risk Level: High risk vulnerability High

Check or Attack Name: nfswrite
Platforms: NFS, Solaris: 2.5.1
Description:

An NFS export was found to be writable by anyone. An attacker could modify any files on this system.
Remedy:

Export the directory as read-only, or reconfigure to only export to trusted hosts. For more information, see your NFS documentation.

For specific patch IDs, see the appropriate CERT Advisory listed in the References.

References:

CERT Advisory CA-91.21, SunOS NFS Jumbo and fsirand Patches, http://www.cert.org/ftp/cert_advisories/CA-91:21.SunOS.NFS.Jumbo.and.fsirand

CERT Advisory CA-92.15, Multiple SunOS Vulnerabilities Patched, http://www.cert.org/ftp/cert_advisories/CA-92:15.Multiple.SunOS.vulnerabilities.patched

CERT Advisory CA-93.15, /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-93:15.SunOS.and.Solaris.vulnerabilities

CERT Advisory CA-94.15, NFS Vulnerabilities, http://www.cert.org/ftp/cert_advisories/CA-94:15.NFS.Vulnerabilities


Repair directory readable

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: repair insecure
Platforms: Windows NT
Description:

By default, the %systemroot%\repair directory is readable by everyone. It is possible to extract usernames and potentially the hashes of the passwords from the sam._ file. Set the permissions on this directory to full control for administrators and system and remove permissions for everyone.

Remedy:

Restrict access to the %systemroot\repair directory to administrators only.

To restrict access from the Windows NT desktop, follow these steps:

  1. From Windows Explorer, right-click the selected directory and select Properties to display the Properties dialog box.
  2. Under the Security tab, click Permissions.
  3. Configure Administrators with Full Control and every one else with No Access.

—OR—

Open the command line and restrict access:

  1. From the Windows NT Start menu, select Run.
  2. Type cmd, then click OK. This opens the command line.
  3. Type: cacls c:\winnt\repair /g administrators:F
  4. Type exit to return to the Windows NT desktop.
References:


Windows NT null session user modals

Risk Level: Low risk vulnerability Low

Check or Attack Name: Null Session User Modals
Platforms: Windows NT
Description:

Password policy information is available to non-authenticated users for all Windows NT systems prior to NT 4.0 with Service Pack 3 and the lsa2-fix. An attacker can access valuable information regarding password length, number of incorrect passwords before a user is locked out, and duration of user lockout.
Remedy:

Apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must apply the post-SP3 lsa2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/lsa2-fix/.

—AND—

The RestrictAnonymous key must be set to restrict password policy information:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. If you have not already done so, apply the latest Windows NT 4.0 Service Pack, or SP3 with the lsa2-fix patch.
  2. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  3. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA key.
  4. From the Edit menu, select Add Value to display the Add Value dialog box.
  5. In the Value Name field, type RestrictAnonymous.
  6. Select REG_DWORD as the Data Type.
  7. Click OK to display the DWORD Editor.
  8. In the Data field, type 1. (Ignore the Radix setting.)
  9. Click OK. Registry Editor adds the key to the registry.
  10. Reboot the system to apply the changes.

Note: Changing the Registry entries is only effective after applying the latest Service Pack, or after applying the post-SP3 lsa2-fix patch and Service Pack 3.
References:

Microsoft Knowledge Base Article Q129457, Anonymous Connections May Be Able to Obtain the Password Policy, http://support.microsoft.com/support/kb/articles/q129/4/57.asp


Chargen patch not applied

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Chargen Patch
Platforms: Windows NT
Description:

An unpatched version of Windows NT Simple TCP/IP services has been detected. It is possible for an attacker to cause a network denial of service by sending broadcast UDP packets to the Windows NT chargen service.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or the post-SP3 simptcp-fix patch.

To install the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 simp-tcp patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/simptcp-fix/.
References:

Microsoft Knowledge Base Article Q154460, Denial of Service Attack Against WinNT Simple TCP/IP Services, http://support.microsoft.com/support/kb/articles/q154/4/60.asp

Microsoft Knowledge Base Article Q154460, Denial of Service Attack Against WinNT Simple TCP/IP Services, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/simptcp-fix/Q154460.TXT


DNS predictable query

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DNS Predictable Query
Platforms: Windows NT, Windows NT: 4.0, Windows NT: 4.0 SP2, Windows NT: 4.0 SP1, Windows NT: 4.0 SP3
Description:

An unpatched version of Windows NT DNS has been found. If the DNS query numbers are predictable, it is possible for an attacker to spoof replies to DNS queries, which could potentially redirect traffic to hostile sites.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or the post-SP3 dns-fix patch.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 dns-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/dns-fix/.
References:

Microsoft Knowledge Base Article Q167629, Predictable Query IDs Pose Security Risks for DNS Servers, http://support.microsoft.com/support/kb/articles/q167/6/29.asp

Microsoft Knowledge Base Article Q167629, Predictable Query IDs Pose Security Risks for DNS Servers, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/dns-fix/Q167629.txt


Windows NT kernel outdated

Risk Level: Low risk vulnerability Low

Check or Attack Name: kernel version
Platforms: Windows NT
Description:

This system was found to have an outdated Windows NT kernel version. Windows NT can allow a user to start a high priority process that cannot be killed from the Task Manager. It is extremely difficult to cause this behavior to occur remotely.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or Windows NT 4.0 Service Pack 3 (SP3) users must apply the getadmin fix.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

To apply getadmin fix, follow these steps:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/getadmin-fix.
  3. View the README.TXT for patch version and execution.
  4. Download the appropriate patch for your system.
  5. Follow the instructions to install the patch.
References:

Microsoft Knowledge Base Article Q135707, Programs Run at Priority Level 15 May Cause Computer to Hang, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/krnl-fix/Q135707.txt

Microsoft Knowledge Base Article Q135707, Programs Run at Priority Level 15 May Cause Computer to Hang, http://support.microsoft.com/support/kb/articles/Q135/7/07.asp

Microsoft Knowledge Base Article Q141239, Stop 0xA Errors May Occur After Installing Service Pack 2, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/krnl-fix/Q141239.txt

Microsoft Knowledge Base Article Q141239, Stop 0xA Errors May Occur After Installing Service Pack 2, http://support.microsoft.com/support/kb/articles/Q141/2/39.asp

Microsoft Knowledge Base Article Q150734, List of Bugs Fixed in Windows NT 4.0 Service Pack 3, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ussp3/readme.htm


Windows NT denial of service attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Windows NT SMB logon DoS
Platforms: Windows NT
Description:

Windows NT servers (including those with Service Pack 3 when all hotfixes applied) are vulnerable to a denial of service attack. When a logon request is initiated to access the SMB/CIFS service and the SMB logon packet is incorrectly processed, memory corruption results in the NT kernel. When this happens, a blue screen error message appears and the machine has to be rebooted.
Remedy:

Apply the following patch from Microsoft available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/srv-fix.
References:

Microsoft Knowledge Base Article Q180963, Denial of Service Attack Causes Windows NT Systems to Restart, http://support.microsoft.com/support/kb/articles/Q180/9/63.asp

Network Associates, Inc. Security Advisory #25, Windows NT Logon Denial of Service, http://www.nai.com/nai_labs/asp_set/advisory/25_windows_nt_dos_adv.asp


LSA patch not applied

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: LSA patch for NT SP3
Platforms: Windows NT: 4.0
Description:

An unpatched version of the Local Security Authority (LSA) subsystem exists, allowing an attacker to display sensitive security information. In addition, account lockout events, as a result of exceeding the Bad Logon Attempts limit, are not logged at Domain Controllers. Although the latter is not a vulnerability, it does create an inconvenience for administrators wanting to locate the computer originating the bad password attempts.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or SP3 users must apply the post-SP3 las2-fix patch.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must apply the post-SP3 lsa2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/lsa2-fix/.
References:

Microsoft Knowledge Base Article Q184017, Administrators can Display Contents of Service Account Passwords, http://support.microsoft.com/support/kb/articles/q184/0/17.asp

Microsoft Knowledge Base Article Q182918, Account Lockout Event also Stored in Security Event Log on DC, http://support.microsoft.com/support/kb/articles/q182/9/18.asp hotfixes-postSP3/lsa2-fix/Q182918.txt

Microsoft Knowledge Base Article Q182918, Account Lockout Event also Stored in Security Event Log on DC, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/lsa2-fix/Q182918.txt

Microsoft Knowledge Base Article Q184017, Administrators can Display Contents of Service Account Passwords, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/lsa2-fix/Q184017.txt


PowerPoint security patch missing

Risk Level: Low risk vulnerability Low

Check or Attack Name: PPT patch
Platforms: Windows NT
Description:

An unpatched version of PowerPoint has been detected. The potential misuse of a PowerPoint 95/97 feature allows an application to be run from within PowerPoint without warning the user. The problem can occur in web browsers, such as Internet Explorer, that support the viewing of PowerPoint files from within the web browser.
Remedy:

Upgrade PowerPoint or Microsoft Office 97. Select one of the following options:

  • Download Office 97 Service Release 1 at http://www.microsoft.com/windows/ie/security/powerpoint.asp. In addition to providing the fix, this release addresses Office migration issues, includes performance enhancements for the Outlook 97 desktop information manager, and updates file viewers, converters, and filters.
  • Download the standalone fix at http://www.microsoft.com/windows/ie/security/powerpoint.asp. This option, which has been available for some time, is much quicker to download, but does not include the additional significant improvements delivered in Service Release 1.

After you install either the Service Release or the standalone fix, you will be prompted before you activate a potentially dangerous link from within PowerPoint. Users who don't want to be prompted about this risk can turn off the new warning from within PowerPoint by disabling Macro Virus Protection from the Tools/Options dialog box.
References:

Microsoft Windows Technologies, PowerPoint Browsing Security Issue, http://www.microsoft.com/windows/ie/security/powerpoint.asp


PPTP patch not installed

Risk Level: High risk vulnerability High

Check or Attack Name: PPTP3 Fix
Platforms: Windows NT: 4.0
Description:

The machine has an unpatched version of the Point to Point Tunneling Protocol (PPTP). Microsoft has made improvements to the native Virtual Private Networking (VPN) capabilities that significantly improve the performance and security of PPTP-based VPN connections via the Internet, especially for remote access or high-latency networks.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, or Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 pptp3-fix patch. If possible, upgrade your web browser to strong encryption.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 pptp3-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/pptp3-fix/.

Note: Windows NT Servers running Routing and Remote Access Service (RRAS) must first apply the pptp3-fix performance upgrade followed by the RRAS Hotfix 3.0 to benefit from the upgrade (it is important not to reboot your machine in-between installations of the NT pptp3-fix and the Routing and Remote Access Service upgrade). For more information, see Microsoft Knowledge Base Article Q189594 "RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 3.0 Release Notes" at http://support.microsoft.com/support/kb/articles/q189/5/94.asp or from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/pptp3-fix/Q189594.TXT.

—AND—

US and Canadian customers can download the 128-bit version of this hotfix from http://mssecure.www.conxion.com/cgi-bin/ntitar.pl.
References:

Microsoft Knowledge Base Article Q189595, PPTP Performance & Security Upgrade for WinNT 4.0 Release Notes, http://support.microsoft.com/support/kb/articles/q189/5/95.asp

Microsoft Knowledge Base Article Q189595, PPTP Performance & Security Upgrade for WinNT 4.0 Release Notes, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/pptp3-fix/Q189595.TXT

Microsoft Download Server, Microsoft Strong Encryption Product Download (US and Canada Only), http://mssecure.www.conxion.com/cgi-bin/ntitar.pl

Microsoft Knowledge Base Article Q189595, PPTP Performance & Security Upgrade for WinNT 4.0 Release Notes, http://support.microsoft.com/support/kb/articles/q189/5/95.asp


SecHole lets non-administrative users gain Debug Level access

Risk Level: High risk vulnerability High

Check or Attack Name: NTPrivFix
Platforms: Windows NT: 3.5, Windows NT: 4.0
Description:

The sechole.exe utility circulated on the Internet can allow a non-administrative user to gain debug-level access on a system process. Using this utility, the non-administrative user may run some code in the system security context and acquire local administrative privileges on the system.
Remedy:

Apply the latest Windows NT 4.0 Service Pack. To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 priv-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/priv-fix/.

—OR—

Windows NT 3.51 SP5 customers can download the patch from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/priv-fix/.
References:

Microsoft Knowledge Base Article Q190288, SecHole Lets Non-administrative Users Gain Debug Level Access, http://support.microsoft.com/support/kb/articles/q190/2/88.asp

Microsoft Knowledge Base Article Q190288, SecHole Lets Non-administrative Users Gain Debug Level Access, ftp://ftp.microsoft.com/bussys/winnt/winnt public/fixes/usa/NT40/hotfixes-postSP3/priv-fix/Q190288.TXT hotfixes-postSP5/priv-fix/.

Microsoft Knowledge Base Article Q190288, SecHole Lets Non-administrative Users Gain Debug Level Access, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/priv-fix/Q190288.TXT otfixes-postSP3/priv-fix/

Microsoft Security Bulletin MS98-009, Update Available for Windows NT Privilege Elevation attack, http://www.microsoft.com/security/bulletins/ms98-009.asp


Windows NT RPC locator vulnerable

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: RPC DLL version
Platforms: Windows NT
Description:

Prior to installation of the Windows NT 4.0 post-SP2 rpc-fix, an attacker can telnet to port 135 and cause the system to become extremely slow. As a result of this denial of service attack, the RPC locator process will use nearly 100% of the processor.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, or Windows NT 3.51 and 4.0 users can apply the appropriate patch.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 2 (SP2) users must apply the post-SP2 rpc-fix available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/rpc-fix.

—OR—

Windows NT 3.51 Service Pack 5 (SP5) users must apply the post-SP5 rpc-fix available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/rpc-fix.
References:


RRAS patch not installed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Ntrras
Platforms: Windows NT: 4.0
Description:

The machine has an unpatched version of the Routing and Remote Access Service (RRAS). This patch includes an enhancement to TCP/IP that will improve the performance of TCP-based applications over high latency networks, demand dial filtering to better control dialing interfaces, fragmented IP packet filtering to drop malformed or unauthorized packets, and other security fixes.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, or Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 rras30-fix patch.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 rras30-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/rras30-fix/.

Note: This patch requires that you already have Routing and Remote Access Service for Windows NT 4.0 Server installed on your system. You must first apply the Windows NT 4.0 PPTP Upgrade before applying RRAS Upgrade 3.0 (it is important not to reboot your machine in-between installations of the Windows NT PPTP upgrade and the RRAS upgrade). For more information, see Microsoft Knowledge Base Article Q189595 "PPTP Performance & Security Upgrade for WinNT 4.0 Release Notes" at http://support.microsoft.com/support/kb/articles/q189/5/95.asp.

References:

Microsoft Knowledge Base Article Q189594, RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 3.0 Release Notes, http://support.microsoft.com/support/kb/articles/q189/5/94.asp

Microsoft Knowledge Base Article Q168469, RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 2.0 Release Notes, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/archive/rras20-fix/Q168469.TXT

Microsoft Knowledge Base Article Q189594, RRAS Upgrade for WinNT Server 4.0 Hotfix Pack 3.0 Release Notes, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/rras30-fix/Q189594.TXT


Windows NT Post-SP2 security patches missing

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: SP2 security patches
Platforms: Windows NT
Description:

Detects the application of post Service Pack 2 security patches, which fix a number of network vulnerabilities. Service Pack 3 contains this patch.

WARNING: Service Pack 2 must be applied before applying this patch. Do not apply this patch directly over Service Pack 1, or you will cause the machine to crash. Service Pack 3 may be applied over any configuration.

These patches are documented in the following Microsoft Knowledge Base Articles Q143474, Q143475, and Q161372 available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/sec-fix/.
Remedy:

Apply the latest Windows NT 4.0 Service Pack.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.
References:


SSL patch not installed

Risk Level: High risk vulnerability High

Check or Attack Name: SSLpatch
Platforms: IIS: 3.0 and earlier, Windows NT: 4.0
Description:

An unpatched version of the Secure Sockets Layer (SSL) allows an attacker to formulate a complex structured attack that could potentially decode an Internet transaction encrypted using SSL. This knowledge would not give the attacker an advantage in decoding any other transactions that had been made by the server, nor would it necessarily give the attacker an advantage in decoding any other transactions performed by the user. A web site operator could detect an attack through observations, such as abnormal network activity or high CPU utilization.

Remedy:

Apply the latest Windows NT 4.0 Service Pack. To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users can apply the post-SP3 ssl-fix available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/ssl-fix/.

—AND—

Residents of the US and Canada can download the North American (128-bit) version of Schannel.dll from http://mssecure.www.conxion.com/cgi-bin/ntitar.pl.

—AND—

Also, follow these guidelines to minimize the risk to your web servers:

  • Change server-side certificates on a periodic basis. By changing the certificate on a server, an attacker will no longer be able to use this vulnerability to decode transactions that were encrypted with the previous private key.
  • Use a certificate on only a single system. Sometimes in server farms (large clusters of servers) the same certificate is installed on multiple systems. This is not recommended for the most secure solutions. If multiple servers are configured with the same certificate, an attacker could use the processing strength of each server to try to break a single session, thus reducing the time required.
  • Monitor normal trend performance and look for changes. Since this attack uses the processing power of the server against itself, regular monitoring of CPU utilization and network traffic could give warning of an attack. For example, watching for a large amount of network traffic from a single source might indicate an attack.
References:

CERT Advisory CA-98.07, Vulnerability in Some Usages of PKCS#1, http://www.cert.org/ftp/cert_advisories/CA-98.07.PKCS

Microsoft Knowledge Base Article Q148427, Generic SSL (PCT/TLS) Updates for IIS and MS Internet Products, http://support.microsoft.com/support/kb/articles/q148/4/27.asp

Microsoft Security Bulletin MS98-002, Updates available for the SSL enabled Internet Server "The Error Message Vulnerability", http://www.microsoft.com/security/bulletins/ms98-002.asp

Bell Labs Innovations - Pages for Daniel Bleichenbacher, List of Publications, http://www.bell-labs.com/user/bleichen/bib.html tfixes-postSP3/ssl-fix/Q148427.TXT

Microsoft Knowledge Base Article Q148427, Generic SSL (PCT/TLS) Updates for IIS and MS Internet Products, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/ssl-fix/Q148427.TXT

Microsoft Security Bulletin MS98-009, Update Available for Windows NT Privilege Elevation attack, http://www.microsoft.com/security/bulletins/ms98-009.asp


Ssping patch not applied

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: ssping
Platforms: Windows NT
Description:

An unpatched version of Windows NT has been found. It is possible for an attacker to cause the host to crash by sending improperly formed ICMP packets.
Remedy:

Apply the teardrop2 patch.

To apply teardrop2, follow these steps:

  1. From the Windows NT Start menu, select Run.
  2. Type 'ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/ and press Enter.
  3. View the README.TXT for patch version and execution.

For more information about teardrop2, see Microsoft Knowledge Base Article Q179129 available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/Q179129.txt.
References:

Microsoft Knowledge Base Article Q154174, Invalid ICMP Datagram Fragments Hang Windows NT, Windows 95, http://support.microsoft.com/support/kb/articles/Q154/1/74.asp


Syncstorm patch missing

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: syncstorm patch
Platforms: Windows NT
Description:

This machine was found to be vulnerable to a Sync Storm denial-of-service attack due to an unpatched TCPIP.SYS file.

Remedy:

Apply the latest Windows NT 4.0 Service Pack or Windows NT 4.0 Service Pack 3 (SP3) users must apply the teardrop2 patch.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

To apply teardrop2, follow these steps:

  1. From the Windows NT Start menu, select Run.
  2. Type 'ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/ and press Enter.
  3. View the README.TXT for patch version and execution.

For more information about teardrop2, see Microsoft Knowledge Base Article Q179129 available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/Q179129.txt.
References:

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, http://support.microsoft.com/support/kb/articles/q179/1/29.asp

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/teardrop2-fix/Q179129.txt

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/teardrop2-fix/Q179129.txt

Microsoft Knowledge Base Article Q142641, Internet Server Unavailable Because of Malicious SYN Attacks, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP1/syn-attack/q142641.txt

Microsoft Knowledge Base Article Q142641, Internet Server Unavailable Because of Malicious SYN Attacks, http://support.microsoft.com/support/kb/articles/q142/6/41.asp

CERT Advisory CA-96.21, TCP SYN Flooding and IP Spoofing Attacks, http://www.cert.org/ftp/cert_advisories/CA-96.21.tcp_syn_flooding

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, http://support.microsoft.com/support/kb/articles/q179/1/29.asp


WINS patch not applied

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: WINS Patch
Platforms: Windows NT
Description:

An unpatched version of Windows NT WINS has been found. It is possible for an attacker to cause WINS to fail by sending invalid UDP packets.
Remedy:

Apply the latest Windows NT 4.0 Service Pack.

To apply the latest service pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post SP3 winsupd-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/winsupd-fix/.
References:

Microsoft Knowledge Base Article Q155701, Invalid UDP Frames May Cause WINS to Terminate, http://support.microsoft.com/support/kb/articles/Q155/7/01.asp


WINS update patch not installed header

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NTWinsupFix
Platforms: Windows NT: 4.0
Description:

It is possible to crash the WINS server by sending random UDP packets to port 137 on a machine running the WINS server. The WINS Update patch prevents this denial of service.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, or Windows NT 4.0 Service Pack 3 (SP3) users must also apply the post SP3 winsupd-fix patch.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must also apply the post SP3 winsupd-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/winsupd-fix/.
References:


Year 2000 Patch not installed

Risk Level: Low risk vulnerability Low

Check or Attack Name: NTy2k
Platforms: Windows NT
Description:

The Year 2000 (y2k-fix) patch is not installed. This patch resolves date issues with the Find Files or Folders feature, leap year usage in the User Manager program, incorrect saved dates in the document properties viewer, and day skipping in the Date/Time control panel.
Remedy:

Apply the latest Windows NT 4.0 Service Pack. To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users can apply the post-SP3 y2k-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/y2k-fix/.
References:

Microsoft Knowledge Base Article Q175093, User Manager Does Not Recognize February 2000 As a Leap Year, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/y2k-fix/Q175093.TXT k-fix/Q183123.TXT

Microsoft Knowledge Base Article Q180122, After Changing the Time, Windows NT May Skip a Day, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/y2k-fix/Q180122.TXT k-fix/Q175093.TXT

Microsoft Knowledge Base article Q183123, Find Files Displays Garbled Date if Year is 2000 or Greater, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/y2k-fix/Q183123.TXT k-fix/Q180122.TXT

Microsoft Knowledge Base Article Q175093, User Manager Does Not Recognize February 2000 As a Leap Year, http://support.microsoft.com/support/kb/articles/q175/0/93.asp

Microsoft Knowledge Base Article Q180122, After Changing the Time, Windows NT May Skip a Day, http://support.microsoft.com/support/kb/articles/q180/1/22.asp

Microsoft Knowledge Base Article Q183123, Find Files Displays Garbled Date if Year is 2000 or Greater, http://support.microsoft.com/support/kb/articles/q183/1/23.asp

Microsoft Knowledge Base Article Q183125, Shell Doc Property Dialog Custom Date Incorrect After Year 2000, http://support.microsoft.com/support/kb/articles/q183/1/25.asp

Microsoft Knowledge Base Article Q183125, Shell Doc Property Dialog Custom Date Incorrect After Year 2000, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/y2k-fix/Q183125.TXT


Modified teardrop attack can remotely crash machines

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Modified Teardrop Attack
Platforms: Windows NT: 3.5.1, Windows 95, Windows NT: 4.0
Description:

A denial of service attack exists against the networking stack of some versions of Microsoft's operating systems. This issue is caused by a problem with the way the Microsoft TCP/IP stack handles certain exceptions caused by misformed UDP header information. This situation does not occur in properly formed TCP/IP packets and must be generated by a program with malicious intent.
Remedy:

Obtain one of the following patches:

Windows NT Service Pack 3 users must apply the teardrop2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/teardrop2-fix/.

Windows NT 3.51 SP5 users must apply the post-SP5 teardrop2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/teardrop2-fix/.
References:

Microsoft Security Bulletin, Update on Network Denial of Service Attacks (Teardrop/NewTear/Bonk/Boink), http://www.microsoft.com/security/bulletins/netdos.asp

SCO Security Bulletin 98:01, IP-based Denial of Service Attacks, ftp://ftp.sco.com/SSE/security_bulletins/SB.98:01a

CIAC Information Bulletin I-031A, I-031a: Malformed UDP Packets in Denial of Service Attacks, http://ciac.llnl.gov/ciac/bulletins/i-031a.shtml

CERT Summary CS-98.02, Denial of service attacks targeting Windows 95/NT machines, ftp://ftp.cert.org/pub/cert_summaries/CS-98.02


Application log readable

Risk Level: Low risk vulnerability Low

Check or Attack Name: applog
Platforms: Windows NT
Description:

The Windows NT Application Log could be read from the network. If the user account is not one who should have access to the host, it may indicate that the Guest account is enabled and is allowed to access the computer from the network. If the account should not have that level of access, then the user permissions may be set incorrectly, or in the worst case, the Guest account is enabled and is a member of the Administrators group. Typically, the application log does not contain information an attacker would find useful. However, some applications, such as the Ataman Telnet, Rlogin, and Rexec may write sensitive information to the application log.
Remedy:

Remove Administrator access for unauthorized user accounts and remove network access rights for the Guest account.

To remove Administrator access from a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the Administrators group, or the group you use to assign administrative rights.
  3. Remove any unexpected Members. Look for the following:
    • User accounts or groups that do not need administrative rights.
    • User accounts or groups that are disabled or obsolete.
  4. The Guest account should not be a member of Administrators unless there is a compelling reason.

To prevent remote log on of a Windows NT user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  4. From the Right list, select Access this computer from network.
  5. From the Grant To list, select the user account and click Remove.
  6. Click OK>
References:


Windows NT system log accessible

Risk Level: Low risk vulnerability Low

Check or Attack Name: systemlog
Platforms: Windows NT
Description:

The Windows NT System Log was found to be accessible. This enables an attacker to read the System Log on a Windows NT computer. This could also indicate that the guest account is enabled, possibly with network access rights.
Remedy:

Remove network access rights for the Guest account.

To remove network access rights, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Check administrative rights on the machine, and the state of the network access right for the Guest account.

—AND—

Remove Administrator access for unauthorized user accounts.

To remove Administrator access, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Double-click the Administrators group, or the group you use to assign administrative rights.
  3. Remove any unexpected Members. Look for the following:
    • User accounts or groups that do not need administrative rights.
    • User accounts or groups that are disabled or obsolete.
  4. The Guest account should not be a member of Administrators unless there is a compelling reason.
References:


Users enumerated through a null session

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Users - null session
Platforms: Windows NT
Description:

Users were enumerated through a null session. Account names may be acquired, providing the foundation for a brute force attack.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or Windows NT 4.0 Service Pack 2 (SP2) users must apply the sec fix, then regulate access to the NT registry.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

To apply sec-fix, follow these steps:

  1. From the Windows NT Start menu, select Run.
  2. Type ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/sec-fix/ and click OK.
  3. View README.TXT for version and execution.

—AND—

To regulate access to the NT registry, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA.
  3. From the Edit menu, select Add Value to display the Add Value dialog box. Use the following entries:

    4. Value Name: RestrictAnonymous

    Data Type: REG_DWORD

    Value: 1.

  4. Reboot the system to apply the changes.

Warning: The winreg key will not be present if Service Pack 3 is not installed. Resetting the Registry entries is only effective after applying the patch and Service Pack 3. For more information, see Microsoft Knowledge Base Article Q155363.
References:


ICMP redirect downed host

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: ICMP Redirect
Platforms: Unix, NetWare: 3.12, OS-9
Description:

ICMP redirects targeted at hosts with weaker TCP/IP stack implementations have been shown to cause system failures and other adverse affects. NetWare, Windows, and especially embedded systems like OS-9 have been shown to be very susceptible to attacks using ICMP redirects.

Warning: Various networked embedded controllers may hang or shut down if they receive an ICMP redirect with code=4. If your network contains controllers attached to automation equipment, manufacturing equipment, HVAC (Heating, Ventilation, and Air Conditioning) equipment, and medical equipment, do not perform ICMP redirects. See the ISS Security Advisory listed in the references.
Remedy:

Many firewall builders block external ICMP traffic from their internal network, since it limits the ability of outsiders to ping hosts or modify routing tables. Protecting against external ICMP redirects is usually accomplished at the router or the firewall. You should enable the anti-redirect feature on your Internet router or firewall.

If your router or firewall does not support anti-redirects, consider upgrading as soon as possible or contact the vendor for alternatives.
References:

Internet and Firewall Security, What are ICMP redirects and redirect bombs?, http://slis-two.lis.fsu.edu/~security/Firewall/page17.htm

The NT Shop, ICMP Redirects, http://www.ntsecurity.net/security/icmp-redirects.htm

ISS Security Advisory #14, ICMP Redirects Against Embedded Controllers, http://xforce.iss.net/alerts/advise14.php3


Land denial of service attack

Risk Level: Low risk vulnerability Low

Check or Attack Name: land
Platforms: Any, Windows NT
Description:

The land exploit consists of a forged packet sent to a target machine, with identical source and destination addresses, and identical source and destination ports. This type of packet is known to crash many machines.
Remedy:

Users should contact their vendors for fix information, NT users should follow the instructions below.

Windows NT: Apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 teardrop2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/ (which supersedes the land patch).

To apply teardrop2, follow these steps:

  1. Open a web browser.
  2. Go to 'ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/.
  3. View the readme.txt for patch version and execution.
  4. Download the patch appropriate for your system.
  5. Locate and execute the file you downloaded to your system.
  6. Follow the installation directions.

—AND—

Applying router or firewall rules that deny all incoming packets claiming to originate from the internal network is good practice, and will stop this attack.
References:

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, http://support.microsoft.com/support/kb/articles/q179/1/29.asp

Microsoft Knowledge Base Article Q165005, Windows NT Slows Down Because of Land Attack, http://support.microsoft.com/support/kb/articles/q165/0/05.asp

SCO Security Bulletin 98:01, IP-based Denial of Service Attacks, ftp://ftp.sco.com/SSE/security_bulletins/SB.98:01a

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/teardrop2-fix/Q179129.txt

Microsoft Knowledge Base Article Q165005, Windows NT Slows Down Due to Land Attack, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/archive/land-fix/Q165005.txt

Hewlett-Packard Security Bulletin HPSBUX9801-076, Security Vulnerability with land on HP-UX, http://us-support.external.hp.com/

CERT Advisory CA-97.28, IP Denial-of-Service Attacks, http://www.cert.org/advisories/CA-97.28.Teardrop_Land.html


SYN flood denial of service attack can crash machines or degrade performance

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: syncstorm
Platforms: Any, Windows NT: 3.5.1, Windows NT: 4.0, Windows NT: 4.0 SP1
Description:

SYN flooding is an attack based on sending numerous session connection requests to a server and never completing the entire handshake. In some systems, this behavior depletes the new connection buffer space and records all the new connections, which results in a denial of service for clients wishing to make legitimate connections.
Remedy:

Most modern releases of operating systems contain fixes for SYN-based flooding attacks and users should contact their vendor for further information. Windows NT users should upgrade to at least SP2 or install the synattack post-SP1 hotfix to remedy this vulnerability.
References:

IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1996:006.1, Newly Available Patches for IBM AIX(r) Address `SYN Flood' and `Ping o' Death' Vulnerabilities, http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories

Microsoft Knowledge Base Article Q142641, Internet Server Unavailable Because of Malicious SYN Attacks, http://support.microsoft.com/support/kb/articles/q142/6/41.asp

CERT Advisory CA-96.21, TCP SYN Flooding and IP Spoofing Attacks, http://www.cert.org/advisories/CA-96.21.tcp_syn_flooding.html

Silicon Graphics Inc. Security Advisory 19960901-01-A, TCP SYN Denial of Service Attack, ftp://sgigate.sgi.com/security/19960901-01-A

Silicon Graphics Inc. Security Advisory 19961202-01-PX, TCP SYN and Ping Denial of Service Attacks, ftp://sgigate.sgi.com/security/19961202-01-PX

Sun Microsystems, Inc. Security Bulletin #00136, TCP-based "SYN flood" denial-of-service attack, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/136&type=0&nav=sec.sba


Teardrop IP fragmentation overlap

Risk Level: High risk vulnerability High

Check or Attack Name: Teardrop
Platforms: Any
Description:

The attacker sends a series of fragmented IP datagram pairs to the target (how many depends on the operating system—Windows NT can take up to 50, while Linux crashes with one pair). The first fragment is sent with an offset of 0 (telling the IP that it is the first fragment in the list) and a payload of size N. Subsequent fragments are sent with an offset telling IP that it should overlap inside the previous fragment, but the fragment's payload is either non-existent, or quite small (1 or 2 bytes). Affected machines crash or reboot.
Remedy:

Apply necessary patches.
References:

CERT Advisory CA-97.28, IP Denial-of-Service Attacks, http://www.cert.org/ftp/cert_advisories/CA-97.28.Teardrop_Land

SCO Security Bulletin 98:01, IP-based Denial of Service Attacks, ftp://ftp.sco.com/SSE/security_bulletins/SB.98:01a

CERT Advisory CA-98.13, Tcp Denial of Service, http://www.cert.org/advisories/CA-98-13-tcp-denial-of-service.html


SunOS can be crashed with malformed UDP packets

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: udpbomb
Platforms: | SunOS: 4.1.3a1 or earlier
Description: | Unpatched versions of SunOS 4.1.3 can be remotely crashed by sending a malformed UDP packet.
Remedy: | Obtain and apply Sun Patch ID#100567-04 "SunOS 4.1,4.1.1, 4.1.2, 4.1.3: mfree and icmp redirect security patch" at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References: |


Out of Band denial of service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: oob_crash
Platforms: Windows NT, Windows 95, SCO OpenServer: 5.0
Description:

The machine is vulnerable to the Out of Band (OOB) attack. Sending out of band data to port 139 will cause Windows NT to stop and Windows 95 to lose networking and possibly crash. Other systems have also been shown to be vulnerable to this attack.
Remedy:

Apply the latest Windows NT 4.0 Service Pack or Windows NT 4.0 Service Pack 3 (SP3) users must apply the teardrop2 patch.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must apply the teardrop2 patch:

  1. Open a web browser.
  2. Go to 'ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/teardrop2-fix/.
  3. View the README.TXT for patch version and execution.
  4. Download the appropriate patch for your computer.
  5. Locate the file you just downloaded on your computer.
  6. Follow the installation directions to install the patch.
References:

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, http://support.microsoft.com/support/kb/articles/q179/1/29.asp

CIAC Information Bulletin H-57, Windows NT/95 Out of Band Data Exploit, http://ciac.llnl.gov/ciac/bulletins/h-57.shtml

SCO Security Bulletin 98:01, IP-based Denial of Service Attacks, ftp://ftp.sco.com/SSE/security_bulletins/SB.98:01a

Microsoft Knowledge Base Article Q179129, STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/teardrop2-fix/Q179129.txt


Rlogin vulnerable through TCP sequence prediction spoofing

Risk Level: High risk vulnerability High

Check or Attack Name: rloginspoof
Platforms: Any
Description:

The rlogin service may allow an attacker masquerading as a user from a trusted host to remotely execute a command through the rlogin service.

TCP sequencing has been detected as predictable. If the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from trusted machines and compromise such services as rsh and rlogin, because their authentication is based on IP addresses. The percentage of guessed sequence numbers increases the likelihood that an attacker could predict the sequence and compromise the system.
Remedy:

Turn off rlogin and other services that authenticate based on IP address. Install patches from your vendor that correct TCP sequence prediction. For Windows NT, apply Service Pack 3 or later, which improves (but does not fully correct) Windows NT's sequence predictability. As a result, the Windows NT machines may continue to report this vulnerability.

Windows: Apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

Hewlett-Packard: HP-UX 9.0 users can obtain and apply patch ID PHNE_14212 at http://us-support.external.hp.com/. Note: Requires no-cost password to access Patch Database.
References:

CERT Advisory CA-96.21, TCP SYN Flooding and IP Spoofing Attacks, http://www.cert.org/advisories/CA-96.21.tcp_syn_flooding.html

CERT Advisory CA-95.01, IP Spoofing Attacks and Hijacked Terminal Connections, http://www.cert.org/advisories/CA-95.01.IP.spoofing.attacks.and.hijacked.terminal.connections.html


Rsh vulnerable through TCP seq prediction spoofing

Risk Level: High risk vulnerability High

Check or Attack Name: rshspoof
Platforms: Any
Description:

The rsh service is vulnerable. An attacker masquerading as a user from a trusted host can execute a command remotely through the rsh service.

This vulnerability occurs because TCP sequencing has been detected as predictable. If the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from trusted machines and compromise such services as rsh and rlogin, because their authentication is based on IP addresses. The percentage of guessed sequence numbers increases the likelihood that an attacker could predict the sequence and compromise the system.

False Positives: Some patches make sequence prediction more difficult, but still possible. As a result, the host may continue to report this vulnerability.
Remedy:

Turn off rshd and other services that authenticate based on IP address. Comment out the services from the /etc/inetd.conf file by putting a # at the beginning of the line and sending a HUP signal to the inetd (# kill -HUP <inetd.pid>). Install patches from your vendor that correct TCP Sequence Prediction.

References:

CERT Advisory CA-95.01, IP Spoofing Attacks and Hijacked Terminal Connections, http://www.cert.org/ftp/cert_advisories/CA-95:01.IP.spoofing


TCP sequence prediction

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: tcppred
Platforms: Any
Description:

The TCP sequence was found to be predictable. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from trusted machines. These forged packets can compromise services, such as rsh and rlogin, because their authentication is based on IP addresses. The percentage guessed is the likelihood that an attacker could predict the sequence and compromise the system.
Remedy:

Ask your vendor for patches to correct TCP sequence prediction. Note that some patches make sequence prediction more difficult, but still possible. As a result, the host may continue to report this vulnerability.

For Windows NT, apply Service Pack 3 or later, which improves (but does not fully correct) Windows NT's sequence predictability. As a result, the Windows NT machines may continue to report this vulnerability.

Windows: Apply the latest Windows NT 4.0 Service Pack.

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

Hewlett-Packard: HP-UX 9.0 users can obtain and apply patch ID PHNE_14212 at http://us-support.external.hp.com/wpsl/bin/doc.pl/ . Note: Requires no-cost password to access Patch Database.
References:

CERT Advisory CA-95.01, IP Spoofing Attacks and Hijacked Terminal Connections, http://www.cert.org/advisories/CA-95.01.IP.spoofing.attacks.and.hijacked.terminal.connections.html

Microsoft Knowledge Base Article Q192292, Unpredictable TCP Sequence Numbers in SP4, http://support.microsoft.com/support/kb/articles/q192/2/92.asp


Etherstatd service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: etherstatd
Platforms: | Unix
Description: | The RPC etherstatd service has been detected as running. The etherstatd service puts a specified ethernet interface into promiscuous mode and provides traffic statistics to remote programs. This program registers itself with the RPC portmapper as program 100010.
Remedy: | This service should be disabled if you do not wish remote users to be able to view your network traffic statistics.
References: |


SMB NetBIOS Test: Possible NT dotdot denial of service

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NetBios dotdot DoS
Platforms: | Windows NT
Description: | Windows NT 3.51 systems prior to Service Pack 4 will blue screen when you access the root directory of a shared tree prepended with (..).
Remedy: | Apply the latest Windows NT 3.51 service pack (any service pack at or after SP4). The latest service pack is available at http://support.microsoft.com/support/downloads/LNP391.asp.
References: |


Shares enumerated through a null session

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NetBIOS shares - null session
Platforms: Windows NT
Description:

Users or shares were detected using a null session. A null session is a NetBIOS connection established with a zero length string as user, password, and domain name, which is designed to enable enumeration of shares and users. This capability has always been present in Windows NT, but was discovered to allow access to the registry with the same level of permissions as the Everyone group. It is a medium risk vulnerability (similar to finger) that allows users and shares to be enumerated.
Remedy:

Windows NT 4.0 users must first apply the latest Windows NT 4.0 Service Pack or the post-SP2 sec-fix patch described later, remove all unnecessary shares, and restrict anonymous connections.

Note: The vulnerability will be flagged if any shares are detected, even if they are not accessible. Windows 95 machines must disable file and print sharing to avoid flagging this vulnerability. If shares are needed and must be secure, consider upgrading to Windows NT running NTFS.

Windows 95: To remove file and print sharing:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. From Configuration, click File and Print Sharing.
  3. Disable ‘I want to be able to give others access to my files.’
  4. Disable ‘I want to be able to allow others to print to my printer(s).’
  5. Click OK and restart the computer. The Windows 95 machine no longer allows shares to exist or be created.

Windows NT: Perform the following actions:

Remove unnecessary shares. Choose one of these options:

  • Remove the share from a local computer.

    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. To disallow access to all users, select the Not Shared check box.

  • Remove the share from a remote computer.

    1. From a remote computer, open the Server Manager.
    2. Select the host name.
    3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
    4. Select the NetBIOS share.
    5. Click Stop Sharing.

  • Remove the share from the command line.

    1. From a command prompt, type: net share sharename /delete

—AND—

Apply the latest Windows NT 4.0 Service Pack. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.

Windows NT 4.0 Service Pack 2 (SP2) users must apply the sec-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/sec-fix/.

—AND—

Restrict anonymous connections by changing the registry. To restrict anonymous connections in Windows NT:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. If you have not already done so, apply the latest Windows NT 4.0 Service Pack or the post-SP2 sec-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/sec-fix/.
  2. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA.
  4. From the Edit menu, choose Add Value to display the Add Value dialog box.
  5. In the Value Name field, type RestrictAnonymous.
  6. Select REG_DWORD as the Data Type.
  7. Click OK to display the DWORD Editor.
  8. In the Data field, type 1. (Ignore the Radix setting.)
  9. Click OK. Registry Editor adds the key to the registry.
  10. Reboot the system to apply the changes.

Note: Changing the Registry entries is only effective after applying the post-SP2 sec-fix patch or the latest Windows NT Servic

References:

Microsoft Knowledge Base Article Q143475, Windows NT System Key Permits Strong Encryption of the SAM, http://support.microsoft.com/support/kb/articles/q143/4/75.asp

Microsoft Knowledge Base Article Q155363, HOWTO: Regulate Network Access to the Windows NT Registry, http://support.microsoft.com/support/kb/articles/q155/3/63.asp hotfixes-postSP2/sec-fix/Q143474.TXT

Microsoft Knowledge Base Article Q143474, Restricting Information Available to Anonymous Logon Users, http://support.microsoft.com/support/kb/articles/q143/4/74.asp

Microsoft Knowledge Base Article Q143474, Restricting Information Available to Anonymous Logon Users, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/sec-fix/Q143474.txt

Microsoft Knowledge Base Article Q143475, Windows NT System Key Permits Strong Encryption of the SAM, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/sec-fix/Q143475.txt hotfixes-postSP2/sec-fix/Q143475.TXT


X11 MIT-MAGIC-COOKIE-1 prediction could allow remote access to arbitrary X sessions

Risk Level: High risk vulnerability High

Check or Attack Name: Xguesscookie
Platforms: IRIX, X11
Description:

A vulnerability exists in some implementations of X11 that rely on MIT-MAGIC-COOKIE-1 for security, allowing a remote attacker access to arbitrary X sessions. The vulnerability affects sites using xdm for generating keys when xdm has not been compiled to use XDM-AUTHORIZATION-1. The keys produced by xdm will be cryptographically insecure and easily guessable by an attacker.
Remedy:

Users of X11 from the X Consortium should apply, at least, up to patch #13 and preferably upgrade to X11R6.1. XFree86 users should upgrade to, at least, 3.1.2 with applicable patches and preferably upgrade to the latest release available.
References:

CERT Vendor-Initiated Bulletin VB-95:08, X Authentication Vulnerability, http://www.cert.org/ftp/cert_bulletins/VB-95%3a08.X_Authentication_Vul

Silicon Graphics Inc. Security Advisory 19960601-01-I, X Authentication Vulnerability, ftp://sgigate.sgi.com/security/19960601-01-I

CIAC Information Bulletin G-04, G-04: X Authentication Vulnerability, http://ciac.llnl.gov/ciac/bulletins/g-04.shtml


Open X display

Risk Level: | High risk vulnerability High | Check or Attack Name: xcheck
Platforms: | X11
Description: | Open X Displays allow an attacker to capture keystrokes and to execute commands remotely. Many users have their X Server set to xhost +, permitting access to the X Server by anyone, from anywhere.
Remedy: | If you are using xhost-type authentication you should issue an xhost - command and then selectively allow only trusted hosts to connect with xhost + commands. A cryptographically secure authentication, such as provided by the xauth program, is always preferred. Consult your X11 server's documentation for further security information.
References: | Indiana University, Crash Course in X Windows Security, http://www.uwsg.indiana.edu/usail/external/recommended/Xsecure.html


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 91 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Brute Force
TelnetOpen | Telnet available with no login
deftel | Telnet default account accessible
DNS
DNS version | DNS version denial of service
DnsRev | DNS service reverse lookup
dnsbadseq | DNS bad sequence
dnsupdates | DNS allow updates can corrupt name server
iquery | DNS server inverse queries
ntdnsdos | Windows NT DNS denial of service attack
zonexfer | DNS honors zone transfer requests
Daemons
chargen | Chargen service
fingerbomb | Finger bomb recursive request
netstat | Netstat Inet service
openclose | Open/Close connection flood
sysstat | Sysstat
E-mail
EhloCheck | SMTP daemon supports EHLO
SMTP DoS for MS Exchange | SMTP Exchange denial of service
badforwards | User .forward file found
imapd Core Vulnerability | IMAP-4.1BETA server can be crashed with a core file containing hashed passwords
qmailrecipient | Qmail RCPT denial of service attack
qmailswap | Qmail length denial of service attack
smtp_outdated | Sendmail daemon outdated
smtpexec | Sendmail remote execution
smtpsyslog | Syslog buffer overflow allows remote execution through network daemons
FTP
Cwdleak | FTP Getcwd() file descriptor leak
FTP PASV Denial of Service | FTP PASV port denial of service attack
Ftpd Args Core Dump | Ftpd args core dump
WarFTPD | WarFTPD buffer overflow vulnerability
ftpanon | Anonymous FTP enabled
ftpbounce | FTP bounce attack
ftpcd | FTP CWD ~root login
ftpexec | Wu-ftp site exec command could compromise root privileges
ftphome | FTP home directory bug
ftppasvcore | Premature PASV command could cause some FTP servers to crash possibly compromising system passwords
ftppwless | FTP daemon with no password
ftprnfr | Wu-ftp RNFR command vulnerable
ftpservu | FTP CWD buffer overflow
ftpwrite | FTP directories writable
NFS
Mountd File Exists | NFS mount daemon could allow remote attackers to determine whether files exist on a system
MountdReserved | NFS mount daemon operating on an unreserved port
mountd | Unix running NFS
nfsCache | NFS cache poisoning
nfsbugadmin | NFS exports outside domain
nfscd | NFS CD accesses non-exported files
nfsd | NFS Service
nfsexp | NFS exports
nfsguess | Guessable NFS filehandles
nfsmknod | NFS mknod
nfsmount | NFS mountable
nfspmap | NFS portmapper export
nfsrhosts | NFS .Rhosts
nfssuper | Superfluous NFS daemon
nfsuid | NFS does not properly identify UID
nfsultrix | NFS mountable via Ultrix remount bug
nfswrite | NFS writable
NT Critical Issues
repair insecure Repair directory readable
NT Networking
Null Session User Modals Windows NT null session user modals
NT Patches
Chargen Patch | Chargen patch not applied
DNS Predictable Query | DNS predictable query
LSA patch for NT SP3 | LSA patch not applied
Modified Teardrop Attack | Modified teardrop attack can remotely crash machines
NTPrivFix | SecHole lets non-administrative users gain Debug Level access
NTWinsupFix | WINS update patch not installed header
NTy2k | Year 2000 Patch not installed
Ntrras | RRAS patch not installed
PPT patch | PowerPoint security patch missing
PPTP3 Fix | PPTP patch not installed
RPC DLL version | Windows NT RPC locator vulnerable
SP2 security patches | Windows NT Post-SP2 security patches missing
SSLpatch | SSL patch not installed
WINS Patch | WINS patch not applied
Windows NT SMB logon DoS | Windows NT denial of service attack
kernel version | Windows NT kernel outdated
ssping | Ssping patch not applied
syncstorm patch | Syncstorm patch missing
NT Policy Issues
applog | Application log readable
systemlog | Windows NT system log accessible
NT Users
Users - null session Users enumerated through a null session
Network
ICMP Redirect | ICMP redirect downed host
Teardrop | Teardrop IP fragmentation overlap
land | Land denial of service attack
oob_crash | Out of Band denial of service
syncstorm | SYN flood denial of service attack can crash machines or degrade performance
udpbomb | SunOS can be crashed with malformed UDP packets
Protocol Spoofing
rloginspoof | Rlogin vulnerable through TCP sequence prediction spoofing
rshspoof | Rsh vulnerable through TCP seq prediction spoofing
tcppred | TCP sequence prediction
RPC
etherstatd Etherstatd service
Shares
NetBIOS shares - null session | Shares enumerated through a null session
NetBios dotdot DoS | SMB NetBIOS Test: Possible NT dotdot denial of service
NT Networking
Xguesscookie | X11 MIT-MAGIC-COOKIE-1 prediction could allow remote access to arbitrary X sessions
xcheck | Open X display


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 91 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
Cwdleak | FTP Getcwd() file descriptor leak
NTPrivFix | SecHole lets non-administrative users gain Debug Level access
PPTP3 Fix | PPTP patch not installed
SMTP DoS for MS Exchange | SMTP Exchange denial of service
SSLpatch | SSL patch not installed
Teardrop | Teardrop IP fragmentation overlap
TelnetOpen | Telnet available with no login
WarFTPD | WarFTPD buffer overflow vulnerability
Xguesscookie | X11 MIT-MAGIC-COOKIE-1 prediction could allow remote access to arbitrary X sessions
deftel | Telnet default account accessible
ftpcd | FTP CWD ~root login
ftpexec | Wu-ftp site exec command could compromise root privileges
ftppwless | FTP daemon with no password
imapd Core Vulnerability | IMAP-4.1BETA server can be crashed with a core file containing hashed passwords
nfscd | NFS CD accesses non-exported files
nfsguess | Guessable NFS filehandles
nfsmknod | NFS mknod
nfsmount | NFS mountable
nfspmap | NFS portmapper export
nfssuper | Superfluous NFS daemon
nfsuid | NFS does not properly identify UID
nfsultrix | NFS mountable via Ultrix remount bug
nfswrite | NFS writable
rloginspoof | Rlogin vulnerable through TCP sequence prediction spoofing
rshspoof | Rsh vulnerable through TCP seq prediction spoofing
smtp_outdated | Sendmail daemon outdated
smtpexec | Sendmail remote execution
smtpsyslog | Syslog buffer overflow allows remote execution through network daemons
xcheck | Open X display
Low
EhloCheck | SMTP daemon supports EHLO
NTy2k | Year 2000 Patch not installed
Null Session User Modals | Windows NT null session user modals
PPT patch | PowerPoint security patch missing
applog | Application log readable
dnsbadseq | DNS bad sequence
dnsupdates | DNS allow updates can corrupt name server
etherstatd | Etherstatd service
ftpanon | Anonymous FTP enabled
ftphome | FTP home directory bug
kernel version | Windows NT kernel outdated
land | Land denial of service attack
mountd | Unix running NFS
netstat | Netstat Inet service
nfsCache | NFS cache poisoning
nfsd | NFS Service
nfsexp | NFS exports
qmailswap | Qmail length denial of service attack
sysstat | Sysstat
systemlog | Windows NT system log accessible
Low
Chargen Patch | Chargen patch not applied
DNS Predictable Query | DNS predictable query
DNS version | DNS version denial of service
DnsRev | DNS service reverse lookup
FTP PASV Denial of Service | FTP PASV port denial of service attack
Ftpd Args Core Dump | Ftpd args core dump
ICMP Redirect | ICMP redirect downed host
LSA patch for NT SP3 | LSA patch not applied
Modified Teardrop Attack | Modified teardrop attack can remotely crash machines
Mountd File Exists | NFS mount daemon could allow remote attackers to determine whether files exist on a system
MountdReserved | NFS mount daemon operating on an unreserved port
NTWinsupFix | WINS update patch not installed header
NetBIOS shares - null session | Shares enumerated through a null session
NetBios dotdot DoS | SMB NetBIOS Test: Possible NT dotdot denial of service
Ntrras | RRAS patch not installed
RPC DLL version | Windows NT RPC locator vulnerable
SP2 security patches | Windows NT Post-SP2 security patches missing
Users - null session | Users enumerated through a null session
WINS Patch | WINS patch not applied
Windows NT SMB logon DoS | Windows NT denial of service attack
badforwards | User .forward file found
chargen | Chargen service
fingerbomb | Finger bomb recursive request
ftpbounce | FTP bounce attack
ftppasvcore | Premature PASV command could cause some FTP servers to crash possibly compromising system passwords
ftprnfr | Wu-ftp RNFR command vulnerable
ftpservu | FTP CWD buffer overflow
ftpwrite | FTP directories writable
iquery | DNS server inverse queries
nfsbugadmin | NFS exports outside domain
nfsrhosts | NFS .Rhosts
ntdnsdos | Windows NT DNS denial of service attack
oob_crash | Out of Band denial of service
openclose | Open/Close connection flood
qmailrecipient | Qmail RCPT denial of service attack
repair insecure | Repair directory readable
ssping | Ssping patch not applied
syncstorm | SYN flood denial of service attack can crash machines or degrade performance
syncstorm patch | Syncstorm patch missing
tcppred | TCP sequence prediction
udpbomb | SunOS can be crashed with malformed UDP packets
zonexfer | DNS honors zone transfer requests