BIND servers can be remotely queried for their version

Risk Level: | Low risk vulnerability Low | Check or Attack Name: bindvrs
Platforms: | BIND
Description: | BIND (Berkeley Internet Name Domain) servers support the ability to be remotely queried for their version numbers. This feature could be used by attackers to remotely probe machines for vulnerable versions of BIND to be exploited in later attacks.
Remedy: | Refer to the documentation that accompanies BIND on the procedure for disabling the version feature.
References: | Internet Software Consortium (ISC), BIND page, http://www.isc.org/bind.html


FTP proxy penetrated

Risk Level: | High risk vulnerability High | Check or Attack Name: ftpproxy
Platforms: | Any
Description: | The FTP proxy is not configured correctly, and could represent a breach in your firewall.
Remedy: | If found vulnerable, review the firewall proxy rules and reconfigure as needed. For more information, see your vendor's documentation.
References: |


HTTP proxy penetrated

Risk Level: | High risk vulnerability High | Check or Attack Name: wwwproxypen
Platforms: | Any
Description: | The web (HTTP) proxy allowed access through the proxy server. If the test was conducted from outside the firewall, an attacker could use the proxy to access any portion of the network inside the firewall. False Positives: If the test was conducted from inside the firewall, no risk is indicated.
Remedy: | Review the proxy server's settings. Refer to your firewall's documentation for more information.
References: |


SOCKS v3 daemon misconfigured

Risk Level: | High risk vulnerability High | Check or Attack Name: SOCKS
Platforms: | Any
Description: | An insecure SOCKS v3.0 service configuration was detected. This configuration permits attackers to access the network through the gateway host, and bypass proxy server controls and services normally relayed securely. Connections to the following services occur through the SOCKS proxy: FTP, Telnet, Sendmail (SMTP), Finger, HTTP, and POP3.
Remedy: | Verify the proxy rules and reconfigure as needed. For more information, see your vendor's documentation.
References: |


SOCKS v4 daemon misconfigured

Risk Level: | High risk vulnerability High | Check or Attack Name: SocksV4
Platforms: | Any
Description: | An insecure SOCKS v4.0 service configuration was detected. This configuration permits attackers to access the network through the gateway host, and bypass proxy server controls and services normally relayed securely. Connections to the following services occur through the SOCKS proxy: FTP, Telnet, Sendmail (SMTP), Finger, HTTP, and POP3. SOCKS v4 may be detected on SOCKS v5 servers if the server is backwards compatible.
Remedy: | Verify proxy rules, and reconfigure as needed. For more information, see your vendor's documentation.
References: |


SOCKS v5 daemon misconfigured

Risk Level: | High risk vulnerability High | Check or Attack Name: SocksV5
Platforms: | Any
Description: | An insecure SOCKS v5.0 service configuration was detected. This configuration permits attackers to access the network through the gateway host, and bypass proxy server controls and services normally relayed securely. Connections to the following services occur through the SOCKS proxy: FTP, Telnet, Sendmail (SMTP), Finger, HTTP, and POP3. SOCKS v4 may be detected on SOCKS v5 servers if the server is backwards compatible.
Remedy: | Verify proxy rules, and reconfigure as needed. For more information, see your vendor's documentation.
References: |


Squid proxy was penetrated to reach protected hosts

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: squidprox
Platforms: | Squid
Description: | A firewall's squid HTTP proxy was used to connect to a URL inside the firewall. If this is allowed, an attacker can bypass certain firewall filters.
Remedy: | Check your squid configuration. For more information, refer to your firewall's documentation.
References: |


Rstat output

Risk Level: Low risk vulnerability Low

Check or Attack Name: rstatout
Platforms: Unix
Description:

The rstat service was found. The rstatd daemon has provided information to a request. The rstatd daemon gives an attacker the following information:

  • When the machine was last booted, possibly revealing the maintenance schedule or the host's reliability.
  • How much CPU it is using, providing a load average.
  • How many disks it has, providing the attacker with the storage layout for the host.
  • How many packets have reached it, indicating the amount of network traffic processed by the host.
Remedy:

Disable the rstat service. Comment out rstat from the /etc/inetd.conf file by putting a # at the beginning of the line and sending a HUP signal to the inetd (# kill -HUP <inetd.pid>).

References:


NIS rstat service is running

Risk Level: | Low risk vulnerability Low | Check or Attack Name: rstatd
Platforms: | Unix
Description: | The rpc.rstatd service was found. The rstat daemon gives an attacker information about the host, including when the machine was last booted, how much CPU it is using, how many disks it has, and how many packets have reached it.
Remedy: | If the rpc.rstatd service isn't needed on your network(s), disable it by commenting it out of the inetd.conf file or the appropriate RC file.
References: |


NIS YPBind service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ypbind
Platforms: | Any
Description: | The NIS ypbind service was found. NIS (Network Information Service) contains data, such as host files, password files, and e-mail aliases for entire networks. It allows a remote user to obtain copies of the NIS password map information. An attacker who possesses the NIS domain name (often set up as a derivative of the public domain name) can steal information helpful in guessing passwords and gaining unauthorized access.
Remedy: | The NIS domain name should be hard to guess.
References: |


Ypbind is running over a non-reserved port

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: YpBindReserved
Platforms: | Any
Description: | The target has a ypbind running over a non-reserved port. This daemon is probably vulnerable to port hijacking and should be moved to a reserved port.
Remedy: | Contact the vendor for more information.
References: |


NIS maps

Risk Level: Low risk vulnerability Low

Check or Attack Name: ypmap
Platforms: Unix
Description:

NIS (Network Information Service) contains data such as host files, password files, and e-mail aliases for entire networks. It allows a remote user to obtain copies of the NIS password map information. An attacker who possesses the NIS domain name (often set up as a derivative of the public domain name) can steal information helpful in guessing passwords and gaining unauthorized access.
Remedy:

Fortify the NIS domain name and use strong password techniques:

  • The NIS domain name should be something hard to guess. If it can be guessed using brute force methods, then change the NIS domain name.
  • In the event that an attacker successfully obtains the password file, the passwords should be hard to guess. The crack utility and password shadowing help correct this weakness, but NIS/YP (Yellow Pages) transfers include encrypted passwords even if they are shadowed and unreadable on the server. The attacker can decode them at leisure using brute force methods.
References:


Yppasswdd service

Risk Level: Low risk vulnerability Low

Check or Attack Name: yppasswdd
Platforms: Unix
Description:

The yppasswdd service was detected as running. yppasswdd is a daemon that changes (or installs) the network password associated with the user’s username (your own name by default) in the Network Information Service (NIS) database.
Remedy:

Disable the yppasswdd service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


NIS Yellow Pages (YP) service is running

Risk Level: Low risk vulnerability Low

Check or Attack Name: ypserv
Platforms: Unix
Description:

The NIS YP service was found. Unpatched versions allow attackers to capture the password file.

Remedy:

Disable NIS if it is not needed.

To disable NIS, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Ypserv on unreserved Port

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: YpServReserved
Platforms: | Any
Description: | The target has a ypserv running over a non-reserved port. This daemon is probably vulnerable to port hijacking and should be moved to a reserved port.
Remedy: | Contact the vendor for more information.
References: |


Ypxfrd service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ypxfrd
Platforms: | Unix
Description: | The RPC ypxfrd service has been detected as running. The ypxfrd daemon is designed to significantly improve the efficiency of transferring NIS maps between hosts. The ypxfrd process registers with the RPC portmapper as program 100069.
Remedy: | This service should be disabled if your network does not implement NIS or is small enough that map transfers do not have a serious impact on performance.
References: |


Guest user has blank password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: guestblankpw
Platforms: Windows NT
Description:

The Guest account has no password. Any individual can log in to this account with any user name and any password.

This issue applies for both enabled and disabled Guest accounts. Although disabled accounts are less of a concern, an attacker may be able to enable the Guest account at a later time if they have already succeeded in compromising the network.
Remedy:

Set the Guest password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account.
  3. From the Policies menu, select Account.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account.
  3. From the User menu, select Properties.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.
References:


Guest account has no password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: guestnopw
Platforms: Windows NT
Description:

A Guest account with no password has been detected. An attacker could use this account to gain access to sensitive information.
Remedy:

Set the guest password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select Guest.
  3. From the Policies menu, select Account.
  4. Under Minimum Password Length, set the minimum length to at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select Guest.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Under Password, change the password.
  5. Under Confirm Password, confirm the password.
  6. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Guest username same as password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: guestuserpw
Platforms: Windows NT
Description:

The Guest account has the password set to the account name. An attacker could use this account to gain access to sensitive information.

Windows NT 4.0 Service Pack 2 (SP2) contains a password filter that can be installed, and Service Pack 3 allows checking of dictionary passwords. We strongly recommend using non-trivial passwords.
Remedy:

Windows NT 4.0 Service Pack 2 (SP2) or Service Pack 3 (SP3) includes a password filter (PASSFILT.DLL) that allows system administrators to increase password strength. This filter is copied to %system root%\SYSTEM32 when the Service Pack is installed on the system. In networked environments, the password filter should be copied to the primary domain controller for the domain, and to any backup domain controllers in the event the server role in the domain changes.

—AND—

Set the administrator password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.
  6. From the User menu, select Properties to display the User Properties dialog box.
  7. Type and confirm a non-trivial password.
  8. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.
References:


Primary domain controller identified

Risk Level: Low risk vulnerability Low

Check or Attack Name: Primary Domain Controller
Platforms: Windows NT
Description:

The machine has been identified as a primary domain controller (PDC). This information could be used by an attacker to focus domain-wide structured attacks.

False Positives: If the host is inside the firewall, then this vulnerability is purely informational.
Remedy:

If NetBIOS ports are available, then determining if a host is a domain controller cannot be prevented. If the host is outside of a firewall, ports 135-139 should be filtered. If the PDC is inside the firewall, this vulnerability is purely informational.
References:


Lockout duration insufficient

Risk Level: Low risk vulnerability Low

Check or Attack Name: Lockout Duration
Platforms: Windows NT
Description:

The lockout duration is less than the value specified in the current policy. This value specifies how long an account is locked out if too many logon failures occur within the period of time specified by in User Manager. If the lockout duration is too short, or if account lockouts are not enabled, attackers can easily brute force your accounts.
Remedy:

Set the lockout Duration value so that it equals or exceeds the value in the current policy.

To change the account lockout duration, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. Enable Account Lockout.
  4. Set the Duration field to a value that is less than or equal to the value in the current policy.
  5. Click OK.
References:


Lockout window insufficient

Risk Level: Low risk vulnerability Low

Check or Attack Name: Lockout Window
Platforms: Windows NT
Description:

The lockout observation window is less than the value specified in the current policy. The Lockout Window specifies what period of time passes before the incorrect login count is reset. If the duration is too short, or if account lockouts are not enabled, attackers can more easily brute force your accounts.
Remedy:

Set the Reset Count After value so that it equals or exceeds the Lockout Window value in the current policy.

To change the account lockout duration, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. Enable Account Lockout.
  4. Set the Duration field to a value that is less than or equal to the value in the current Internet Scanner policy.
  5. Click OK.
References:


Logon hours not set

Risk Level: Low risk vulnerability Low

Check or Attack Name: Logon Hours Not Set
Platforms: Windows NT
Description:

A user has been found with no logon hours set. This setting allows the user to log on at any time. If logon hours are set, it may inhibit certain internal and external attacks.
Remedy:

To set logon hours for the user, follow these steps:

  1. Open User Manager for Domains. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select Hours. By default, all hours will be enabled.
  5. Select the times and days when the user should not be allowed to log on.
  6. Click Disallow.
  7. Repeat steps 5 and 6 until the logon hours meet your security policy.
References:


Lockout threshold incorrect

Risk Level: Low risk vulnerability Low

Check or Attack Name: lockout
Platforms: Windows NT
Description:

The lockout threshold is greater than the security policy requires. This situation allows an attacker to successfully attempt a brute force attack on any account. The lockout period should not be too long, or an attacker can use the lockout period in a denial of service attack.
Remedy:

Set the Lockout After n Bad Logins value so that it equals or is less than the value in the current policy.

To change an account lockout count, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. Enable Account Lockout.
  4. Set the Lockout After n bad logon attempts to a value that is less than or equal to the value in the current policy.
  5. Click OK.
References:


Inappropriate user with Act as Part of the Operating System privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Act as System Privilege
Platforms: Windows NT
Description:

A user has been detected with Act as part of the operating system privileges. This right is not normally granted to any users, and can be used to attain administrative rights.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Act as part of the operating system.
  5. Verify this right is set in accordance with your security policy.
    6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Backup Files and Directories privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Backup Privilege
Platforms: Windows NT
Description:

A user has been detected with the Back up Files and Directories privilege. This right is normally only granted to Administrators and Backup Operators, and can be used to read any file or registry key, regardless of permissions. If the user also has Restore Files and Directories privileges, the ownership of files and other objects can be changed.
Remedy:

Check user rights for Back up files and Directories. Remove any names disallowed by your security policy.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Back up files and directories.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q104221, Windows NT Backup and Security, http://support.microsoft.com/support/kb/articles/q104/2/21.asp


Inappropriate user with Create Permanent Shared Objects privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Create Permanent Object Privilege
Platforms: Windows NT
Description:

A user has been detected with Create Permanent Shared Object privileges. This right is not normally granted to any users, and can be used to attain administrative rights.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Create permanent shared objects.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Create a Pagefile privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Create Pagefile Privilege
Platforms: Windows NT
Description:

A user has been detected with Create Pagefile privileges. This right is normally only granted to Administrators.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Create a pagefile.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Create a Token Object privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Create Token Name Privilege
Platforms: Windows NT
Description:

A user has been detected with Create Token Object privileges. This right is not normally granted to any users.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Act as part of the operating system.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Debug Programs privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Debug Privilege
Platforms: Windows NT
Description:

A user has been detected with the Debug Programs privilege. This right is normally only granted to Administrators, and can be used to obtain higher access levels. Under some circumstances, it may be best not to grant this right to any user.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Debug programs.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q155075, Cannot End Service Processes with Task Manager, http://support.microsoft.com/support/kb/articles/q155/0/75.asp

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Disabled account

Risk Level: Low risk vulnerability Low

Check or Attack Name: Disabled Account
Platforms: Windows NT, Solaris: 2.5.1
Description:

A disabled user account has been detected. The administrator should periodically review and remove any disabled accounts that are no longer needed. An attacker could re-enable a disabled account.
Remedy:

Remove the account if it is not needed.

To remove an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account to be removed.
  3. Press Delete and confirm the delete operation.
References:


Domain Administrators group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Domain Admin
Platforms: Windows NT
Description:

A user was found in the Domain Administrators group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user in the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select Groups.
  5. In the Member list, highlight Domain Administrators and select Remove.
  6. Click OK.
References:


Domain Guest group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Domain Guest
Platforms: Windows NT
Description:

A user was found in the Domain Guests group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove the user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Domain Guests and click Remove.
  6. Click OK.
References:


Dormant account

Risk Level: Low risk vulnerability Low

Check or Attack Name: Dormant Account
Platforms: Windows NT
Description:

The user has not logged in for the amount of time specified by your policy. User accounts that are dormant can be exploited by an attacker, and should be removed if the account is no longer needed.
Remedy:

Disable the account if it is not needed. To disable an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

Remove the account if it is not needed. To remove an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account to be removed.
  3. Press Delete and confirm the delete action.
References:


Forced logoff not enabled for account with expired time

Risk Level: Low risk vulnerability Low

Check or Attack Name: Forced Logoff
Platforms: Windows NT
Description:

A user whose logon hours have expired is not forced to log off. If this option is not enabled, users will not be forced to log out once their allowed login hours expire. This situation allows a user to maintain open connections. If your security policy restricts logon hours, you may want to enable this feature.
Remedy:

Enable forced logoffs.

From a Primary Domain Controller (PDC), enable logoffs:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. Select the Forcibly Disconnect Remote Users From the Server When Logon Hours Expire check box. This option is visible only when the server is the PDC.

Note: If logon hours are not also restricted, this setting will have no effect.
References:


Guest account name exists

Risk Level: Low risk vulnerability Low

Check or Attack Name: Guest Exists
Platforms: Windows NT
Description:

The Guest account is named "Guest." If your security policy requires that the guest account be renamed, then this name should be changed. You should be aware, however, that an attacker can easily determine which account is the guest user, so this action is of very limited use in most situations.
Remedy:

To rename the Guest account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account.
  3. From the User menu, select Rename.
  4. Type a new name for the Guest Account.
  5. Click OK.
References:


Guest account in non-default group

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Guest in Group
Platforms: Windows NT
Description:

The Guest user has been detected in a group other than Guests or Domain Guests. This membership could result in granting higher access to the Guest user than desired.
Remedy:

Verify that guest should be a member of this group, and ensure that membership could not lead to higher access:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the group that includes the Guest account as a member.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select Guest, and click Remove.
  5. Click OK.
References:


Guest account includes unallowed user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Guest User
Platforms: Windows NT
Description:

An account was detected as a member of the Guest group, but the account is not an allowed Guest user. Verify that the user should be a member of this group.
Remedy:

Verify that the user should be a member of this group. If the user should not be a member of this group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups.
  5. Remove the user from the group.
  6. Click OK.
References:


Inappropriate user with Increase Scheduling Priority privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Increase Priority Privilege
Platforms: Windows NT
Description:

A user has been found with Increase Scheduling Priority privileges. This right is normally only granted to Administrators and Power Users.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Increase scheduling priority.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q103810, Realtime Priority Applications And Windows NT, http://support.microsoft.com/support/kb/articles/q103/8/10.asp

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Increase Quotas privilege

Risk Level: Low risk vulnerability Low

Check or Attack Name: Increase Quota Privilege
Platforms: Windows NT
Description:

A user has been detected with the Increase Quotas privilege. This right is not normally granted to any users.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Increase quotas.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp

Microsoft Knowledge Base Article Q131144, HOWTO: Assign Privileges to Accounts for API Calls, http://support.microsoft.com/support/kb/articles/q131/1/44.asp


Windows NT Interactive_Guest_Logon

Risk Level: Low risk vulnerability Low

Check or Attack Name: Interactive Guest Logon
Platforms: Windows NT
Description:

The Guest account is allowed to log on from the console. The console user may modify many sensitive settings in the registry, and it is best to prohibit the Guest account from logging in locally. By default, Windows NT 4.0 comes with the guest account disabled, so many administrators may find it sufficient to leave the account disabled.
Remedy:

Prevent the Everyone group from logging in locally:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Log on locally.
  4. Remove Everyone from the name list, and add any users who should be allowed to log in locally.
References:


Inappropriate user with Load and Unload Device Drivers privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Load Driver Privilege
Platforms: Windows NT
Description:

A user has been detected with the Load and Unload Device Drivers privilege. This right is normally only granted to Administrators.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Load and unload device drivers.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge-Pak Network Suite 10142282, Built-in Group Rights, http://support.microsoft.com/support/ntserver/serviceware/10142282.asp

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Windows NT local user on workstation

Risk Level: Low risk vulnerability Low

Check or Attack Name: Local User
Platforms: Windows NT
Description:

A local user account has been found on a non-domain controller. Some sites require that all user accounts on workstations and standalone servers be managed through the domain.
Remedy:

Remove the local user.

To remove the local user, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the local user from the list.
  3. Press Delete and confirm the removal.
References:


Inappropriate user with Lock Pages in Memory privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Lock Memory Privilege
Platforms: Windows NT
Description:

A user has been detected with Lock Pages in Memory privileges. The 'Lock pages in memory' user right allows a user to lock pages in memory so they cannot be paged out to a backing store such as PAGEFILE.SYS. If users have the capability to lock pages in memory, there is a risk that system performance may be adversely affected. This privilege is normally granted to subsystems, not to groups or to users.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Lock pages in memory.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q126767, Improve System Performance by Using Proper Working Set Size, http://support.microsoft.com/support/kb/articles/q126/7/67.asp

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Locked account from bad login attempts

Risk Level: Low risk vulnerability Low

Check or Attack Name: Locked Account
Platforms: Windows NT
Description:

The user is locked out due to too many bad login attempts. This situation could signal a brute force password guessing attempt.
Remedy:

Reinstate the user and implement Logon and Logoff Failure auditing. To reinstate the user, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Clear the Account Locked Out check box.

—AND—

To implement Logon and Logoff Auditing, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Audit to display the Audit Policy dialog box.
  4. Select Audit these events. The audit choices are enabled.
  5. From the Logon and Logoff field, select the Failure check box.
  6. Click OK.
References:


Inappropriate user with Manage Auditing and Security Log privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Manage Security Log Privilege
Platforms: Windows NT
Description:

A user has been detected with the Manage Auditing and Security Log privilege. This right is normally only granted to Administrators.
Remedy:

Verify user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display User Rights Policy dialog box.
  3. From the Right list, select Manage auditing and security log.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q181735, Adding a Link Service to a Remote SNA Server, http://support.microsoft.com/support/kb/articles/q181/7/35.asp


Windows NT network Guest logon

Risk Level: Low risk vulnerability Low

Check or Attack Name: Network Guest Logon
Platforms: Windows NT
Description:

The Guest account is allowed to log on from the network. This configuration may allow an attacker unauthorized remote access to a machine. Access can be improperly elevated if guest accounts are assigned to the wrong group, or if guests are granted stronger than normal user rights.
Remedy:

Since Windows NT 4.0 comes with the Guest account disabled by default, many administrators may find it sufficient to leave the account disabled.

—OR—

To explicitly grant network logon rights, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policy menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Access this computer from network.
  4. If present, remove Everyone and Guest from the Grant To list
    5. .
  5. Add any users or groups who should be allowed to log in from the network.
  6. Click OK.
References:


Windows NT user has never logged on

Risk Level: Low risk vulnerability Low

Check or Attack Name: No Logon
Platforms: Windows NT
Description:

A user has been detected who has never logged on. If the user was not created recently, consider deleting or disabling the account. Accounts that have never logged on are frequently created with standard passwords, and may create unauthorized access opportunities for an attacker.
Remedy:

Delete or disable the user.

Remove the account if it is not needed. To remove an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account to be removed.
  3. Press Delete and confirm the delete action.

—OR—

Disable the user account if it may be needed at a later time.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.
References:


No user profile required

Risk Level: Low risk vulnerability Low

Check or Attack Name: No User Profile
Platforms: Windows NT
Description:

No user profile is required for the user. The System Policy Editor creates user profiles that can be used to restrict user access. Profiles are an effective tool to improve your user security.
Remedy:

Create a profile and assign it to the user account. To create a profile in the System Policy Editor:

  1. Open the System Policy Editor.
  2. From the File menu, select New Policy to display the Default User and Default User icons.
  3. Set the options of the new policy:
    • Double-click the Default Computer icon and select the computer policy options.
    • Double-click the Default User icon and select the user policy options.
    • (Optional) Add additional users, computers, or groups to the new policy.
  4. Click OK.
  5. Save the file as NTCONFIG.POL in the netlogon share of the PDC/BDC.

—AND—

To assign a profile to a user:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Profile to display the User Environment Profile dialog box.
  5. Add the User Profile Path for this user.
  6. Click OK.

For more information on the System Policy Editor, see Microsoft Knowledge Base Article "What is your Setting the User Policy issue?" at http://support.microsoft.com/support/ntserver/serviceware/10141629.ASP.
References:


Inappropriate user with Profile System Performance privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Profile System Privilege
Platforms: Windows NT
Description:

A user has been detected with Profile System Performance privileges. This right is normally only granted to Administrators.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Act as part of the operating system.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Force Shutdown from a Remote System privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Remote Shutdown Privilege
Platforms: Windows NT
Description:

A user has been detected with Force Shutdown from a Remote System privileges. This right is normally granted to only Administrators and Server Operators.
Remedy:

Verify user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Force shutdown from a remote system.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge-Pak Network Suite 10142417, Built-in Group Rights, http://support.microsoft.com/support/ntserver/serviceware/10142417.asp


Inappropriate user with Replace a Process Level Token privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Replace Process Token Privilege
Platforms: Windows NT
Description:

A user has been detected with Replace a Process Level Token privileges. This right is not normally granted to any users, and can be used to attain administrative rights.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select Show Advanced User Rights check box.
  4. From the Right list, select Replace a process level token.
  5. Verify that this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp

Microsoft Knowledge Base Article Q186374, Enable Auditing of Microsoft Windows NT Server Password Registry, http://support.microsoft.com/support/kb/articles/q186/3/74.asp

Microsoft Knowledge Base Article Q131144, HOWTO: Assign Privileges to Accounts for API Calls, http://support.microsoft.com/support/kb/articles/q131/1/44.asp


Inappropriate user with Restore Files and Directories privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Restore Privilege
Platforms: Windows NT
Description:

A user has been detected with Restore Files and Directories privileges. This right is normally only granted to Administrators and Backup operators, and can be used to replace any file or registry key regardless of permissions. If the user also has Backup Files and Directories privileges, the ownership of files and other objects can be changed.
Remedy:

Verify user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Restore files and directories.
  4. Verify that this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q104204, Troubleshooting Directory Replicator Problems, http://support.microsoft.com/support/kb/articles/q104/2/04.asp

Microsoft Knowledge Base Article Q183054, Taking Ownership Remotely May Set Owner Incorrectly, http://support.microsoft.com/support/kb/articles/q183/0/54.asp

Microsoft Knowledge Base Article Q186374, Enable Auditing of Microsoft Windows NT Server Password Registry, http://support.microsoft.com/support/kb/articles/q186/3/74.asp


Inappropriate user with Generate Security Audits privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Generate Security Audit Privilege
Platforms: Windows NT
Description:

A user has been detected with the Generate Security Audits privilege. This right is not normally granted to any users.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Generate security audits.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Profile Single Process privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Profile Single Process Privilege
Platforms: Windows NT
Description:

A user has been detected with Profile Single Process privileges. This right is normally granted to only Administrators and Power Users.

Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Profile single process.
  5. Verify that this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Modify Firmware Environment Values privilege

Risk Level: High risk vulnerability High

Check or Attack Name: System Environment Privilege
Platforms: Windows NT
Description:

A user has been detected with Modify Firmware Environment Values privileges. This right is normally only granted to Administrators, and can be used to obtain higher access levels.
Remedy:

Verify Advanced user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights dialog box.
  3. Select the Show Advanced User Rights check box.
  4. From the Right list, select Modify firmware environment values.
  5. Verify this right is set in accordance with your security policy.
  6. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q101366, Definition and List of Windows NT Advanced User Rights, http://support.microsoft.com/support/kb/articles/q101/3/66.asp


Inappropriate user with Change the System Time privilege

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Change System Time Privilege
Platforms: Windows NT
Description:

A user has been detected with Change the System Time privileges. This right is normally only granted to Administrators and Power Users.
Remedy:

Verify user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Change the system time.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:


Inappropriate user with Take Ownership of Files or Other Objects privilege

Risk Level: High risk vulnerability High

Check or Attack Name: Take Ownership Privilege
Platforms: Windows NT
Description:

A user has been detected with Take Ownership of Files or Other Objects privileges. This right is normally only granted to Administrators.
Remedy:

Verify user rights in User Manager.

To audit and revoke this privilege, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. From the Right list, select Take ownership of files or other objects.
  4. Verify this right is set in accordance with your security policy.
  5. To remove a user, select the user and click Remove.
References:

Microsoft Knowledge Base Article Q170834, Take Ownership Remotely Does Not Log Security Event, http://support.microsoft.com/support/kb/articles/q170/8/34.asp

Microsoft Knowledge Base Article Q186374, Enable Auditing of Microsoft Windows NT Server Password Registry, http://support.microsoft.com/support/kb/articles/q186/3/74.asp


Windows NT workstations not restricted

Risk Level: Low risk vulnerability Low

Check or Attack Name: Workstation not restricted
Platforms: Windows NT
Description:

A user has been found who does not have workstation restrictions. Workstation restrictions can help limit both internal and external attacks.
Remedy:

Implement workstation restrictions on the user account.

To implement restrictions, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select Logon To.
  5. Select User May Log On to These Workstations, and enter the NetBIOS names of the allowed workstations.
  6. Restart the machine for these changes to take place.
References:


Routed append vulnerability allows remote file manipulation

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: RipAppend
Platforms: Unix, IRIX: 3.x, IRIX: 4.x, IRIX: 5.x, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0
Description:

Many routed daemons that have been ported from the original 4.x BSD routed code have the ability for a packet to turn on debug mode, and to specify a debugging log file. Attackers can append data to system files without any checks on the permissions of the file.
Remedy:

Contact your vendor for fix information. IRIX users of affected but unsupported versions should upgrade to the latest release available for your hardware and then install the patch (if necessary). Other IRIX users should obtain and apply the following patches:

  • IRIX 5.3: 2770
  • IRIX 6.2: 1638
  • IRIX 6.3: 2413
  • IRIX 6.4: 2413
References:

Fyodor's Exploit World, routed trace file exploit, http://www.insecure.org/sploits/routed.tracefile.html

Rootshell Web Site, BSD 4.4 based routed trace file exploit, http://www.rootshell.com/archive-j457nxiqi3gq59dv/199801/riptrace.c.html

Silicon Graphics Inc. Security Advisory 19981004-01-PX, IRIX routed(1M) Vulnerability, ftp://sgigate.sgi.com/security/19981004-01-PX

CIAC Information Bulletin J-012, J-012: SGI IRIX routed(1M) Vulnerability, http://ciac.llnl.gov/ciac/bulletins/j-012.shtml


3270 mapper service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: 3270 mapper
Platforms: | Unix
Description: | The RPC 3270_mapper service has been detected. Clients wishing to communicate with some mainframes are required to use a 3270 terminal emulation program, which under many implementations requires this service to be running. The 3270_mapper registers with the RPC portmapper as program 100013.
Remedy: | This service should be disabled if either 3270 is not used or your implementation does not require its use.
References: |


Admind or Sadmind running

Risk Level: Low risk vulnerability Low

Check or Attack Name: admind
Platforms: SunOS: 4.1.3
Description:

Admind or sadmind was detected on the machine. By default, admind runs in an insecure SYS mode. If admind is insecure, an attacker can obtain access to it and change the password file.

If this vulnerability was flagged and admind or sadmind are not running, then you will need to run rpcinfo on the vulnerable system. According to RFC 1700, the correct RPC numbers for admind and sadmind are:

  • admind = 100087
  • sadmind = 100232

Solaris is the only Unix platform that uses admind or sadmind. Another OS could show up vulnerable if the above RPC numbers are being used by another service. If this is the case, you will need to change the RPC numbers to reflect the standards as defined in RFC 1700.
Remedy:

Fortify the security level for admind and upgrade to Solaris 2.3 or later. If you cannot upgrade and want to use the patch instead, contact your Sun support representative.

To increase security, follow these steps:

  1. Edit the /etc/inetd.conf file.
  2. Locate the line that controls admind.
  3. Append -S 2 switch to the admind line. This switch instructs the admind server to require stronger DES authentication.
  4. Restart inetd.

—AND—

Solaris Patch ID 101384 addresses this vulnerability, but is no longer publicly available from SunSolve. The patch has been incorporated in Solaris 2.3. Inclusion of this patch is documented in "SunSolve Online Public Patch Access" at ftp://sunsolve1.sun.com/pub/patches/Solaris2.3.PatchReport.
References:

Sun Microsystems SunSolve FTP Site, Solaris 2.3 Patch Report Update as of 01 Dec 98, ftp://sunsolve1.sun.com/pub/patches/Solaris2.3.PatchReport


RPC alis service

Risk Level: Low risk vulnerability Low

Check or Attack Name: alis
Platforms: Unix
Description:

The RPC alis service was detected as running.
Remedy:

Disable alis if it is not required.

To disable alis when started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Bootparam enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: bootparam
Platforms: Unix
Description:

Bootparam was detected as running. If a machine is running bootparam, then it is probably a server to diskless clients. An attacker can obtain the domain name from bootparam if they can guess which machines are the client and servers. Since many NIS implementations provide no access control, an attacker can use the domain name to make NIS provide the password file.
Remedy:

Disable bootparamd if it is not required as a server for diskless clients, or patch NIS.

Several vendors have added access control to their NIS implementation. Check your system documentation or the vendor’s patch list. The control file is sometimes called securenets.

As a workaround, consider the following suggestions:

  • Run a portmapper with access control.
  • Block port 111 (portmap) on your network gateway, making attacks on NIS and NFS mount daemons much harder.
  • Enforce a policy for choosing passwords by installing an alternative passwd command, for example anlpasswd. Information is available from ftp://ftp.auscert.org.au/pub/mirrors/info.mcs.anl.gov/README.INSTALL.ANLPASSWD, and the anlpasswd program is available from ftp://ftp.auscert.org.au/pub/mirrors/info.mcs.anl.gov/anlpasswd.tar.Z.
            •
    References:

    CERT Advisory CA-92.13, SunOS NIS Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-92:13.SunOS.NIS.vulnerability

    CERT Advisory CA-93.01, Revised Hewlett-Packard NIS ypbind Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-93:01.REVISED.HP.NIS.ypbind.vulnerability

    AUSCERT Advisory AA-95.03, An overview of SATAN, http://ftp.sunet.se/pub/security/csir/auscert/auscert-advisory/AA-95.03.An.overview.of.SATAN

    CERT Advisory CA-93.01, Revised Hewlett-Packard NIS ypbind Vulnerability, http://www.cert.org/advisories/CA-93.01.REVISED.HP.NIS.ypbind.vulnerability.html

    CERT Advisory CA-92.13, SunOS NIS Vulnerability, http://www.cert.org/advisories/CA-92.13.SunOS.NIS.vulnerability.html


Bootparam supplies domain name

Risk Level: Low risk vulnerability Low

Check or Attack Name: bootpdom
Platforms: Unix
Description:

Bootparam supplied the domain name for NIS. With the domain name, an attacker can get NIS to provide the password file.
Remedy:

Disable bootparamd, if it is not required as a server for diskless clients, or patch NIS.

Several vendors have added access control to their NIS implementation. Check your system documentation or the vendor’s patch list. The control file is sometimes called securenets.

As a workaround, consider the following suggestions:

  • Run a portmapper with access control.
    • Block port 111 (portmap) on your network gateway, making attacks on NIS and NFS mount daemons much harder.
  • Enforce a policy for choosing passwords by installing an alternative passwd command, for example anlpasswd. Information is available from ftp://ftp.auscert.org.au/pub/mirrors/info.mcs.anl.gov/README.INSTALL.ANLPASSWD, and the anlpasswd program is available from ftp://ftp.auscert.org.au/pub/mirrors/info.mcs.anl.gov/anlpasswd.tar.Z.
    • References:

    CERT Advisory CA-92.13, SunOS NIS Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-92:13.SunOS.NIS.vulnerability

    CERT Advisory CA-93.01, Revised Hewlett-Packard NIS ypbind Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-93:01.REVISED.HP.NIS.ypbind.vulnerability

    AUSCERT Advisory AA-95.03, An overview of SATAN, http://ftp.sunet.se/pub/security/csir/auscert/auscert-advisory/AA-95.03.An.overview.of.SATAN

    , ,

    , ,


RPC database service

Risk Level: Low risk vulnerability Low

Check or Attack Name: database service
Platforms: Unix
Description:

The RPC Database (database_svc) service was detected running.
Remedy:

Disable database_svc if it is not required.

To disable database_svc when started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


RPC keyserv service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: keyserv
Platforms: | Unix
Description: | The RPC keyserv service was detected as running. The keyserv service stores the private encryption keys of all logged in users for use with network services with integrated security, like secure NFS and NIS+. The keyserv service registers with the RPC portmapper as program 100029.
Remedy: | This service should be disabled if your network is not implementing any protocol that requires or uses this type of integrated security.
References: |


Ugidd daemon can reveal usernames on Linux machines

Risk Level: | Low risk vulnerability Low | Check or Attack Name: Ugidd Check
Platforms: | Linux
Description: | The rpc.ugidd daemon is used on older Linux installations to translate between user names and user IDs. This daemon allows a remote attacker to enumerate all the users on a given machine.
Remedy: | Remove or disable the rpc.ugidd daemon, if it is not necessary in your configuration.
References: | Linux-Security Mailing List, NFS uid/gid map daemon, http://www.sonic.net/hypermail/security/mbox/0196.html


RPC llockmgr service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: llockmgr
Platforms: | Unix, NFS
Description: | The RPC llockmgr service has been detected as running. The llockmgr is part of the file locking manager system for NFS. It generates local file locking operations in response to requests from client lock managers. The llockmgr service registers with the RPC portmapper as program 100020.
Remedy: | This service should be disabled if your system is not acting as either an NFS client or server.
References: |


RPC nlockmgr service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: nlockmgr
Platforms: | Unix, NFS
Description: | The RPC nlockmgr service has been detected as running. The nlockmgr is part of the file locking manager system for NFS. It forwards local file locking requests to the lock manager on the server system. The nlockmgr service registers with the RPC portmapper as program 100021.
Remedy: | This service should be disabled if your system is not acting as either an NFS client or server.
References: |


nsed service

Risk Level: Low risk vulnerability Low

Check or Attack Name: nsed
Platforms: Unix
Description:

The nsed service has been detected as running.
Remedy:

Disable the nsed service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


nsemntd service

Risk Level: Low risk vulnerability Low

Check or Attack Name: nsemntd
Platforms: Unix
Description:

The nsemntd service has been detected as running.
Remedy:

Disable the nsemntd service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Portmap UNSET procedure requested with spoofed address

Risk Level: | High risk vulnerability High | Check or Attack Name: pmapsunset
Platforms: | RPC Portmapper
Description: | The RPC Portmapper implements the UNSET procedure that allows RPC programs to unregister themselves with the portmapper. This destroys the mapping between the programs RPC number and port number inside the portmapper and is usually called as the service shuts down. Many implementations accept spoofed UNSETs that appear to originate from the local machine. In many cases, the UNSET is executed with superuser privileges.
Remedy: | The Remote Procedure Call (RPC) is an inherently unsafe protocol and should be blocked at all border gateways and firewalls to prevent attackers from abroad exploiting these weaknesses. Also, packets entering a network that appear to come from hosts inside that network or invalid addresses like 127.0.0.1 should be blocked to prevent spoofing attacks.
References: | PGCI Inc., rpcbind: deceive, inveigle and obfuscate, http://www.pgci.ca/rpc.html BUGTRAQ Mailing List, rpcbind: deceive, enveigle and obfuscate, http://www.netspace.org/cgi-bin/wa?A2=ind9901E&L=bugtraq&P=R125


Portmap UNSET procedure requested

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: PmapUnset
Platforms: | RPC Portmapper
Description: | The RPC Portmapper implements the UNSET procedure that allows RPC programs to unregister themselves with the portmapper. This destroys the mapping between the programs RPC number and port number inside the portmapper and is usually called as the service shuts down.
Remedy: | The Remote Procedure Call (RPC) is an inherently unsafe protocol and should be blocked at all border gateways and firewalls to prevent attackers from abroad exploiting these weaknesses.
References: |


Rexd running

Risk Level: High risk vulnerability High

Check or Attack Name: rexd
Platforms: Unix, Solaris: 2.5.1
Description:

Some versions of the rexd daemon allow remote attackers to gain unprivileged remote access.
Remedy:

Disable the rexd daemon by commenting it out from the inetd.conf file and restarting the inetd process. If rexd services are required for your configuration, apply the patches provided by your vendor.

Hewlett-Packard (HP-UX) all versions: Add the -r option to the rpc.rexd entry in the /etc/inetd.conf file.
rpc stream tcp nowait root /usr/etc/rpc.rexd 100017 1 rpc.rexd -r
This option specifies that only hosts listed in /etc/hosts.equiv are permitted to use rexd.

IBM AIX 3.1 and 3.2: Install APAR IX21353
AIX 3.2.5 or AIX 4.1: rexd is disabled by default when shipped, and should remain disabled.
IBM patches are located at http://service.software.ibm.com/support/rs6000. Type the APAR number to obtain information or the patch.

NeXT NeXTstep 2.0 and 2.1: Disable rexd.

SGI IRIX 4.x, 5.x, 6.x: Disable rexd. rexd is inappropriate on systems directly exposed to the Internet.
References:

CERT Advisory CA-91.06, NeXT rexd, /private/etc, Username me Vulnerabilities, http://www.cert.org/advisories/CA-91.06.NeXTstep.vulnerability.html

CERT Advisory CA-92.05, AIX REXD Daemon Vulnerability, http://www.cert.org/advisories/CA-92.05.AIX.REXD.Daemon.vulnerability.html

CIAC Information Bulletin C-21, AIX REXD Daemon Vulnerability, http://ciac.llnl.gov/ciac/bulletins/c-21.shtml


rje mapper service

Risk Level: | Low risk vulnerability Low | Check or Attack Name: rje mapper
Platforms: | Unix
Description: | The RPC rje_mapper service was detected as running. The rje_mapper is part of many Remote Job Entry (RJE) implementations. RJE is a system for batch-oriented transfers between a host and downstream devices, such as printers. The rje_mapper service registers with the RPC portmapper as program 100014.
Remedy: | This service should be disabled if RJE is not implemented on your network.
References: | Request for Comment document RFC 407, REMOTE JOB ENTRY PROTOCOL, http://andrew2.andrew.cmu.edu/rfc/rfc407.html


RPC bind service on improper port

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: rpc32771
Platforms: Solaris: 2.3, Solaris: 2.4, Solaris: 2.5, Solaris: 2.5.1, Solaris: 2.5 x86, Solaris: 2.5.1 x86, Solaris: 2.4 x86
Description:

Normally, the rpcbind service only listens on port 111. Under Solaris, the rpcbind service will also listen under port 32771, sometimes allowing attackers to bypass packet filtering.
Remedy:

Solaris users should obtain and install the following patches:

  • Solaris 2.5.1: 104331-02
  • Solaris 2.5.1_x86: 104332-02
  • Solaris 2.5: 104357-02
  • Solaris 2.5_x86: 104358-02
  • Solaris 2.4: 102070-03
  • Solaris 2.4_x86: 102071-03
  • Solaris 2.3: 102034-02
References:

Network Associates, Inc. Security Advisory #15, Solaris rpcbind weaknesses, http://www.nai.com/nai_labs/asp_set/advisory/15_solaris_rpcbind_adv.asp

Sun Microsystems, Inc. Security Bulletin #00142, Vulnerability in rpcbind, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/142&type=0&nav=sec.sba


RPC pcnfsd service allows remote command execution as root

Risk Level: High risk vulnerability High

Check or Attack Name: rpcpcnfsd
Platforms: pcnfs
Description:

The RPC pcnfsd vulnerability was found, allowing an attacker to execute commands on the vulnerable system.

Warning: Older versions of pcnfsd can hang if this check is performed. Do not perform this check on systems that run an old version of pcnfsd, or upgrade the daemon to a recent version.
Remedy:

Obtain newer version of pcnfsd from your vendor, or obtain and install a public domain pcnfsd that has been certified as not vulnerable. Also, set the mode of the top-level pcnfsd spool directory to 755 by typing: chmod 755 /usr/spool/pcnfs

A public domain pcnfsd is available from ftp://ftp.cert.org/pub/tools/pcnfsd/pcnfsd.93.02.16-cert-dist.tar.Z or from ftp://ftp.cert.dfn.de/pub/tools/net/pcnfsd/pcnfsd.93.02.16-cert-dist.tar.Z.
References:

CERT Advisory CA-96.08, Vulnerabilities in PCNFSD, http://www.cert.org/ftp/cert_advisories/CA-96.08.pcnfsd


RPC SNMP service detected running

Risk Level: Low risk vulnerability Low

Check or Attack Name: rpc_snmp
Platforms: SNMP
Description:

The SNMP service was detected as running. An attacker can use SNMP (Simple Network Management Protocol) to gain valuable information about the system (such as information on network devices and current open connections) when SNMP uses default words, such as public or private, for the community word. If no community is specified, then the SNMP server responds to queries from any system.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Disable SNMP if it is not needed. If the RPC daemon is started from inetd.conf, comment its entry by putting a # at the beginning of the line. If it is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop

# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:


RPC statd remote file creation and removal

Risk Level: High risk vulnerability High

Check or Attack Name: rpcstatd
Platforms: AIX, IRIX, DG/UX, HPUX: 9.x, NEC EWS-UX/V, NEC UP-UX/V, NEC UX/4800, NeXT STEP, HPUX: 10.x, NCR MP-RAS
Description:

A remote rpc.lockd can provide false information to the rpc.statd file, allowing a file to be removed or created. Rpc statd maintains state information in cooperation with RPC lockd, to provide crash and recovery functionality for file locking across NFS. Because statd does not validate the information it receives from the remote lockd, an attacker can send a remote procedure call, resulting in the creation or removal of any file on the system.

Remedy:

Obtain and install the appropriate patch for your operating system, or follow the vendor's instructions. Select from the following operating systems:

Hewlett-Packard: Before installing the patch, read Security Advisory HPSBUX9607-032 "Security Vulnerability in rpc.pcnfsd & rpc.statd." This document is available after logging in by clicking the Search Technical Knowledge Base link and typing any of the patch IDs as the search string. The HP Patch Database requires a no-cost password and is located at http://us-support.external.hp.com/wpsl/bin/doc.pl/. After logging in, go to Individual Patches (Patch Database) and search for HP-UX Patches that match your vulnerable version and its corresponding patch(es).

Series 300/400 HP-UX 9.X: PHNE_7371 and PHNE_7372; Series 700/800 HP-UX 9.X: PHNE_7072; Series 700/800 HP-UX 10.X: PHNE_7073; Series 700 HP-UX 9.08 BLS: PHNE_8015; Series 700 HP-UX 9.09 BLS: PHNE_8016; Series 700 HP-UX 9.09+ BLS: PHNE_8017; Series 700 HP-UX 10.09 CMW: PHNE_8018; Series 700 HP-UX 10.09.01 CMW: PHNE_8019; Series 700 HP-UX 10.16 CMW: PHNE_8020.

IBM: AIX 3.2: APAR IX56056; AIX 4.1: APAR IX55931. IBM patches are located at http://aix.boulder.ibm.com/aix.us/aixfixes. Type the APAR number to obtain information or the patch.

Sony: NEWS-OS Patch IDs: 0124, 6063, 6176, and 6207. NEWS-OS Patches are available from ftp://ftp1.sony.co.jp/pub/patch/news-os/un-official. Note: This site may be slow in responding.

DEC (Digital Equipment Corporation): Ultrix ECO ID#: SSRT03901; OSF/1 ECO ID#: SSRT038301 at http://www.service.digital.com/html/patch_service.htm.

Sun Microsystems: SunOS 4.1.3: 100988-05; SunOS 4.1.3_U1: 101592-09; SunOS 4.1.4: 102516-06; SunOS 5.3: 102932-03; SunOS 5.4: 102769-04; SunOS 5.4x86: 102770-04; SunOS 5.5: 103468-03; SunOS 5.5x86: 103469-03. SunOS 5.6 and 5.6_x86 are not vulnerable to this problem. SunOS Patches are available at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.

Silicon Graphics: Prior to IRIX 5.3: Upgrade to IRIX 5.3 or later, or use temporary fix described in the SGI Security Advisory; IRIX 5.3: Patch 1391; IRIX 6.x: Not vulnerable. Before installing the patch, read SGI Security Advisory 19971201-01-P: "Buffer Overrun Vulnerability in statd(1M) Program" at ftp://sgigate.sgi.com/security/19971201-01-P1391. SGI Patches are available at http://www.sgi.com/Support/security/security.html. Previous versions must upgrade or use temporary fix described in the security advisory. The specific patch to fix this issue on IRIX 5.3 platforms is available from ftp://sgigate.sgi.com/patches/5.3/patch1391.tar.
References:

CERT Advisory CA-96.09, Vulnerability in rpc.statd, http://www.cert.org/ftp/cert_advisories/CA-96.09.rpc.statd

AUSCERT Advisory AA-97.29, statd Buffer Overrun Vulnerability, ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-97.29.statd.overflow.vul

Silicon Graphics Inc. Security Advisory 19971201-01-P1391, Buffer Overrun Vulnerability in statd(1M) Program, ftp://sgigate.sgi.com/security/19971201-01-P1391

Hewlett-Packard Security Bulletin HPSBUX9607-032, Security Vulnerability in rpc.pcnfsd & rpc.statd, http://us-support.external.hp.com/

Sun Microsystems, Inc. Security Bulletin #00135, Vulnerability with the statd program, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=secbull/135


RPC ypupdated daemon allows remote commands execution as root

Risk Level: High risk vulnerability High

Check or Attack Name: rpcupdate
Platforms: AIX: 3.2, AIX: 4.1, IRIX: 3.x, IRIX: 4.x, IRIX: 5.x, IRIX: 6.0.1, NEC EWS-UX/V, NEC UP-UX/V, NEC UX/4800, SunOS: 4.1.x, HPUX: 10.01, HPUX: 10.10, IRIX: 6.0, HPUX: 10.20
Description:

The NIS update daemon rpc.ypupdated contains a vulnerability in how it passes commands to certain function calls, which allows a remote attacker to trick the service into executing arbitrary commands on the system with root privileges. Exploit information for this hole has been made widely available.
Remedy:

Obtain and install a patch from your vendor as soon as possible.
References:

CERT Advisory CA-95.17, rpc.ypupdated Vulnerability, http://www.cert.org/advisories/CA-95.17.rpc.ypupdated.vul.html

Silicon Graphics Inc. Security Advisory 19951201-01-P, Avalon Security Research - rpc.ypupdate slammer exploit, ftp://sgigate.sgi.com/security/19951201-01-P


rquotad service

Risk Level: Low risk vulnerability Low

Check or Attack Name: rquotad
Platforms: Unix
Description:

The rquotad service was detected as running. rquotad is an RPC server that returns quotas for a user of a local file system mounted by a remote machine over the NFS. The rquotad daemon is normally invoked by inetd.
Remedy:

Disable the rquotad service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Rusers output

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ruserout
Platforms: | Unix
Description: | The rusers command will query every machine on a network with the rusers daemon running and return all the users logged in to those machines.
Remedy: | This service should be disabled if it is not needed, since it poses a significant information gathering threat.
References: |


Rusers running

Risk Level: | Low risk vulnerability Low | Check or Attack Name: rusersd
Platforms: | Unix
Description: | Rusers was found running. Rusers gives an attacker information, such as login accounts and how busy the machine is. Account information is used in a brute force default attack.
Remedy: | Disable the rusers service. Comment out rusers from the /etc/inetd.conf file by putting a # at the beginning of the line and sending a HUP signal to the inetd (# kill -HUP <inetd.pid>).
References: |


RPC sched service

Risk Level: Low risk vulnerability Low

Check or Attack Name: sched
Platforms: Unix
Description:

The sched service was detected as running.
Remedy:

Disable sched if it is not required.

To disable a Unix daemon started from inetd, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.

If the RPC daemon is started from the rc script, comment it out as appropriate for your operating system.
References:


Remote file access through selection service

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: selsvcvuln
Platforms: SunOS: 4.1.2 and below
Description:

The Selection service (selection_svc or selnsvc) was found to be vulnerable. This service allows readable files to be grabbed remotely.
Remedy:

Disable the service by placing a # at the beginning of the appropriate line in the file /etc/inetd.conf, and then send the SIGHUP signal to the inetd process, or obtain a patch from the vendor.

References:

CERT Advisory CA-90.05, SunView selection_svc vulnerability, http://www.cert.org/ftp/cert_advisories/CA-90:05.sunselection.vulnerability

SunOS Patch ID # 100085-XX, , http://www.cert.org/ftp/cert_advisories/CA-90:05.sunselection.vulnerability


showfhd service

Risk Level: Low risk vulnerability Low

Check or Attack Name: showfhd
Platforms: Unix
Description:

The showfhd service was detected as running. Showfhd is a daemon that provides the full path name for the given file handle. If the daemon cannot find the file or the inode number, it returns an error message.
Remedy:

Disable the showfhd service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Sprayd service

Risk Level: Low risk vulnerability Low

Check or Attack Name: sprayd
Platforms: Unix
Description:

The sprayd service was detected as running. rpc.sprayd is a server that records the packets sent by spray, and sends a response to the originator of the packets. The rpc.sprayd daemon is normally invoked by inetd.

sprayd sends a one-way stream of packets to a host using RPC, and reports how many were received, as well as the transfer rate. The host argument can be either a name or an Internet address.

Remedy:

Disable the sprayd service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


RPC statmon service

Risk Level: Low risk vulnerability Low

Check or Attack Name: statmon
Platforms: Unix
Description:

The statmon service was detected as running. Statmon (or status monitor) uses statd and lockd to provide the crash and recovery functions for the locking services on NFS.
Remedy:

Disable the statmon service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Sunlink mapper service

Risk Level: Low risk vulnerability Low

Check or Attack Name: Sunlink Mapper
Platforms: Unix
Description:

The sunlink mapper service was detected as running. The sunlink_mapper service is a part of the SunLink X.400 implementation for connecting normal SMTP-MIME mail systems to X.400 networks. The sunlink_mapper process registers itself with the RPC portmapper as program 100033. This service should be disabled if you do not use the SunLink X.400 implementation on your network.
Remedy:

Disable the sunlink mapper service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Tfsd service

Risk Level: Low risk vulnerability Low

Check or Attack Name: tfsd
Platforms: Unix
Description:

The tfsd service was detected as running. tfsd is the daemon for the Translucent File Service (TFS). The translucent file service (TFS) supplies a copy-on-write file system, allowing users to share file hierarchies while providing each user with a private hierarchy into which files are copied as they are modified. Consequently, users are isolated from each other’s changes.

Remedy:

Disable the tfsd service if it is not needed.

To disable the service, follow these steps:

  1. Edit the /etc/inetd.conf (or equivalent) file.
  2. Locate the line that controls the daemon.
  3. Type a # at the beginning of the line to comment out the daemon.
  4. Restart inetd.
References:


Rpc.walld wall daemon running

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: walld
Platforms: | Unix
Description: | The "write all" daemon rpc.rwalld was detected as running. This daemon allows users to broadcast messages to all users connected to a network. The rwall daemon lacks significant authentication and can be used in denial of service attacks and social engineering attacks.
Remedy: | Disable the wall daemon by commenting it out of inetd.conf or removing it from any RC scripts. Alternatively, users can install a walld package that includes improved authentication.
References: | CIAC Advisory Notice, Notice of Availability of Patch for rwalld/wall, http://ciac.llnl.gov/ciac/bulletins/ciac-06.shtml


X25 daemon running

Risk Level: Low risk vulnerability Low

Check or Attack Name: x25.inr
Platforms: Any
Description:

An X25 gateway service was detected as running. X25 allows an attacker to possibly gain access via an X.25 network rather than through TCP/IP.
Remedy:

Remove or disable the X25 daemon if it is not needed.

Unix: Disable X25 by putting # at the beginning of the snmp line in your etc/inetd.conf file (usually located in /etc) and then restarting inetd. Consult your vendor's documentation for more information.

Windows:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select the X25 service.
  3. Select one of these choices:
    • To stop the X25 service for this session only, click Stop.
    • To permanently stop the X25 service, click Startup and choose the Disabled option.
    • Click OK.
References:


Ascend Pipeline and MAX denial of service vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: Ascend-kill2 SNMP
Platforms: Ascend Routers: R 4.5Ci12 or earlie
Description:

A denial of service vulnerability exists in Ascend Pipeline and MAX networking equipment running Ascend operating systems 5.0A and 5.0Ap42, respectively. An attacker can send a malformed probe packet to the discard port of the router, which causes the router to lock up. A second issue allows an attacker to use SNMP and TFTP to capture the entire configuration file, including passwords and keys for the router.
Remedy:

While no immediate fix is available, it is possible to work around this problem by filtering out packets to the UDP discard port (port 9).

—AND—

Because SNMP write access on an Ascend router is equivalent to complete administrative access, you should choose a community name that is hard to guess.

—AND—

Check deployed Ascend equipment to make sure the equipment is not using default (or easily guessed) communities.
References:

CIAC Information Bulletin I-038, Ascend Routing Hardware Vulnerabilities, http://ciac.llnl.gov/ciac/bulletins/i-038.shtml

Network Associates, Inc. Security Advisory #26, Security Issues with Ascend Routing Hardware, http://www.nai.com/nai_labs/asp_set/advisory/26_ascendrouter_adv.asp


Cisco CHAP authentication failure allows unauthorized PPP connections

Risk Level: High risk vulnerability High

Check or Attack Name: Cisco CHAP/PPP Vulnerability
Platforms: Cisco
Description:

The system is vulnerable to a failure of CHAP authentication via PPP connections. Cisco IOS, as well as IOS/700 software, allows dial-up users to obtain a PPP connection without a password. An attacker possessing source code and information about the network (such as user names and IP addresses) can modify their own CHAP implementation to exploit this vulnerability.

Systems using PAP for PPP authentication are not vulnerable. Systems not configured for PPP are not vulnerable. If the keywords ppp and chap do not both appear in your system configuration file, you are not vulnerable.

Remedy:

IOS users should upgrade to 10.3(19a), 11.0(17), 11.1(14), 11.2(4)F1, 11.2(8), or the latest supported version for the device. As with any software upgrade, you should verify that your hardware can support the new software before upgrading.

Temporary Fix: Affected users who want to protect their systems must upgrade their software or stop using CHAP authentication. Alternatives to CHAP authentication include PAP authentication and reliance on "Caller ID" information.

Patches: Cisco customers with contracts should obtain upgraded software through their regular update channels (via Cisco's web site). Customers without contracts should contact Cisco TAC at tac@cisco.com.
References:

Cisco Systems Field Notice, Vulnerabilities in Cisco CHAP Authentication, http://www.cisco.com/warp/public/770/chapvuln-pub.shtml

CIAC Information Bulletin I-002a, I-002a: Cisco CHAP Authentication Vulnerability, http://www.ciac.org/ciac/bulletins/i-002a.shtml


Cisco IOS access control list vulnerable via 'established' keyword

Risk Level: High risk vulnerability High

Check or Attack Name: CiscoACL Established
Platforms: Cisco
Description:

The host may allow unauthorized packets to circumvent a filtering router. Devices using IOS v10.3 and below and the 'established' keyword in extended IP access control lists can result in unauthorized network traffic.

An attacker could take advantage of the network access to gain information or acquire further unauthorized access to machines.
Remedy:

IOS users should upgrade to 10.0(10), 10.2(6), 10.3(3), or the latest supported version for the device. As with any software upgrade, you should verify that your hardware can support the new software before upgrading.

Temporary Fix: Rewrite the access list parameters so the established keyword is not necessary. Do not remove the established keyword; instead, re-design your access lists to provide similar functionality without using the established mechanism.

Or, disable the interfaces applied the access list by using the shutdown interface subcommand.

Patches: Registered CCO users can obtain software at http://www.cisco.com/public/sw-center/ and select the version of software to download. Non-registered users can obtain patches at http://www.cisco.com/public/library/spc_req.shtml. When prompted for a code, please enter the special access code you are given by your Cisco Technical Assistance Center support representative for a list of available files to download. For codes and assistance contact Cisco's TAC at tac@cisco.com.
References:

Cisco Systems Software & Support, Software Center, http://www.cisco.com/public/sw-center/

Cisco Systems Software & Support, Special Access Code for Software, http://www.cisco.com/public/library/spc_req.shtml

CERT Advisory CA-92.20, Cisco Access List Vulnerability, http://www.cert.org/advisories/CA-92.20.Cisco.Access.List.vulnerability.html


Cisco IOS access control list vulnerable via 'tacacs' keyword

Risk Level: High risk vulnerability High

Check or Attack Name: CiscoACL
Platforms: Cisco
Description:

The host may allow unauthorized packets to circumvent a filtering router. Devices using IOS v10.3(3.4) through 10.3(4.2) and the 'tacacs-ds' or 'tacacs' keyword in extended IP access control lists can cause an extended IP access control list to be misparsed, resulting in unauthorized network traffic. An attacker could take advantage of the network access to gain information or acquire further unauthorized access to machines.
Remedy:

IOS v10.3 users should upgrade to 10.3(4.3), or the latest supported version for the device. As with any software upgrade, you should verify that your hardware can support the new software before upgrading.

Patches: Registered CCO users can obtain software at http://www.cisco.com/public/sw-center/ and select the version of software to download. Non-registered users can obtain patches at http://www.cisco.com/public/library/spc_req.shtml. When prompted for a code, please enter certjuly31 for a list of available files to download. For assistance, contact Cisco's TAC at tac@cisco.com.
References:

Cisco Systems Software & Support, Software Center, http://www.cisco.com/public/sw-center/ .cisco.com/public/sw-center/ .cisco.com/public/sw-center/

Cisco Systems Software & Support, Special Access Code for Software, http://www.cisco.com/public/library/spc_req.shtml

Cisco Systems Technical Tips, Cisco Security Advisory 7/31/95, http://www.cisco.com/warp/public/707/1.html


Cisco administrative account accessible

Risk Level: | High risk vulnerability High | Check or Attack Name: bruteciscoenable
Platforms: | Cisco
Description: | A Cisco device was detected with an accessible administrative account. Vulnerable accounts allow attacker easy access to remote systems and to the administrative commands of the device.
Remedy: | Disable the account or change the password. Refer to your Cisco (http://www.cisco.com/) documentation for instructions.
References: |


Cisco IOS AAA does not properly authenticate users

Risk Level: High risk vulnerability High

Check or Attack Name: CiscoIOS AAA Authenticate
Platforms: Cisco
Description:

A vulnerability in Cisco IOS AAA authentication processing may allow users unauthorized access. Any user or attacker can issue system commands that are otherwise unissuable, or make connections or send packets to destinations that are usually unreachable. The attacker, without any special skills or knowledge, can invoke this vulnerability and a legitimate user can gain network access even if this user is not deliberately conducting an attack. This vulnerability's effects depend how it's installed, but you should assume that it opens very broad access to your network.

The bug that creates this vulnerability may also result in access being denied to legitimate users, or in system crashes.
Remedy:

IOS v11.3(1.2) and 11.3(1.2)T users should upgrade to 11.3(1.3) and 11.3(1.3)T, or the latest supported version for the device. There is no configuration workaround for this vulnerability, short of completely disabling AAA authentication.
References:

Cisco Systems Field Notice, Cisco IOS 11.3(1.2) and 11.3(1.2)T AAA Failure, http://www.cisco.com/warp/public/770/aaapair-pub.shtml

Cisco Systems Documentation, AAA Overview, http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/secur_c/scprt1/scaaa.htm


Cisco IOS can be remotely crashed and rebooted by unauthenticated users

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: CiscoIOS
Platforms: Cisco
Description:

The system may crash and reload if an untrusted and unauthenticated user gains access to the login prompt of a router or other Cisco IOS device. An attacker who wants to exploit this denial of service attack does not need to log in to the device; establishing a terminal connection is sufficient.

This vulnerability is present in classic Cisco IOS version 9.1 up to the corrected versions listed in the Cisco Field Notice.
Remedy:

IOS v9.1 to v10.3 users should upgrade to the latest supported version for the device. An interim release of 11.0(20.3) is immediately available, and the first supported release containing the fix will be 11.0(21).

As with any software upgrade, you should verify that your hardware can support the new software before upgrading. The most common problem is inadequate RAM.

Temporary Fix: Prevent interactive access to the Cisco IOS device from the following access points:

  • IP-based: Use the 'ip access-class' line configuration to apply an access list to all virtual terminals.
  • Asynchronous: Apply the 'no exec' configuration command to lines used by untrusted users.
  • Virtual terminals: Use the 'transport input none' command for lines used by untrusted users.

Patches: Cisco customers with contracts should obtain upgraded software through their regular update channels (generally via Cisco's web site). Customers without contracts should contact Cisco TAC at tac@cisco.com, and should refer to the URL of the Cisco Field Notice as evidence of their entitlement.
References:

Cisco Systems Field Notice, Cisco IOS Remote Router Crash, http://www.cisco.com/warp/public/770/ioslogin-pub.shtml

CIAC Information Bulletin I-084, Cisco IOS Remote Router Crash, http://ciac.llnl.gov/ciac/bulletins/i-084.shtml


Cisco vulnerable to land attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: CiscoLand
Platforms: Cisco
Description:

The system is vulnerable to the land denial of service attack. Recovery may require physically visiting the affected hardware. The exploit initiates a TCP connection, giving the target host's address as both source and destination, and using the same port on the target host as both source and destination.
Remedy:

IOS v10.3 to v11.2 users should upgrade to 10.3(19a), 11.0(17), 11.0(17)BT, 11.1(15), 11.1(15)AA, 11.1(15)CA, 11.1(15)IA, 11.2(10), 11.2(9)P, 11.2(4)F1, or the latest supported version for the device. As with any software upgrade, you should verify that your hardware can support the new software before upgrading.

Temporary Fix: Appropriate firewalls and some configuration workarounds can block this attack. Other workarounds using input access lists are described in the Cisco Field Notice.

Patches: Cisco customers with contracts should obtain upgraded software through their regular update channels (generally via Cisco's web site). Customers without contracts should contact Cisco TAC at tac@cisco.com.
References:

Cisco Systems Interim Field Notice, TCP Loopback DoS Attack (land.c) and Cisco Devices, http://www.cisco.com/warp/public/770/land-pub.shtml


NetBIOS dictionary attack

Risk Level: High risk vulnerability High

Check or Attack Name: nbdict
Platforms: Windows for Workgroups: 3.11, Windows 95
Description:

A dictionary attack upon the resources accessible through NetBIOS was successful.

If a NetBIOS share is detected on a system that requires only a password for validation, an attempt is made to log in using passwords from a dictionary file.
Remedy:

Change your password to a password that is difficult to guess and is not part of a password dictionary.

To change your password, follow these steps:

  1. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.
References:


HTTP proxy detected

Risk Level: Low risk vulnerability Low

Check or Attack Name: httpproxy
Platforms: Any
Description:

A web (HTTP) proxy has been identified. Some older proxy servers may have vulnerabilities that let an attacker execute commands remotely. If the web proxy can be penetrated, it could lead to unauthorized access to the network.

Remedy:

Disable the service or review your proxy rules. See your firewall's documentation for more information.

Unix: Do not run your web server as a proxy. Refer to your web server's documentation, and disable the proxy, if possible.

Windows: From the Services control panel, disable the HTTP service:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.
References:


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 103 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
DNS
bindvrs BIND servers can be remotely queried for their version
Firewalls
SOCKS | SOCKS v3 daemon misconfigured
SocksV4 | SOCKS v4 daemon misconfigured
SocksV5 | SOCKS v5 daemon misconfigured
ftpproxy | FTP proxy penetrated
squidprox | Squid proxy was penetrated to reach protected hosts
wwwproxypen | HTTP proxy penetrated
Information Gathering
rstatd | NIS rstat service is running
rstatout | Rstat output
NIS
YpBindReserved | Ypbind is running over a non-reserved port
YpServReserved | Ypserv on unreserved Port
ypbind | NIS YPBind service
ypmap | NIS maps
yppasswdd | Yppasswdd service
ypserv | NIS Yellow Pages (YP) service is running
ypxfrd | Ypxfrd service
NT Password
guestblankpw | Guest user has blank password
guestnopw | Guest account has no password
guestuserpw | Guest username same as password
NT Policy Issues
Lockout Duration | Lockout duration insufficient
Lockout Window | Lockout window insufficient
Logon Hours Not Set | Logon hours not set
Primary Domain Controller | Primary domain controller identified
lockout | Lockout threshold incorrect
NT Users
Act as System Privilege | Inappropriate user with Act as Part of the Operating System privilege
Backup Privilege | Inappropriate user with Backup Files and Directories privilege
Change System Time Privilege | Inappropriate user with Change the System Time privilege
Create Pagefile Privilege | Inappropriate user with Create a Pagefile privilege
Create Permanent Object Privilege | Inappropriate user with Create Permanent Shared Objects privilege
Create Token Name Privilege | Inappropriate user with Create a Token Object privilege
Debug Privilege | Inappropriate user with Debug Programs privilege
Disabled Account | Disabled account
Domain Admin | Domain Administrators group includes non-default user
Domain Guest | Domain Guest group includes non-default user
Dormant Account | Dormant account
Forced Logoff | Forced logoff not enabled for account with expired time
Generate Security Audit Privilege | Inappropriate user with Generate Security Audits privilege
Guest Exists | Guest account name exists
Guest User | Guest account includes unallowed user
Guest in Group | Guest account in non-default group
Increase Priority Privilege | Inappropriate user with Increase Scheduling Priority privilege
Increase Quota Privilege | Inappropriate user with Increase Quotas privilege
Interactive Guest Logon | Windows NT Interactive_Guest_Logon
Load Driver Privilege | Inappropriate user with Load and Unload Device Drivers privilege
Local User | Windows NT local user on workstation
Lock Memory Privilege | Inappropriate user with Lock Pages in Memory privilege
Locked Account | Locked account from bad login attempts
Manage Security Log Privilege | Inappropriate user with Manage Auditing and Security Log privilege
Network Guest Logon | Windows NT network Guest logon
No Logon | Windows NT user has never logged on
No User Profile | No user profile required
Profile Single Process Privilege | Inappropriate user with Profile Single Process privilege
Profile System Privilege | Inappropriate user with Profile System Performance privilege
Remote Shutdown Privilege | Inappropriate user with Force Shutdown from a Remote System privilege
Replace Process Token Privilege | Inappropriate user with Replace a Process Level Token privilege
Restore Privilege | Inappropriate user with Restore Files and Directories privilege
System Environment Privilege | Inappropriate user with Modify Firmware Environment Values privilege
Take Ownership Privilege | Inappropriate user with Take Ownership of Files or Other Objects privilege
Workstation not restricted | Windows NT workstations not restricted
Protocol Spoofing
RipAppend Routed append vulnerability allows remote file manipulation
RPC
3270 mapper | 3270 mapper service
PmapUnset | Portmap UNSET procedure requested
Sunlink Mapper | Sunlink mapper service
Ugidd Check | Ugidd daemon can reveal usernames on Linux machines
admind | Admind or Sadmind running
alis | RPC alis service
bootparam | Bootparam enabled
bootpdom | Bootparam supplies domain name
database service | RPC database service
keyserv | RPC keyserv service
llockmgr | RPC llockmgr service
nlockmgr | RPC nlockmgr service
nsed | nsed service
nsemntd | nsemntd service
pmapsunset | Portmap UNSET procedure requested with spoofed address
rexd | Rexd running
rje mapper | rje mapper service
rpc32771 | RPC bind service on improper port
rpc_snmp | RPC SNMP service detected running
rpcpcnfsd | RPC pcnfsd service allows remote command execution as root
rpcstatd | RPC statd remote file creation and removal
rpcupdate | RPC ypupdated daemon allows remote commands execution as root
rquotad | rquotad service
ruserout | Rusers output
rusersd | Rusers running
sched | RPC sched service
selsvcvuln | Remote file access through selection service
showfhd | showfhd service
sprayd | Sprayd service
statmon | RPC statmon service
tfsd | Tfsd service
walld | Rpc.walld wall daemon running
x25.inr | X25 daemon running
Router/Switch
Ascend-kill2 SNMP | Ascend Pipeline and MAX denial of service vulnerability
Cisco CHAP/PPP Vulnerability | Cisco CHAP authentication failure allows unauthorized PPP connections
CiscoACL | Cisco IOS access control list vulnerable via 'tacacs' keyword
CiscoACL Established | Cisco IOS access control list vulnerable via 'established' keyword
CiscoIOS | Cisco IOS can be remotely crashed and rebooted by unauthenticated users
CiscoIOS AAA Authenticate | Cisco IOS AAA does not properly authenticate users
CiscoLand | Cisco vulnerable to land attack
bruteciscoenable | Cisco administrative account accessible
Shares
nbdict NetBIOS dictionary attack
NT Users
httpproxy HTTP proxy detected


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 103 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
Act as System Privilege | Inappropriate user with Act as Part of the Operating System privilege
Ascend-kill2 SNMP | Ascend Pipeline and MAX denial of service vulnerability
Backup Privilege | Inappropriate user with Backup Files and Directories privilege
Cisco CHAP/PPP Vulnerability | Cisco CHAP authentication failure allows unauthorized PPP connections
CiscoACL | Cisco IOS access control list vulnerable via 'tacacs' keyword
CiscoACL Established | Cisco IOS access control list vulnerable via 'established' keyword
CiscoIOS AAA Authenticate | Cisco IOS AAA does not properly authenticate users
Create Permanent Object Privilege | Inappropriate user with Create Permanent Shared Objects privilege
Debug Privilege | Inappropriate user with Debug Programs privilege
Generate Security Audit Privilege | Inappropriate user with Generate Security Audits privilege
Load Driver Privilege | Inappropriate user with Load and Unload Device Drivers privilege
Manage Security Log Privilege | Inappropriate user with Manage Auditing and Security Log privilege
Profile System Privilege | Inappropriate user with Profile System Performance privilege
Replace Process Token Privilege | Inappropriate user with Replace a Process Level Token privilege
Restore Privilege | Inappropriate user with Restore Files and Directories privilege
SOCKS | SOCKS v3 daemon misconfigured
SocksV4 | SOCKS v4 daemon misconfigured
SocksV5 | SOCKS v5 daemon misconfigured
System Environment Privilege | Inappropriate user with Modify Firmware Environment Values privilege
Take Ownership Privilege | Inappropriate user with Take Ownership of Files or Other Objects privilege
bruteciscoenable | Cisco administrative account accessible
ftpproxy | FTP proxy penetrated
nbdict | NetBIOS dictionary attack
pmapsunset | Portmap UNSET procedure requested with spoofed address
rexd | Rexd running
rpcpcnfsd | RPC pcnfsd service allows remote command execution as root
rpcstatd | RPC statd remote file creation and removal
rpcupdate | RPC ypupdated daemon allows remote commands execution as root
wwwproxypen | HTTP proxy penetrated
Low
3270 mapper | 3270 mapper service
Disabled Account | Disabled account
Domain Admin | Domain Administrators group includes non-default user
Domain Guest | Domain Guest group includes non-default user
Dormant Account | Dormant account
Forced Logoff | Forced logoff not enabled for account with expired time
Guest Exists | Guest account name exists
Guest User | Guest account includes unallowed user
Increase Quota Privilege | Inappropriate user with Increase Quotas privilege
Interactive Guest Logon | Windows NT Interactive_Guest_Logon
Local User | Windows NT local user on workstation
Locked Account | Locked account from bad login attempts
Lockout Duration | Lockout duration insufficient
Lockout Window | Lockout window insufficient
Logon Hours Not Set | Logon hours not set
Network Guest Logon | Windows NT network Guest logon
No Logon | Windows NT user has never logged on
No User Profile | No user profile required
Primary Domain Controller | Primary domain controller identified
Sunlink Mapper | Sunlink mapper service
Ugidd Check | Ugidd daemon can reveal usernames on Linux machines
Workstation not restricted | Windows NT workstations not restricted
admind | Admind or Sadmind running
alis | RPC alis service
bindvrs | BIND servers can be remotely queried for their version
bootparam | Bootparam enabled
bootpdom | Bootparam supplies domain name
database service | RPC database service
httpproxy | HTTP proxy detected
keyserv | RPC keyserv service
llockmgr | RPC llockmgr service
lockout | Lockout threshold incorrect
nlockmgr | RPC nlockmgr service
nsed | nsed service
nsemntd | nsemntd service
rje mapper | rje mapper service
rpc_snmp | RPC SNMP service detected running
rquotad | rquotad service
rstatd | NIS rstat service is running
rstatout | Rstat output
ruserout | Rusers output
rusersd | Rusers running
sched | RPC sched service
showfhd | showfhd service
sprayd | Sprayd service
statmon | RPC statmon service
tfsd | Tfsd service
x25.inr | X25 daemon running
ypbind | NIS YPBind service
ypmap | NIS maps
yppasswdd | Yppasswdd service
ypserv | NIS Yellow Pages (YP) service is running
ypxfrd | Ypxfrd service
Low
Change System Time Privilege | Inappropriate user with Change the System Time privilege
CiscoIOS | Cisco IOS can be remotely crashed and rebooted by unauthenticated users
CiscoLand | Cisco vulnerable to land attack
Create Pagefile Privilege | Inappropriate user with Create a Pagefile privilege
Create Token Name Privilege | Inappropriate user with Create a Token Object privilege
Guest in Group | Guest account in non-default group
Increase Priority Privilege | Inappropriate user with Increase Scheduling Priority privilege
Lock Memory Privilege | Inappropriate user with Lock Pages in Memory privilege
PmapUnset | Portmap UNSET procedure requested
Profile Single Process Privilege | Inappropriate user with Profile Single Process privilege
Remote Shutdown Privilege | Inappropriate user with Force Shutdown from a Remote System privilege
RipAppend | Routed append vulnerability allows remote file manipulation
YpBindReserved | Ypbind is running over a non-reserved port
YpServReserved | Ypserv on unreserved Port
guestblankpw | Guest user has blank password
guestnopw | Guest account has no password
guestuserpw | Guest username same as password
rpc32771 | RPC bind service on improper port
selsvcvuln | Remote file access through selection service
squidprox | Squid proxy was penetrated to reach protected hosts
walld | Rpc.walld wall daemon running