Zone active scripting

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone active scripting
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow script code embedded in HTML pages within the URL security zone to be able to use embedded objects (such as ActiveX or Java), provided that the applets expose properties, methods, and events. The web browser may automatically execute potentially malicious scripts.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Active scripting.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the ActiveX controls and plug-ins area, disable Script ActiveX controls marked safe for scripting.
    7. Click OK twice to apply the changes.
References:


Zone ActiveX execution

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Zone Active X execution
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow ActiveX controls and plug-ins to be launched from the URL security zone of the HTML page that contains the control.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Run ActiveX controls and plug-ins.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x.

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. Disable Run ActiveX controls and plug-ins.
    7. Click OK twice to apply the changes.
References:


Zone auto user authentication

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone auto authenticate
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow the web browser to automatically transmit the user's credentials when requested from an HTML page in the selected URL security zone. A potentially malicious web site may automatically obtain the user's credentials without the user's knowledge.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

For Internet Explorer 4.x:

  1. Open Internet Explorer 4.x.
  2. From the View menu, select Internet Options.
  3. Click the Security tab.
  4. Select the appropriate Zone.
  5. Click Custom (for expert users).
  6. Click Settings.
  7. Set the Prompt for user name and password to log on. Do not use Automatic logon with current username and password.
  8. Click OK twice to apply the changes.

For Internet Explorer 5.x:

  1. Open Internet Explorer 5.x.
  2. From the Tools menu, select Internet Options.
  3. Click the Security tab.
  4. Select the appropriate Zone.
  5. Click Custom Level.
  6. In the User Authentication, Logon area, enable Prompt for user name and password to log on. Do not use Automatic logon with current username and password.
  7. Click OK twice to apply the changes.
References:


Zone desktop install

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone desktop install
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow desktop content to be downloaded and installed directly from the URL security zone of the HTML page that contains the desktop content. Potentially malicious desktop content may automatically download and install on the host.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Installation of desktop items.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. Disable Installation of desktop items.
    7. Click OK twice to apply the changes.
References:


Zone file download

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone file download
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow files to be downloaded directly from the URL security zone of the HTML page containing the download link. A potentially malicious or virus-infected program may be received without the user's knowledge.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable File Download.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Downloads area, disable File Downloads.
    7. Click OK twice to apply the changes.
References:


Zone file launch

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone file launch
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow files or applications to be launched directly from the URL security zone of the HTML page that contains the file or application. Potentially malicious files or applications may automatically execute on the host without the user's knowledge.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Launching applications and files in an IFRAME.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Miscellaneous area, disable Launching programs and files in an IFRAME.
    7. Click OK twice to apply the changes.
References:


Zone non-secure form submission

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone non-secure form submission
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow the web browser to submit non-encrypted form data to the URL security zone of the HTML page making the data request. Potentially sensitive data may be intercepted in transit by packet sniffing.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Submit non-encrypted form data.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Miscellaneous area, disable Submit non-encrypted form data.
    7. Click OK twice to apply the changes.
References:


Zone Java scripting

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone java scripting
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow script code embedded in HTML pages within the URL security zone to be able to use Java applets, provided that the applets expose properties, methods, and events. The web browser may automatically execute potentially malicious Java applets or scripts.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Scripting of Java applets.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Scripting area, disable Scripting of Java applets.
    7. Click OK twice to apply the changes.
References:


Zone low channel permissions

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone low channel permissions
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow the web browser to automatically install software updates from the URL security zone of the HTML page that contains the channel content. Potentially malicious channel content may automatically download and install without the user's knowledge.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Set Software file permissions to High safety.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Miscellaneous area, set Software channel permissions to High Safety.
    7. Click OK twice to apply the changes.
References:


URL Security Zone low Java permissions

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Zone low java permissions
Platforms: Windows NT, Internet Explorer
Description:

Allows Java applets to operate out of the Java sandbox model, so that they will be allowed to perform high-capability operations, such as file I/O operations. A potentially malicious Java applet may perform unauthorized modifications to the machine.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x, follow these steps:
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Under Internet Zone, click Custom (for expert users).
    5. Click Settings.
    6. Under Java, Java Permissions, enable High Safety.
    7. Click OK to apply these changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the Java, Java Permissions area, enable High Safety.
    7. Click OK twice to apply the changes.
References:


Zone ActiveX safe scripting enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone safe scripting enabled
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow ActiveX controls marked as safe to be scripted from the URL security zone of the HTML page that contains the script. Potentially malicious scripts containing ActiveX controls may be automatically executed by the web browser.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Script ActiveX controls marked safe for scripting.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the ActiveX controls and plug-ins area, disable Script ActiveX controls marked safe for scripting.
    7. Click OK twice to apply the changes.
References:


Zone signed ActiveX download

Risk Level: Low risk vulnerability Low

Check or Attack Name: Zone signed download
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow signed ActiveX controls to be downloaded directly from the URL security zone of the HTML page that contains the control. Potentially malicious ActiveX controls may be automatically downloaded.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Download Signed ActiveX Controls.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the ActiveX controls and plug-ins area, disable Download signed ActiveX controls.
    7. Click OK twice to apply the changes.
References:


Zone scripting of unsafe ActiveX controls

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Zone unsafe scripting enabled
Platforms: Windows NT, Internet Explorer
Description:

The security zone settings allow ActiveX controls not marked as safe to be automatically initialized and executed from the URL security zone of the HTML page that contains the script. Potentially malicious scripts containing ActiveX controls may be automatically executed by the web browser.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. Disable Initialize and script ActiveX controls not marked as safe.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the ActiveX controls and plug-ins area, disable Initialize and script ActiveX controls not marked as safe.
    7. Click OK twice to apply the changes.
References:


URL security zone unsigned ActiveX download

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Zone unsigned download
Platforms: Internet Explorer
Description:

The security zone settings allow unsigned ActiveX controls to be downloaded directly from the URL security zone of the HTML page that contains the control. Potentially malicious ActiveX controls may be automatically downloaded.
Remedy:

Depending on your version, select one of the following choices in Internet Explorer:

  • For Internet Explorer 4.x:

    1. Open Internet Explorer 4.x.
    2. From the View menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom (for expert users).
    6. Click Settings.
    7. In the ActiveX Controls and Plugins area, disable Download Unsigned ActiveX Controls.
    8. Click OK twice to apply the changes.

  • For Internet Explorer 5.x:

    1. Open Internet Explorer 5.x.
    2. From the Tools menu, select Internet Options.
    3. Click the Security tab.
    4. Select the appropriate Zone.
    5. Click Custom Level.
    6. In the ActiveX Controls and Plugins area, disable Download Unsigned ActiveX Controls.
    7. Click OK twice to apply the changes.
References:


DCOM is enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: DCOM
Platforms: Windows NT
Description:

DCOM was found to be enabled. DCOM may be used to remotely execute programs.
Remedy:

Disable DCOM in the Windows NT registry.

To disable DCOM, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Ole key.
  3. Open EnableDCOM key and change the value to N.
  4. Click OK.
References:


DCOM access permission incorrect

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Access Permission
Platforms: Windows NT
Description:

Access permissions on the DCOM object let non-administrators create DCOM objects and execute code on the local system.
Remedy:

Fortify the DCOM object's permissions so that it continues to function under tightened security:

  1. Run the dcomcnfg program in the %SystemRoot%/System32 folder.
  2. Double-click the DCOM object that generated this vulnerability.
  3. Click Security.
  4. Edit the access permissions. Some applications may require loose access permissions in order to function. Verify that the object in question still functions properly after making any changes.
  5. Click OK twice.
References:

Microsoft Knowledge Base Article Q176799, INFO: Using DCOM Config (DCOMCNFG.EXE) on Windows NT, http://support.microsoft.com/support/kb/articles/q176/7/99.asp


DCOM default authentication level

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Auth Level
Platforms: Windows NT
Description:

The DCOM default authentication level has been detected to be below Connect. If the authentication level is None, then any user can access any object on the system without authentication.
Remedy:

Fortify DCOM's default permissions so that objects continue to function under tightened security:

  1. Run the dcomcnfg program in the %SystemRoot%/System32 folder.
  2. Select the Default Properties tab.
  3. Select a Default Authentication level of at least Connect. Note: For sensitive systems, an authentication level of Packet Privacy is recommended.
  4. Click OK.
  5. Verify that DCOM objects still function properly after making changes.
References:

Microsoft Knowledge Base Article Q176799, INFO: Using DCOM Config (DCOMCNFG.EXE) on Windows NT, http://support.microsoft.com/support/kb/articles/q176/7/99.asp


DCOM configuration writable

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Config Writable
Platforms: Windows NT
Description:

A registry key for a valid DCOM object has access permissions that allow non-administrator users to change the security settings. If DCOM security settings are inadvertently set to a low level of security, it may be possible for an attacker to execute code, possibly under the user context of the console user.

In addition, an attacker could change the security on the object to allow for a future attack, such as setting the object to run as Interactive User. The Interactive User runs the application using the security context of the user currently logged on to the computer. If this option is selected and the user is not logged on, then the application will not start.
Remedy:

Fortify DCOM's AppId permissions so that objects continue to function under tightened security.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to HKEY_LOCAL_MACHINE\Software\Classes\AppId.
  3. Select the application that generated this vulnerability.
  4. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  5. Set the permissions to Administrators - Full Control, System - Full Control, and Everyone - Read.
  6. For maximum security, set these permissions at the AppId root key, and click Replace Permission on Existing Subkeys to propagate permissions to all subkeys.

WARNING: If the Interactive user does not have write permission at the root key, then ordinary users will not be able to install applications which expose DCOM objects.
References:


DCOM default access

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Default Access
Platforms: Windows NT
Description:

DCOM default access permissions include users other than Administrators and the Interactive (console) user. Verify that the other users should have access to all DCOM objects on the system.
Remedy:

Fortify DCOM's default permissions so that all objects continue to function under tightened security:

  1. Run the dcomcnfg program in the %SystemRoot%/System32 folder.
  2. Click the Default Security tab.
  3. From Default Access Permissions, select Edit Default.
  4. Review the default permissions. Recommended access levels are Administrators - Allow Access and INTERACTIVE - Allow Access.
  5. Verify that DCOM objects still function properly after making changes.
References:

Microsoft Knowledge Base Article Q176799, INFO: Using DCOM Config (DCOMCNFG.EXE) on Windows NT, http://support.microsoft.com/support/kb/articles/q176/7/99.asp


DCOM default launch

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Default Launch
Platforms: Windows NT
Description:

DCOM default launch permissions include users other than Administrators and the Interactive (console) user. Verify that the other users should have permission to launch all DCOM objects on the system.
Remedy:

Fortify DCOM's default permissions so that all objects continue to function under tightened security:

  1. Run the dcomcnfg program in the %SystemRoot%/System32 folder.
  2. Click the Default Security tab.
  3. From Default Access Permissions, select Edit Default.
  4. Review the default permissions. Recommended access levels are Administrators - Allow Access and INTERACTIVE - Allow Access.
  5. Verify that DCOM objects still function properly after making changes.
References:

Microsoft Knowledge Base Article Q176799, INFO: Using DCOM Config (DCOMCNFG.EXE) on Windows NT, http://support.microsoft.com/support/kb/articles/q176/7/99.asp


DCOM launch permission incorrect

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM Launch Permission
Platforms: Windows NT
Description:

Launch permissions on the DCOM object allow non-administrators to launch DCOM objects and execute code on the host.

False Positives: If a DCOM object implements internal security measures, then this issue is not a vulnerability.
Remedy:

Fortify the DCOM object's permissions so that it continues to function under tightened security:

  1. Run the dcomcnfg program in the %SystemRoot%/System32 folder.
  2. Double-click the DCOM object that generated this vulnerability.
  3. Click Security.
  4. Edit the access permissions. Some applications may require loose launch permissions in order to function. Verify that the object in question still functions properly after making any changes.
  5. Click OK twice.
References:

Microsoft Knowledge Base Article Q176799, INFO: Using DCOM Config (DCOMCNFG.EXE) on Windows NT, http://support.microsoft.com/support/kb/articles/q176/7/99.asp


DCOM RunAs value altered

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DCOM RunAs
Platforms: Windows NT
Description:

The DCOM RunAs Value was found to be altered. DCOM calls are executed under the security context of the calling user by default. If the RunAs key has been altered, the DCOM calls can be executed under the user context of the currently logged in user, or as a third user. If this ability is not controlled very carefully, it could provide a network user with the ability to execute arbitrary code under another user context.
Remedy:

Remove the RunAs value to restore the user context to that of the calling user.

To remove the RunAs value, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Classes\AppID key.
  3. Locate the subkey that has had the RunAs value inserted.
  4. Delete the RunAs value.
References:


Database service detected via TCP

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SybaseDetectTCP
Platforms: | Sybase
Description: | A database service was detected as running on a TCP port.
Remedy: | This check only detects the service, and does not indicate a vulnerability.
References: |


Exchange anonymous IMAP allowed

Risk Level: Low risk vulnerability Low

Check or Attack Name: ExchangeAnonIMAP
Platforms: Microsoft Exchange: 5.0, Microsoft Exchange: 5.5
Description:

If anonymous access to IMAP is enabled, an attacker could connect and possibly access confidential data. An attacker could also waste resources by creating folders and large files.

False Negatives: Microsoft Exchange allows you to configure IMAP to use any login name for anonymous access. If the login name has been changed from anonymous, this check will fail.
Remedy:

Disable anonymous access to IMAP.
References:


LDAP config information available

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: LDAP Config
Platforms: | LDAP
Description: | A potential attacker can gain information about the LDAP server by accessing the LDAP configuration. The configuration information can show what sort of backend is being used.
Remedy: | Disable the cn=config entry or allow only authorized users to view the entry.
References: |


LDAP Exchange overflow crashes LDAP server

Risk Level: High risk vulnerability High

Check or Attack Name: LDAP Exchange Overflow
Platforms: LDAP, Microsoft Exchange: 5.5
Description:

A buffer overflow exploit against Microsoft Exchange's LDAP (Lightweight Directory Access Protocol) server allows read access to the Exchange server directory by using an LDAP client. This buffer overflow consists of a malformed bind request that overflows the buffer and can execute arbitrary code. This attack can also cause the Exchange LDAP service to crash. This vulnerability exists in Microsoft Exchange Server version 5.5.
Remedy:

Microsoft has released patches to fix this problem. Users are encouraged to apply these as soon as possible.
References:

ISS Security Advisory #22, LDAP Buffer overflow against Microsoft Directory Services, http://xforce.iss.net/alerts/advise22.php3

Microsoft Security Bulletin MS99-009, Patch Available for "Malformed Bind Request" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-009.asp


LDAP monitor information gathering

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: LDAP monitor
Platforms: | LDAP
Description: | A potential attacker can gain information about the LDAP server by accessing the LDAP monitor. The LDAP server dumps monitoring information, such as the LDAP server version, the connections, the number of backends, and who's logged on.
Remedy: | Disable the cn=monitor entry or allow only authorized users to view this entry.
References: |


LDAP null base returns information

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: LDAP NullBase
Platforms: | LDAP
Description: | If LDAP allows a NULL base in an LDAP search, a user can run a search that returns information on namingContexts and supported controls.
Remedy: | Use an access list control to prevent users from dumping the base of the tree or issuing a request without knowing the base object.
References: |


LDAP anonymous access to directory

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: LDAP NullBind
Platforms: | LDAP
Description: | The NULL bind entry allows a user to access the LDAP directory as anonymous.
Remedy: | Disable the NULL bind entry or control the entry with Access Control Lists (ACL).
References: |


LDAP null subtree allows user to gain information

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: LDAP NullSubtree
Platforms: LDAP
Description:

If LDAP allows a NULL base in an LDAP search with a scope set to subtree, the LDAP server will dump all viewable information in a directory.
Remedy:
  • Use an access list to deny all access by default.
  • Create groups and modify group permissions according to each group's requirements.
  • Assign users to the appropriate group(s) according to their needs.
References:


LDAP schema information gathering

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: LDAP Schema
Platforms: | LDAP
Description: | A potential attacker can gain information about the LDAP server by accessing the LDAP schema. The LDAP server dumps its schema, which can show all necessary attributes needed for an object, including hidden or non-readable attributes.
Remedy: | Disable the cn=schema entry or allow only authorized users to view the entry.
References: |


IIS can be remotely crashed by excessively long client requests

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: IIS CGI Overflow
Platforms: IIS: 2.0, IIS: 3.0
Description:

The Microsoft Internet Information Server (IIS) 2.0 and 3.0 contain a vulnerability that crashes the server if a very large client request is received. The attack can be embedded in many requests, such as headers and CGI requests, and requires a length between 4 KB and 8 KB to be transmitted, which never happens in normal HTTP traffic.
Remedy:

This vulnerability was corrected in post-SP3 hotfixes and in Service Pack 4.

Apply the latest Windows NT 4.0 Service.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 3 (SP3) users must apply the post-SP3 iis-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/iis-fix/.
References:

Microsoft Knowledge Base Article Q143484, IIS Services Stop with Large Client Requests, http://support.microsoft.com/support/kb/articles/q143/4/84.asp

Microsoft Knowledge Base Article Q143484, Internet Information Server Services Stop w/ Large CGI Request, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/iis-fix/Q143484.txt


Windows NT Local Security Authority (LSA) can be remotely crashed, requiring a system reboot

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: MsrpcLsaLookupnamesDos
Platforms: Windows NT: 4.0 SP4, Windows NT: 4.0 SP5
Description:

A potentially serious denial of service attack on the Windows NT Local Security Authority (LSA) service could allow a remote attacker to crash this service by making a malformed request to LsaLookupNames. In most cases, the system will have to be rebooted to regain normal functionality.
Remedy:

Apply the Windows NT 4.0 post-SP5 LSA3-fix update. This fix can be installed on Windows NT 4.0 Service Pack 4 and Service Pack 5.

Windows NT 4.0 Service Pack 4 (SP4) and SP5 users, apply the LSA3-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/LSA3-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

Microsoft Security Bulletin MS99-020, Patch Available for "Malformed LSA Request" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-020.asp

Microsoft Knowledge Base Article Q231457, Malformed Request Causes LSA Service to Hang, http://support.microsoft.com/support/kb/articles/q231/4/57.asp

BindView Development, Phantom Technical Advisory, http://www.bindview.com/security/advisory/phantom_a.html

CIAC Information Bulletin J-049, J-049: Windows NT, Two Denial-of-Service Vulnerabilities (Malformed LSA Request and CSRSS Worker Thread Exhaustion), http://ciac.llnl.gov/ciac/bulletins/j-049.shtml


Windows NT CSRSS denial of service attack

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NtCsrssDos
Platforms: Windows NT: 4.0 SP5
Description:

The Microsoft Windows NT CSRSS.EXE Client Server Runtime Subsystem service can be used to launch a denial of service attack against hosts accepting interactive logins. CSRSS provides Windows NT services to client processes running on the local computer.

When all worker threads (by default, a maximum of 16) within the CSRSS service are awaiting user input, no new connections can be made, effectively hanging the system.
Remedy:

Apply the Windows NT 4.0 post-SP5 Csrss-fix update.

Windows NT 4.0 Service Pack 5 (SP5) users, apply the Csrss-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/Csrss-fix/ .
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

Microsoft Security Bulletin MS99-021, Patch Available for "CSRSS Worker Thread Exhaustion" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-021.asp

Microsoft Knowledge Base Article Q233323, Exceeding MaxRequestThreads may Cause Windows NT to Hang, http://support.microsoft.com/support/kb/articles/q233/3/23.asp

CIAC Information Bulletin J-049, J-049: Windows NT, Two Denial-of-Service Vulnerabilities (Malformed LSA Request and CSRSS Worker Thread Exhaustion), http://ciac.llnl.gov/ciac/bulletins/j-049.shtml


Windows NT gina flaw allows some clipboard text to be revealed

Risk Level: | Low risk vulnerability Low | Check or Attack Name: NTginaPaste
Platforms: | Windows NT: 3.5.1, Windows NT: 4.0, Windows NT: 4.0 SP4
Description: | A flaw has been found in Windows NT that allows anyone to view the contents of the first line from the clipboard of a user who has locked their terminal, by pasting into the console login username field.
Remedy: | Microsoft has released the Windows NT post-SP3 and post-SP4 gina-fix hotfix that remedies this problem and another similar vulnerability.
References: | Microsoft Knowledge Base Article Q214802, WinNT Lets You Paste Text into Unlock Workstation Dialog Box, http://support.microsoft.com/support/kb/articles/q214/8/02.asp


Windows NT 4.0 help file utility contains a locally exploitable buffer overflow

Risk Level: High risk vulnerability High

Check or Attack Name: NT Help Overflow
Platforms: Windows NT: 4.0
Description:

The Windows NT 4.0 help file utility could allow a malformed help file to overflow buffers inside the program. Help files are typically started by pressing the F1 key or by choosing options from the Help menu in programs.

This hole could possibly be manipulated to execute arbitrary code on affected systems.
Remedy:

Apply the Windows NT 4.0 post-SP5 winhlp32-fix update. As a temporary workaround, administrators should restrict what users are allowed to add help files to the system.

Windows NT 4.0 Service Pack 5 (SP5) users, apply the winhlp32-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/winhlp32-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

Microsoft Knowledge Base Article Q231605, Malformed Help File Causes Help Utility to Stop Responding, http://support.microsoft.com/support/kb/articles/q231/6/05.asp

Microsoft Security Bulletin MS99-015, Patch Available for "Malformed Help File" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-015.asp


Windows NT 4.0 domain caching feature can be exploited to gain administrator privileges

Risk Level: High risk vulnerability High

Check or Attack Name: NTKnownDLLsList
Platforms: Windows NT: 3.5, Windows NT: 3.5.1, Windows NT: 4.0
Description:

Windows NT implements a feature that keeps the most used DLL's in memory to improve performance and memory usage. A flaw exists in the permissions normal users have to this KnownDLLs list that allows them to load malicious code in the list and point applications at this Trojan horse code, which will then be executed with administrative privileges.
Remedy:

Affected users should obtain and install the smss-fix hotfix from Microsoft as soon as possible. As a temporary workaround, the following value can be added to the system registry to prevent the exploitation of this attack:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
Name: ProtectionMode
Type: REG_DWORD
Value: 1
References:

Microsoft Security Bulletin MS99-006, Fix Available for Windows NT "KnownDLLs List" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-006.asp

Microsoft Knowledge Base Article Q218473, Restricting Changes to Base System Objects, http://support.microsoft.com/support/kb/articles/q218/4/73.asp

L0pht Security Advisory, Microsoft Windows NT 4.0, http://www.l0pht.com/advisories/dll_advisory.txt

BUGTRAQ Mailing List, ,


Windows NT can be crashed by executables containing malformed image headers

Risk Level: Low risk vulnerability Low

Check or Attack Name: NtMalformedImageHeader
Platforms: Windows NT: 4.0 SP4, Windows NT: 4.0 TSE
Description:

It is possible to crash a Windows NT machine if the user executes a file with a specially malformed image header. The system will require a reboot to become functional again.
Remedy:

Windows NT 4.0 Service Pack 5 resolves this problem. Apply the latest Windows NT 4.0 Service Pack, or apply the Windows NT 4.0 post-SP4 kernel-fix update from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/Hotfixes-PostSP4/Kernel-fix/.
References:

Microsoft Security Bulletin MS99-023, Patch Available for "Malformed Image Header" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-023.asp

Microsoft Knowledge Base Article Q234557, Executable with a Specially-Malformed Image Header May Crash Windows NT, http://support.microsoft.com/support/kb/articles/q234/5/57.asp

Microsoft Security Bulletin MS99-023, Microsoft Security Bulletin MS99-023: Frequently Asked Questions, http://www.microsoft.com/security/bulletins/MS99-023faq.asp


Windows NT RPC services can be used to deplete system resources

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NTnprpcDoS
Platforms: Windows NT: 4.0, Windows NT: 4.0 SP2, Windows NT: 4.0 SP4, Windows NT: 4.0 SP1, Windows NT: 4.0 SP3
Description:

A vulnerability in the RPC services of Windows NT 4.0 through SP4 could allow a remote attacker to cause the machine to consume all available memory and processor resources, and eventually hang the machine. The attack is exploited by connecting to either the SPOOLSS.EXE and LSASS.EXE service over a named pipe and sending random data.
Remedy:

Microsoft has made the post-SP4 nprpc-fix hotfix available for Windows NT. Users are encouraged to apply this patch as soon as possible.
References:

Microsoft Knowledge Base Article Q195733, Denial of Service in Applications Using RPC over Named Pipes, http://support.microsoft.com/support/kb/articles/q195/7/33.asp

Microsoft Knowledge Base Article Q195733, Denial of Service in Applications Using RPC over Named Pipes, http://www.microsoft.com/security/bulletins/ms98-017.asp


Windows NT RAS client contains an exploitable buffer overflow

Risk Level: High risk vulnerability High

Check or Attack Name: NT RAS Overflow
Platforms: Windows NT: 4.0
Description:

The portion of the RAS (Remote Access Service) client for Windows NT 4.0 that processes phone book entries contains a buffer overflow condition, which could allow a local user to cause a denial of service or possibly execute arbitrary code with system privileges.
Remedy:

Apply the Windows NT 4.0 post-SP5 RAS-fix update.

Windows NT 4.0 Service Pack 5 (SP5) users, apply the RAS-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/RAS-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

BUGTRAQ Mailing List, Buffer Overruns in RAS allows execution of arbitary code as system, http://www.netspace.org/cgi-bin/wa?A2=ind9905C&L=bugtraq&P=R2187

Microsoft Security Bulletin MS99-016, Patch Available for "Malformed Phonebook Entry" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-016.asp

Microsoft Knowledge Base Article Q230677, Malformed Phonebook Entry Security Vulnerability in RAS Client, http://support.microsoft.com/support/kb/articles/q230/6/77.asp


RRAS caches security credentials when using Dial-up Networking client

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: RRASPasswordFix
Platforms: Windows NT: 4.0 SP4
Description:

When Routing and Remote Access Service (RRAS) is installed on your computer and you are using the Dial-Up Networking client software to connect to a server, a dialog box requests the user's User ID and password for the server. In the same dialog box is the Save Password check box, which is intended to provide the user with the option to cache their security credentials if desired. However, the implemented client functionality actually caches the user's credentials regardless of whether the check box is selected or not.

In general, caching security credentials on a computer is not a good security practice. Cache files can easily be decrypted, or users with access to the machine can access unauthorized systems without authentication.
Remedy:

Apply the Windows NT 4.0 post-SP5 RRASPassword-fix update.

Windows NT 4.0 Service Pack 5 (SP5) users, apply the RRASPassword-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/RRASPassword-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

Microsoft Knowledge Base Article Q233303, DUN Credentials Cached When Save Password Not Selected with RRAS, http://support.microsoft.com/support/kb/articles/q233/3/03.asp


RRAS under stress stops responding to incoming calls

Risk Level: Low risk vulnerability Low

Check or Attack Name: RRASIncomingStop
Platforms: Windows NT: 4.0 SP4
Description:

The Routing and Remote Access Server (RRAS) computer may stop responding to incoming calls when it is placed under heavy loads.
Remedy:

Windows NT 4.0 Service Pack 5 resolves this problem. Apply the latest Windows NT 4.0 Service Pack, or apply the Windows NT 4.0 post-SP4 disc-fix update.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 Service Pack 4 (SP4) users, apply the disc-fix update:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP4/Disc-fix/.
  3. View the readme.txt for versions and install instructions.
  4. Download the appropriate patch for your operating environment.
  5. Find the discfix patch file you downloaded to your computer.
  6. Double-click its icon to start the installation.
  7. Follow the installation directions.
References:

Microsoft Knowledge Base Article Q221331, RRAS Computer Stops Responding to Incoming Calls Under Stress, http://support.microsoft.com/support/kb/articles/q221/3/31.asp


Windows NT screen saver can be used to compromise admin privileges

Risk Level: High risk vulnerability High

Check or Attack Name: NTScreenSaver
Platforms: Windows NT: 4.0
Description:

A vulnerability exists in the Windows NT screen saver that could allow local administrator privileges to be compromised. The hole exists because under some circumstances the screen saver will fail to drop its elevated privileges and can then be tricked into running arbitrary commands with administrative rights.
Remedy:

Windows NT users should immediately obtain and apply the ScrnSav-fix hotfix from Microsoft.
References:

Microsoft Security Bulletin MS99-008, Patch Available for Windows NT "Screen Saver" Vulnerability, http://www.microsoft.com/security/bulletins/ms99-008.asp

Microsoft Knowledge Base Article Q221991, Screen Saver Vulnerability Lets User Privileges be Elevated, http://support.microsoft.com/support/kb/articles/q221/9/91.asp

Cybermedia Software Private Limited, Screen Saver vulnerability, http://www.cybermedia.co.in/NT_Security/SS_vulnerability.htm


Windows NT SNMP agent has a serious memory leak

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NT SNMPAgent Leak
Platforms: | Windows NT: 4.0, Windows NT: 4.0 SP4
Description: | A memory leak exists in the Windows NT 4.0 SNMP agent when it is queried multiple times. The program erroneously uses a memory buffer that it then never frees, which, in theory, could be exploited by a remote attacker to deplete a machine's memory resources.
Remedy: | Obtain and install the sms-fix post-SP4 hotfix for Windows NT 4.0 from Microsoft.
References: | Microsoft Knowledge Base Article Q196270, SNMP Agent Leaks Memory When Queried, http://support.microsoft.com/support/kb/articles/q196/2/70.asp


Windows NT 4.0 SP4 could allow null passwords to be used for access

Risk Level: High risk vulnerability High

Check or Attack Name: NTSP4AuthError
Platforms: Windows NT: 4.0 SP4
Description:

A vulnerability was introduced in Windows NT 4.0 SP4 (Service Pack 4) that could allow some users to access resources by supplying a null password. The problem exists when clients other than Windows NT/95/98 change their passwords causing certain fields in the SAM (Service Account Manager) to be left null. The next time this account is accessed from an NT machine no password will be required for authentication. This vulnerability only affects sites who have deployed machines with DOS, Windows 3.1, Windows for Workgroups, OS/2 or Macintosh clients.
Remedy:

Obtain and apply the Msv1-fix hotfix from Microsoft.
References:

Microsoft Security Bulletin MS99-004, Authentication Processing Error in Windows NT 4.0 SP4, http://www.microsoft.com/security/bulletins/ms99-004.asp

Microsoft Knowledge Base Article Q214840, MSV1_0 Allows Network Connections for Specific Accounts, http://support.microsoft.com/support/kb/articles/q214/8/40.asp


Windows NT "snork" attack can disable machines

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Snork DoS
Platforms: Windows NT: 4.0, Windows NT: 4.0 SP2, Windows NT: 4.0 SP1, Windows NT: 4.0 SP3
Description:

A vulnerability has been identified in Windows NT 4.0 up to SP4 that allows a remote attacker with minimal resources to cause the system to consume all available processor and network bandwidth resources for an indefinite length of time. The attack induces a storm of packets much like the smurf and fraggle attacks and has been referred to as the snork attack.
Remedy:

This problem was fixed in Windows NT 4.0 Service Pack 4 (SP4), which also included fixes for several other security problems. Users who do not wish to install SP4 should obtain and apply the Snk-fix post-SP3 hotfix.
References:

Microsoft Security Bulletin MS98-014, Update available for RPC Spoofing Denial of Service on Windows NT, http://www.microsoft.com/security/bulletins/ms98-014.asp

ISS Security Advisory #9, Snork Denial of Service Attack Against Windows NT RPC Service, http://xforce.iss.net/alerts/advise9.php3

Microsoft Knowledge Base Article Q193233, Rpcss.exe Consumes 100% CPU Due to RPC Spoofing Attack, http://support.microsoft.com/support/kb/articles/q193/2/33.asp


NetXRay 3.x probe unpassworded

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NetXRay3ProbeNoPass
Platforms: | NetXRay
Description: | If the NetXRay 3.x Probe service is running on a machine, a user can connect to the probe and sniff network traffic on your machine. If no password is required to connect to the probe, any user could sniff network traffic on your machine.
Remedy: | Disable the NetXRay probe service or enable passwords.
References: |


NetXRay 3.x probe detect

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NetXRay3Probe
Platforms: | NetXRay
Description: | If the NetXRay 3.x Probe service is running on a machine, a user can connect to the probe using your password and sniff network traffic on your machine.
Remedy: | Disable the NetXRay probe service.
References: |


FAM server lists files on IRIX systems

Risk Level: Low risk vulnerability Low

Check or Attack Name: irixfam
Platforms: IRIX
Description:

The IRIX File Alteration Monitor (fam) daemon is used by networked IRIX machines to track file modifications. The fam service, which runs as RPC program 391002, is used by other programs to keep track of file modifications.

When a program initially connects to the fam server, it passes the name of a file or directory to watch. If the fam server receives a directory name, it returns the client a complete list of files and subdirectories in that directory. By passing the fam server a request to list the root directory, and by systematically following the subdirectories, an attacker can remotely obtain a complete list of files on the system.
Remedy:

Determine if the fam daemon is running, and if so, disable the daemon.

To determine whether your workstation is running this service, type:

% /usr/etc/rpcinfo -p | grep 391002

If you are vulnerable, you will see the following line:

391002 1 tcp 1051 sgi_fam

If no output occurs, then you are not running a fam server. Any other type of output, such as an error message, probably indicates that you are either specifying the wrong directory for the rpcinfo program, or that there are no rpc services running on this system.

—AND—

If you do not use any programs that require fam, such as the IRIX file manager, fm(1G), or mailbox(1), then disable the fam service by commenting out the entry for it in /etc/inetd.conf and rebooting. Silicon Graphics has been notified of this problem and recommends that sites concerned about security disable the fam service.
References:

Secure Networks Inc. Security Advisory, July 14, 1997, Silicon Graphics IRIX fam service, http://web1.nai.com/products/security/advisory/16_fam_adv.asp


CDE rpc.ttdbserver daemon allows remote root access

Risk Level: High risk vulnerability High

Check or Attack Name: ToolTalk Overflow
Platforms: IRIX: 5.3, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, Solaris: 2.3, Solaris: 2.4, Solaris: 2.5, Solaris: 2.5.1, SunOS: 4.1.x, SunOS: 4.1.3, Solaris: 2.6, HPUX: 10.10, HPUX: 11.00, AIX: 4.1.x, AIX: 4.2.x, AIX: 4.3.x, HPUX: 10.20, HPUX: 10.30, SCO UnixWare: 7, Common Desktop Environment (CDE)
Description:

ToolTalk is a utility that allows applications to exchange messages between each other. A stack overflow in the rpc.ttdbserver could allow a remote attacker to execute arbitrary code with root privileges.
Remedy:

Immediately disable the rpc.ttdbserver service and obtain and install patches from your vendor.
References:

Silicon Graphics Inc. Security Advisory 19981101-01-A, Vulnerability in ToolTalk RPC Service, ftp://sgigate.sgi.com/security/19981101-01-A

CERT Advisory CA-98.11, Vulnerability in ToolTalk RPC Service, http://www.cert.org/ftp/cert_advisories/CA-98.11.tooltalk

Hewlett-Packard Security Bulletin HPSBUX9808-084, Security Vulnerability in dtmail/rpc.ttdbserverd on HP-UX, http://us-support.external.hp.com/

Network Associates, Inc. Security Advisory #29, Stack Overflow in ToolTalk RPC Service, http://www.nai.com/nai_labs/asp_set/advisory/29_ttdbserver_adv.asp

SCO Security Bulletin 98.04, Security Vulnerability in ToolTalk, ftp://ftp.sco.com/SSE/security_bulletins/SB-98.04a

Silicon Graphics Inc. Security Advisory 19981101-01-PX, Vulnerability in ToolTalk RPC Service, ftp://sgigate.sgi.com/security/19981101-01-PX

CERT Incident Note IN-99-04, Similar Attacks Using Various RPC Services, http://www.cert.org/incident_notes/IN-99-04.html


Cisco equipment can be used to send ICMP pings via SNMP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: SNMPCiscoPingball
Platforms: Cisco
Description:

Some Cisco routers can be configured to issue ICMP echo requests through the SNMP agent. This capability can be used to load other networked devices with echo response activity.

As coded here, the router is the target for the ICMP echo. This condition results in no appreciable network traffic. If repeated many times, the ICMP echo activities starve the router's I/O and memory resources and causes the router to not respond to ICMP echo.
Remedy:

Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters. The router should also apply access control to allow SNMP requests from known valid source sub-networks and authorized IP addresses.
References:

Cisco Systems Product Overview, Simple Network Management Protocol (SNMP), http://www.cisco.com/warp/public/535/3.html


Cisco SNMP agent can be instructed to shut down the RTT monitor service

Risk Level: Low risk vulnerability Low

Check or Attack Name: SNMPCiscoRTTMONKill
Platforms: Cisco
Description:

This exploit attempts to reset the RTTMON Application using SNMP Set-PDU request of these parameters:

  • rttMonApplReset
  • rttMonApplPreConfigedReset

If successful, the RTT monitor application has likely been reset.
Remedy:

Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters.
References:


Cisco SNMP agent can reveal event community strings

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: SNMPRMONGetEventCommunityStrings
Platforms: Cisco
Description:

The RFC-1271 standard RMON MIB defines the eventCommunity object to be a holder for a community string. Community strings can be used as authentication keys, and therefore should be protected.
Remedy:

The standard exists and has not been modified to prevent the event community strings from being exposed.

The trap event community string should be different from other community strings used by the management station. See the configuration section of the management station that is deployed at the customer's site.

Set the community string to a value that is hard to guess. Use uppercase, lowercase, and numeric characters.
References:

Request for Comment document RFC 1271, Remote Network Monitoring Management Information Base, ftp://ftp.isi.edu/in-notes/rfc1271.txt


SNMP community name is world readable by default

Risk Level: Low risk vulnerability Low

Check or Attack Name: SNMP Community
Platforms: Windows NT
Description:

The Simple Network Management Protocol (SNMP) for Windows NT Community Name was readable on the host. SNMP reveals a large amount of information, including shares, user names, and the status of running services. The only authentication available is by knowing the SNMP community name. If this information is readable by Everyone, an attacker could gather information that is normally only available to administrator level users.
Remedy:

Edit the Registry to permit only approved users access to the SNMP Community Name.

To edit the registry, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\S NMP\Parameters\ValidCommunities key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Set the permissions to permit only approved users access.

—AND—

If SNMP is required, remove the public community name and set the SNMP community name to something difficult to guess. To identify and remove public community names from Windows SNMP:

Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab.
  3. Click SNMP Service.
  4. Click Properties.
  5. Click the Security tab.
  6. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/kb/articles/q99/8/80.asp.)
    • The Accepted Community Names are not default or easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address is specified.
    • Each host and community name in the lists is a valid destination.
  7. In addition to securing SNMP from the control panel, you will want to secure it from the Registry.
References:

Request for Comment document RFC 1157, RFC 1157: A Simple Network Management Protocol, ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp

Microsoft Knowledge-Pak Desktop Suite 10140298, How to: Configure SNMP security, http://support.microsoft.com/support/ntserver/serviceware/10140298.asp

Microsoft Knowledge-Pak Desktop Suite 10141603, How to: Configure SNMP communities, http://support.microsoft.com/support/ntserver/serviceware/10141603.asp


Windows NT/WINS exploit using SNMP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NT Wins Dump
Platforms: Windows NT
Description:

This exploit demonstrates the ability via SNMP to dump a list of all usernames in a Windows NT domain (assuming the target computer is a Domain Controller) or on a Windows NT Server.
Remedy:

The simplest fix is to disable SNMP, or to remove the extension agents through the SNMP configuration in the registry.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Remove and confirm the operation.
References:

BUGTRAQ Mailing List, SNMP Insecurity, http://geek-girl.com/bugtraq/1997_4/0060.html


WINS records deletion via SNMP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NT Delete Records
Platforms: Windows NT
Description:

The Simple Network Management Protocol (SNMP) can remotely delete records from a WINS server, bypassing all Windows NT security mechanisms.

WINS (Windows Internet Name Service) provides naming services in a fashion similar to the industry standard DNS (Domain Name Service). After a WINS client reboots, it will register with the WINS server. Until the client is registered, users of the client may not authenticate.

Deleting the WINS records remotely via SNMP prevents authentication from proceeding, and user logins and screen unlocks will not work.
Remedy:

Reboot the WINS client and disable or remove SNMP extension agents from this computer. If SNMP is required on a WINS server, choose a community name that is hard to guess, and configure SNMP to accept requests from specific hosts.

To disable SNMP, follow these steps:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Remove and confirm the operation.

—OR—

To change the SNMP community name and limit requests to specific hosts, follow these steps:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Under the Security tab, review the Accepted Community Names and verify that they are hard to guess.
  5. Set Accept SNMP Packets from These Hosts.
  6. Click Add.
  7. Enter a host name, IP, or IPX address and click Add.
  8. Repeat steps 6 and 7 for all authorized hosts.
  9. Click OK.
References:

BUGTRAQ Mailing List, "Rouland, Christopher J" <CRouland@EXAMNYC.lehman.com>, SNMP Insecurity, http://geek-girl.com/bugtraq/1997_4/0060.html


SNMP server configured without communities

Risk Level: Low risk vulnerability Low

Check or Attack Name: snmp_comm
Platforms: SNMP
Description:

SNMP was found without communities specified. The SNMP Public information may contain sensitive information that can be used to compromise computer systems.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names. If SNMP is not required, disable the service:

Windows: To disable SNMP:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select SNMP.
  3. Click Stop.

Unix: Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:


SNMP_Get able to retrieve any Community Name

Risk Level: Low risk vulnerability Low

Check or Attack Name: Snmp Get Any Community
Platforms: SNMP
Description:

No SNMP community name is specified, allowing anyone the ability to receive responses to queries from a system. An attacker can use SNMP to obtain valuable information about a system, such as information on network devices and current open connections.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab.
  3. Select the SNMP Service.
  4. Click Remove and confirm the removal.
  5. Click OK.

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP_Get able to guess Community Name

Risk Level: Low risk vulnerability Low

Check or Attack Name: Snmp Get Guessable Community
Platforms: SNMP
Description:

The SNMP community name is guessable, allowing anyone who can guess the name the ability to receive responses to queries from the system. An attacker can use SNMP to obtain valuable information about the machine, such as information on network devices and current open connections.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab.
  3. Select the SNMP Service.
  4. Click Remove and confirm the removal.
  5. Click OK.

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP_Get able to retrieve Public Community Name

Risk Level: Low risk vulnerability Low

Check or Attack Name: Snmp Get Public Community
Platforms: SNMP
Description:

The SNMP default Public community name is specified, allowing anyone the ability to receive responses to queries from the system if they use this default value. An attacker can use SNMP to obtain valuable information about the machine, such as information on network devices and current open connections.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Remove and confirm the removal.
  4. Click OK.

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP public information

Risk Level: Low risk vulnerability Low

Check or Attack Name: snmp_info
Platforms: SNMP
Description:

SNMP was found. The SNMP Public information may contain sensitive information that can be used to compromise your computer systems.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names. If SNMP is not required, disable the service:

Windows NT:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select SNMP.
  3. Click Stop.

Unix: Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt


SNMP agents can be instructed not to notify management stations

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: SNMPKillAuthTrap
Platforms: SNMP
Description:

Many SNMP agents can be configured to send an SNMP trap or notification to a management station when the agent receives SNMP messages that fail authentication tests.

If the snmpEnableAuthenTraps object can be written, these notifications can be silenced, preventing the agent from issuing notification
Remedy:

Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters. If the agent supports View Access Control, limit the views that the agent may reveal. Follow the agent manufacturer's recommendations for controlling access via SNMP.
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt


SNMP kill interface

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: SNMP kill interface
Platforms: | SNMP
Description: | Some Simple Network Management Protocol (SNMP) agents do not protect against unauthorized write access. This exploit may disable the internal loopback and external network interfaces if the community string is easily guessed.
Remedy: | Set the community string to a value that is hard to guess. Use uppercase, lowercase, and numeric characters.
References: |


NetBIOS information available from SNMP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Snmp - NetBIOS
Platforms: Windows NT
Description:

By default, Windows NT provides information that is normally available only to administrators via the Simple Network Management Protocol (SNMP). If your security policy does not allow publishing information about Windows NT services, users, and shares via a protocol with very minimal security, disable SNMP or this feature.
Remedy:

Disable SNMP if it is not required. If your systems require SNMP, delete the CurrentVersion registry value and choose a community name that is hard to guess.

To remove the SNMP service from Windows NT, follow these steps:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service
  3. Click Remove and confirm the removal.
  4. Click OK.

—OR—

If your security policy requires SNMP:

  • Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents key and delete the SOFTWARE\Microsoft\LANManagerMIB2Agent\CurrentVersion value.

    • WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

    1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
    2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents key.
    3. Highlight the SOFTWARE\Microsoft\LANManagerMIB2Agent\CurrentVersion value.
    4. From the Edit menu, select Delete. Click Yes to confirm the deletion of this value.
  • Remove the public community name and set the SNMP community name to something difficult to guess. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.
    1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
    2. Click the Services tab.
    3. Click the Services tab and select the SNMP Service.
    4. Click Properties to display the SNMP Properties dialog box.
    5. Click the Security tab.
    6. Verify that your configuration contains the following secure settings:
      • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/kb/articles/q99/8/80.asp.)
      • The Accepted Community Names are not default or easily guessed names, such as public.
      • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
      • Each host and community name in the lists is a valid destination.
    7. In addition to securing SNMP from the control panel, you will want to secure it from the Registry.
References:


SNMP_Set used any Community Name to change system information

Risk Level: High risk vulnerability High

Check or Attack Name: Snmp Set Any Community
Platforms: SNMP
Description:

No Simple Network Management Protocol (SNMP) community name is specified, allowing anyone the ability to change the host's system information. An attacker can use SNMP to obtain valuable information about the machine, such as information on network devices and current open connections.

Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Remove and confirm the removal.
  4. Click OK

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP_Set guessed Community Name and changed system information

Risk Level: High risk vulnerability High

Check or Attack Name: Snmp Set Guessable Community
Platforms: SNMP
Description:

The SNMP community name is guessable, and allows anyone who can guess the name the ability to set new system information. An attacker can use SNMP to obtain valuable information about the machine, such as information on network devices and current open connections.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP service.
  3. Click Remove and confirm the removal.
  4. Click OK.

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP_Set used Public Community Name to change system information

Risk Level: High risk vulnerability High

Check or Attack Name: Snmp Set Public Community
Platforms: SNMP
Description:

The SNMP default Public community name is specified, allowing anyone the ability to change the machine's system information if they use this default value. An attacker can use SNMP to obtain valuable information about the machine, such as information on network devices and current open connections.
Remedy:

If you need SNMP for network management, make sure it is properly configured with private community names.

Windows: Below are general directions to identify and remove public names. Detailed information is available from the Microsoft Knowledge Base Article "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Services tab and select the SNMP Service.
  3. Click Properties to display the SNMP Properties dialog box.
  4. Click the Security tab.
  5. Verify that your configuration contains the following secure settings:
    • At least one Accepted Community Name exists. Empty lists cause SNMP to accept requests from anyone. (See Microsoft Knowledge Base Article Q99880, "How to: Configure SNMP security" at http://support.microsoft.com/support/ntserver/serviceware/10140298.asp.)
    • The Accepted Community Names are not easily guessed names, such as public.
    • The Only Accept SNMP Packets from These Hosts option is selected, and one or more IP Host or IPX address are specified.
    • Each host and community name in the lists is a valid destination.
    6. In addition to securing SNMP from the control panel, you will want to secure it from the Registry. See the Windows NT SNMP Community Name topic for more information.

Windows: If SNMP is not required, disable the service:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select the SNMP service.
  3. Click Stop.

Unix: To change the community name, refer to your SNMP documentation.

—OR—

Disable SNMP if it is not needed. If SNMP is started from the rc script, comment it out as appropriate for your operating system.

As an example for disabling SNMP under Solaris 2.6, execute the following commands:

# /etc/init.d/init.snmpdx stop
# mv /etc/rc3.d/S76snmpdx /etc/rc3.d/DISABLED_S76snmpdx
References:

Request for Comment document RFC 1157, A Simple Network Management Protocol (SNMP), ftp://ftp.isi.edu/in-notes/rfc1157.txt

Microsoft Knowledge Base Article Q99880, SNMP Agent Responds to Any Community Name, http://support.microsoft.com/support/kb/articles/q99/8/80.asp sp


SNMP agents reveal information about network interfaces

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SNMPShowInterface
Platforms: | SNMP
Description: | All SNMP agents support the standard MIB-II ifTable. This table contains the IP address and network mask of each interface that the machine supports. This information may be used to learn more about the connections to and from the networked device.
Remedy: | Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters. If the agent supports View Access Control, limit the views that the agent may reveal.
References: | Cisco Systems Product Overview, Simple Network Management Protocol (SNMP), http://www.cisco.com/warp/public/535/3.html


SNMP RMON agents can monitor network and application activity

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SNMPShowRMON
Platforms: | SNMP
Description: | An active Remote Monitoring (RMON) probe can remotely monitor applications, network traffic, and users. Access to the RMON capabilities should be carefully administered.
Remedy: | To properly support your site's security policy, follow the manufacturer's recommendations for configuring an agent that supports RMON queries.
References: |


SNMP agents reveal information about network routing

Risk Level: | Low risk vulnerability Low | Check or Attack Name: SNMPShowRoutes
Platforms: | SNMP
Description: | Many Simple Network Management Protocol (SNMP) agents support the MIB-II standard ipRouteTable. This table contains the IP address, its network mask, the prototype, and the gateway of each route supported by the networked device. This information can be used to learn more about the connections to and from the networked device.
Remedy: | Set the community string to a value that is not easily guessed. Use uppercase, lowercase, and numeric characters. If the agent supports View Access Control, limit the views that the agent may reveal.
References: | Cisco Systems Product Information, Simple Network Management Protocol (SNMP), http://www.cisco.com/warp/public/535/3.html


SMB NetBIOS entire drive available

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Root Share
Platforms: | Windows NT
Description: | NetBIOS allows full access to the entire hard drive. By sharing the entire drive, any new additions to this drive are automatically made available.
Remedy: | Restrict the share to specific directories or require stronger authentication for access.
References: |


File system insecure

Risk Level: Low risk vulnerability Low

Check or Attack Name: insecure file system
Platforms: Windows NT, Windows for Workgroups: 3.11, OS/2, Windows 95
Description:

A NetBIOS share has been found where the underlying file system does not support security. The only security that can be applied to this share is share-level permissions.
Remedy:

If the host is running Windows NT, convert the file system to NTFS using the convert command. If the host dual-boots into Windows 95 or an older version of Windows, you will lose the ability to boot any operating system other than Windows NT.

If the host is running an operating system other than Windows NT and security is desired, upgrade to Windows NT and convert the file system to NTFS.

To convert the file system to NTFS, follow these steps:

Note: If the computer dual-boots into any version of Windows other than Windows NT, you will lose the ability to run that version of Windows. See the Internet Information Server Resource Kit for additional details.

  1. Open a command-line window. From the Windows NT Start menu, select Run. Type cmd and select OK.
  2. Type convert [drive-letter]: at a command line. Substitute the drive letter of the partition you want to convert.
References:


NetBIOS share has no access control

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Open NetBIOS share
Platforms: Windows NT
Description:

A NetBIOS share was found with no access control list. The absence of an access control list permits attackers to access the shared resource (drive).

Remedy:

Correct the share permissions or remove the share.

To set the permissions, follow these steps:

  1. Navigate to the share in Windows Explorer.
  2. Right-click on the share, select Properties to display the Properties dialog box.
  3. From the Sharing tab, review the permissions.
  4. Allow access only to approved users.
  5. Click OK.

—OR—

To remove the share:

  1. Open a command line.
  2. From the Windows NT Start menu, select Run.
  3. Type cmd, then click OK to open the command line.
  4. Type: net share sharename /delete, where sharename is the name of the share.
  5. Type exit to return to the Windows NT desktop.

—OR—

From a remote host, remove the share:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the host. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
  3. Select the share and click Stop Sharing.

In Security Scanner, this vulnerability is raised when the Windows generic file version checker detects a file that is not current.
References:


NetBIOS permutations attack vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: nbperm
Platforms: Windows for Workgroups: 3.11, Windows 95
Description:

A NetBIOS share requiring only a password for validation was detected. As a result, a brute force attempt to log in using up to four character password combinations was successful.

Note: This exploit results in up to 475,254 login attempts, and could run for several hours.

False Negatives: Applying the lm-fix patch will prevent you from accessing a Windows 95 share from a Windows NT machine.
Remedy:

Set the password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. In the Minimum Password Length field, configure the password to at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the User menu, select Properties.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the new password.
  6. Click OK.
References:


NetBIOS share found

Risk Level: Low risk vulnerability Low

Check or Attack Name: NetBIOS share
Platforms: Windows NT, Samba, Windows for Workgroups: 3.11, OS/2, Windows 95
Description:

A NetBIOS share has been detected. If the share already has the proper access controls, this is a low risk vulnerability.
Remedy:

All platforms should either disable sharing or review access controls.

Note: The vulnerability will be flagged if any shares are detected, even if they are not accessible. Windows 95 machines must disable file and print sharing to avoid flagging this vulnerability. If shares are needed and must be secure, consider upgrading to Windows NT running NTFS.

Windows 95: Select one of these choices:

  • Remove file and print sharing.

    1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
    2. From Configuration, click File and Print Sharing.
    3. Disable 'I want to be able to give others access to my files' and disable 'I want to be able to allow others to print to my printer(s).'
    4. Click OK and restart the computer. The Windows 95 machine no longer allows shares to exist or be created.

  • Use user-level access control (does not eliminate vulnerability). To implement user-specific permissions in Windows 95:

    If disabling Windows 95 sharing is unacceptable, you can use user-level access control. This approach does not eliminate reporting for a vulnerability, but it does decrease the risk. Windows 95 permits user-specific permissions if it is part of a domain. Access to the share by password is discouraged because of the possibility of unlimited and unlogged brute force attacks.

    To implement user-specific permissions, follow these steps:

    1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
    2. From the Access Control tab, select User-Level access control.
    3. Type the domain name.
    4. Click OK.

Windows NT: Select one of these options:

  • Grant share access only to approved users.

    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. Click Permissions.
    5. Use these guidelines to review the listed permissions:
      • Remove or change any permissions such as Everyone: Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
      • Review any names with Change or Full Control permissions and determine if the permission is appropriate. Consider using Read Only or No Access if these names do not need to modify items in the share.
      • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

  • To remove a share, choose one of these options:

    • Remove the share from a local computer.

      1. From the local computer, open Windows NT Explorer.
      2. Navigate to the shared folder.
      3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
      4. To disallow access to all users, select the Not Shared check box.

    • Remove the share from a remote computer.

      1. From a remote computer, open the Server Manager.
      2. Select the host name.
      3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
      4. Select the NetBIOS share
      5. Click Stop Sharing.
      6. Click OK.

    • Remove the share from the command line.

      From a command prompt, type: net share sharename /delete
References:


Samba buffer overflow

Risk Level: High risk vulnerability High

Check or Attack Name: Samba Overflow
Platforms: Samba
Description:

The samba NetBIOS service up to 1.9.17p2 contained a buffer overflow vulnerability. A remote attacker can submit a specially-formatted password that exceeds the length expected by Samba and cause the server to execute arbitrary code with root privileges.
Remedy:

This problem was fixed in 1.9.17p3 and later releases. Users should always install the latest version available..
References:

CIAC Information Bulletin H-110, Samba Servers Vulnerability, http://ciac.llnl.gov/ciac/bulletins/h-110.shtml

Samba Project, SAMBA Web Pages, http://www.samba.org/

CERT Vendor-Initiated Bulletin VB-97.10, Security bugfix for Samba, http://www.cert.org/ftp/cert_bulletins/VB-97.10.samba


Samba open share

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Open Samba Share
Platforms: | Unix, Samba
Description: | An accessible Samba share was detected. Accessible shares can be used to possibly gather critical information, or can be used to write files that would be needed for further attacks.
Remedy: | If access is allowed to everyone, edit smb.conf, normally located in /etc or /usr/local/samba. Refer to your Samba documentation for details on share permissions and user configurations.
References: |


NetBIOS share writable

Risk Level: High risk vulnerability High

Check or Attack Name: Writable NetBIOS share
Platforms: Samba, Windows for Workgroups: 3.11, OS/2, Windows 95
Description:

A NetBIOS share has been detected with no password required for write access. In some cases, an attacker can use these shares to gain access to the entire hard disk. Because anyone is allowed write access with no verification of user or password, this issue is considered a high risk vulnerability.
Remedy:

Remove the share.

Windows: Remove the share using one of the following options:

  • Remove the share from a local computer.
    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. To disallow access to all users, select the Not Shared check box.
  • Remove the share from a remote computer.
    1. From a remote computer, open the Server Manager.
    2. Select the host name from the list.
    3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
    4. Select the NetBIOS share
    5. Click Stop Sharing.
  • Remove the share from the command line. From a command prompt, type: net share sharename /delete

Other Operating Systems: Enable some form of access control as described in your OS documentation.
References:


Password cache files accessible

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: nbsmbpwl
Platforms: Windows for Workgroups: 3.11, Windows 95
Description:

Windows 95, Windows for Workgroups, and DOS network clients cache passwords on the hard drive in files with the .PWL file extension. These password cache files are weakly encrypted and easily broken, and must not be accessible on a shared file system. In updated or patched versions of Windows 95, the encryption is stronger.
Remedy:

Turn off file sharing on the host if it is not needed, or restrict sharing to the parts of the drive that are necessary to be shared. Apply the latest service patches for your operating system.

Windows 95: Remove file and print sharing. To remove file and print sharing from Windows 95:

  1. Open the Network control panel.
  2. From Configuration, click File and Print Sharing.
  3. Disable 'I want to be able to give others access to my files.' and disable 'I want to be able to allow others to print to my printer(s).'
  4. Click OK and restart the computer. The Windows 95 machine no longer allows shares to exist or be created.

Windows NT: Perform the following actions:

Apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—AND—

Remove unnecessary shares. Choose one of these options:

  • Remove the share from a local computer:
    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. To disallow access to all users, select the Not Shared check box.
    5. Click OK.
  • Remove the share from a remote computer:
    1. From a remote computer, open the Server Manager.
    2. Select the host name from the list.
    3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
    4. Select the NetBIOS share.
    5. Click Stop Sharing.
    6. Click OK.
  • Remove the share from the command line. From a command prompt, type: net share sharename /delete
References:

The NT Shop, Windows Client Password Caching Problems, http://www.ntsecurity.net/security/pswcache.htm


Apache cookies buffer overflow

Risk Level: | High risk vulnerability High | Check or Attack Name: Apache cookie
Platforms: | Apache
Description: | The Apache web server has an optional module mod_cookies that contains a vulnerability allowing a remote attacker to overflow an internal buffer in the web server and execute arbitrary bytecode on the web server machine. The mod_cookies module is compiled into the web server, and is not installed by default in any versions of Apache. Apache web servers up to v1.1.1 may be vulnerable to this overflow, if this module has been compiled into the server.
Remedy: | This vulnerability only affects sites running Apache 1.1.1 or below with the cookies modules compiled into the server. This hole was fixed in Apache 1.1.3 and later versions, and users should upgrade to the latest release available.
References: | Apache Server Project Web Site, Security Release: Apache 1.1.3, http://www.apache.org/113announce.html Network Associates, Inc. Security Advisory #2, Vulnerabilities in the Apache httpd, http://www.nai.com/nai_labs/asp_set/advisory/02_apachemod_adv.asp


Root dot dot

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: rootdotdot
Platforms: NCSA Servers: Old
Description:

A directory listing was obtained of the directory above the root directory of the web server. A URL of the form http://www.domain.com/..\.. allows anyone to browse and download files outside of the web server content root directory. URLs such as http://www.domain.com/scripts..\..\script-name allow you to execute the target script. An attacker can use a listing of this directory as additional information for planning a structured attack, or could download files elsewhere in the file system.
Remedy:

Check with the vendor and documentation of your web server software for information on the correct configuration. If necessary, install a more recent (and secure) version of the web server.

The latest version of Microsoft Internet Information Server (IIS) is available at http://www.microsoft.com/iis.
References:


IIS ASP dot bug

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Aspdot check
Platforms: IIS: 3.0 and earlier
Description:

This version of Microsoft Internet Information Server (IIS) displays the source to active server pages (.asp files), if a period is appended to the URL. Scripting information, in addition to other data in the file, is visible.

Potentially proprietary web server files (such as .ASP, .HTX, and .IDC file name extensions) may contain sensitive information (such as user IDs and passwords) embedded in the source code but not normally available to remote users.
Remedy:

Upgrade to latest version of Microsoft Internet Information Server at http://www.microsoft.com/iis. If upgrading to the latest version is not possible, download and apply the iis-fix patch.

To download and install the patch, follow these steps:

  1. Open a web browser.
  2. Go to ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp2/iis-fix.
  3. Read the notices prior to installation by clicking on them.
  4. Download the IISFIX.EXE patch to your system by selecting it.
  5. Locate and execute the file you just downloaded to your system.
  6. Follow the instructions to install the patch.

Temporary Fix: Disable read permissions for the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, segregate them immediately. ASP files should be treated as any other web-based executable and kept in separate directories where permissions can be adjusted.
References:

Microsoft Knowledge Base Article Q163485, Active Server Pages Script Appears in Browser, http://support.microsoft.com/support/kb/articles/q163/4/85.asp p

Microsoft Knowledge Base Article Q163485, Active Server Pages Script Appears in Browser, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postsp2/iis-fix/Q163485.txt t40/hotfixes-postSP2/iis-fix/Q163485.txt.

BUGTRAQ Mailing List, Paul Leach (paulle@MICROSOFT.COM), Re: Major Security Hole in MS ASP, http://geek-girl.com/bugtraq/1997_1/0197.html

BUGTRAQ Mailing List, Mark Joseph Edwards (mark@NTSHOP.NET), Major Security Hole in MS ASP, http://geek-girl.com/bugtraq/1997_1/0191.html

The NT Shop, Microsoft IIS and Active Server Advisory, http://www.ntsecurity.net/security/asp-files.htm


IIS ASP dot bug

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: aspsource
Platforms: Windows NT
Description:

This version of Microsoft Internet Information Server (IIS) displays the source to active server pages (.asp files), if a period is appended to the URL. Scripting information, in addition to other data in the file, is visible.

Potentially proprietary web server files (such as .ASP, .HTX, and .IDC file name extensions) may contain sensitive information (such as user IDs and passwords) embedded in the source code but not normally available to remote users.
Remedy:

Upgrade to the latest version of Microsoft IIS at http://www.microsoft.com/iis.

—OR—

If upgrading to the latest version is not possible, download the patch provided by Microsoft from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp2/iis-fix.

Temporary Fix: Disable read permissions for the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, segregate them immediately. ASP files should be treated as any other web-based executable and kept in separate directories where permissions can be adjusted.
References:

Microsoft Knowledge Base Article Q163485, Active Server Pages Script Appears in Browser, http://support.microsoft.com/support/kb/articles/q163/4/85.asp

Microsoft Knowledge Base Article Q164059, IIS Execution File Text Can Be Viewed in Client, http://support.microsoft.com/support/kb/articles/q164/0/59.asp

Microsoft Internet Information Server Home Page, Microsoft Windows NT Server Web Services, http://www.microsoft.com/iis/default.asp

BUGTRAQ Mailing List, Paul Leach (paulle@MICROSOFT.COM), Re: Major Security Hole in MS ASP, http://geek-girl.com/bugtraq/1997_1/0197.html

BUGTRAQ Mailing List, Mark Joseph Edwards (mark@NTSHOP.NET), Major Security Hole in MS ASP, http://geek-girl.com/bugtraq/1997_1/0191.html

The NT Shop, Microsoft IIS and Active Server Advisory, http://www.ntsecurity.net/security/asp-files.htm

Microsoft Knowledge Base Article Q163485, Active Server Pages Script Appears in Browser, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/iis-fix/Q163485.txt

Microsoft Knowledge Base Article Q164059, IIS Execution File Text Can Be Viewed in Client, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/iis-fix/Q164059.txt


Win32 web servers could allow remote command execution through .CMD and .BAT files

Risk Level: | High risk vulnerability High | Check or Attack Name: iiscmd
Platforms: | IIS: 1.0
Description: | The Microsoft Internet Information Server (IIS) 1.0 contains a vulnerability that allows a remote attacker to execute commands on the server via .BAT and .CMD files. It is believed this hole affects other servers, in addition to IIS. Contact your vendor for more information.
Remedy: | Disable IIS' ability to map .BAT and .CMD to the Windows NT Command Interpreter. If this is not an option, obtain the applicable patch for this vulnerability or upgrade IIS to the latest version.
References: | Microsoft Knowledge Base Article Q148188, Internet Information Server Security .CMD /.BAT Patch, http://support.microsoft.com/support/kb/articles/q148/1/88.asp


Web server directories without an index file

Risk Level: | Low risk vulnerability Low | Check or Attack Name: noindex
Platforms: | HTTP
Description: | One or more web server directories were detected without an index.html file. An attacker can gather information on the content of web server directories, if a directory does not contain an index of HTML documents.
Remedy: | Verify all subdirectories at the web server root directory possess index.html files.
References: |


Novell Convert.bas web server script vulnerability

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Convert Check
Platforms: | Novell Web Server: 1.0, Common Gateway Interface (CGI)
Description: | The convert.bas program contains a vulnerability that allows a remote attacker to read any file on the web server. This program is included as part of the default installation of some versions of the Novell HTTP server.
Remedy: | Remove the convert.bas program from the scripts directory of your web server.
References: | Best-of-Security Mailing List, Novell HTTP insecure out of the box, http://www.njh.com/latest/9607/960704-01.html


HTTP basic authorization password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: httppassword
Platforms: Any
Description:

The WWW resource was found to be vulnerable. Default accounts or easily guessable passwords can give an attacker access to sensitive information.
Remedy:

Disable the account or change the password to something difficult to guess.

Unix: Disable login access to this Unix account if it is not needed:

  1. Edit the /etc/passwd file.
  2. Locate the account.
  3. Place an * (asterisk) in the password field.
  4. Place the string /bin/false in the shell field. An example of the /etc/passwd entry for a disabled guest account should resemble the following: guest:*:2311:50:Guest User:/home/guest:/bin/false
  5. Save and exit the file.

Windows: Select one of these choices:

  • Change the password on this account to something difficult to guess:

    1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
    2. Double-click the account to display the User Properties dialog box.
    3. To change the password to something difficult to guess, type and confirm the new password.
    4. Click OK.

    • —OR—

  • Disable login access to this Windows account:

    1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
    2. Double-click the account to display the User Properties dialog box.
    3. To disable the account, select the Account Disabled check box.
    4. Click OK.
References:


HTTP (WWW server) port active

Risk Level: | High risk vulnerability High | Check or Attack Name: httpd
Platforms: | NCSA Servers: Old
Description: | An NCSA V1.3 httpd web server or earlier version was detected. These versions of NCSA allow attackers to remotely execute commands.
Remedy: | Unix: Update to the newest version of httpd. Make sure httpd is configured to run as nobody instead of root. If possible, chroot http to a restricted file area.
References: | CERT Advisory CA-95.04, NCSA HTTP Daemon for UNIX Vulnerability, http://www.cert.org/advisories/CA-95.04.NCSA.http.daemon.for.unix.vulnerability.html


ScriptAlias directive allows remote CGI script access

Risk Level: | Low risk vulnerability Low | Check or Attack Name: ScriptAlias
Platforms: | NCSA Servers: Old, Apache
Description: | The ScriptAlias directive creates a virtual directory on your server. Any accesses to that virtual directory will be satisfied by returning the output of a CGI server script in that directory. Configuring a web server with a ScriptAlias Directive specifying a directory under DocumentRoot can open a vulnerability on some web servers, allowing a remote attacker to view the source of CGI scripts on the web server. This action may allow a remote attacker to gain access to proprietary CGI code or more easily determine vulnerabilities in existing CGI scripts on a machine. All versions of Apache prior to 1.0 and NCSA prior to and including version 1.5 are affected.
Remedy: | Affected sites should move ScriptAlias directories out of the DocumentRoot or upgrade your server to a version that securely handles ScriptAlias directives.
References: | NCSA HTTPd Development Team, ScriptAlias directive, http://httpd.ncsa.uiuc.edu/docs/setup/srm/ScriptAlias.html


IRIX handler CGI allows remote command execution

Risk Level: High risk vulnerability High

Check or Attack Name: Handler Check
Platforms: IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI)
Description:

The handler cgi-bin program contains a vulnerability that allows a remote attacker to execute arbitrary commands on a web server running a vulnerable version of the program. The handler program is part of the Outbox Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. Older versions of IRIX may have this package optionally installed.

Remedy:

Disable the scripts included with the IRIX Outbox Environment Subsystem and obtain the patch(es) made available by SGI.

To disable the scripts, follow these steps:

  • Log in as root on the vulnerable machine and type: # /bin/chmod 400 /var/www/cgi-bin/handler (assuming default install path of /var/www)
  • Log in as root on the vulnerable machine and remove the outbox subsystem: # /usr/sbin/versions -v remove outbox

Patches: Patches are available from ftp://sgigate.sgi.com/Patches for the following versions:

IRIX 5.3: #2315 available from ftp://sgigate.sgi.com/Patches/5.3/patch2315.tar.
IRIX 6.0.x: Upgrade system or use temporary fix.
IRIX 6.1: Upgrade system or use temporary fix.
IRIX 6.2: #2314 available from ftp://sgigate.sgi.com/Patches/6.2/patch2314.tar.
IRIX 6.3: #2338 available from ftp://sgigate.sgi.com/Patches/6.3/patch2338.tar.
IRIX 6.4: #2338 available from ftp://sgigate.sgi.com/Patches/6.4/patch2338.tar.
References:

Silicon Graphics Inc. Security Advisory 19970501-02-PX, IRIX webdist.cgi, handler and wrap programs, ftp://sgigate.sgi.com/security/19970501-02-PX


SGI Webdist CGI script allows remote command execution

Risk Level: High risk vulnerability High

Check or Attack Name: Webdist
Platforms: IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI)
Description:

The webdist.cgi program contains a vulnerability that allows a remote attacker to execute arbitrary commands on a remote machine with the privileges of the user owning the server process. The webdist program is part of the Outbox Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. Older versions of IRIX may have this package optionally installed.
Remedy:

Disable the scripts included with the IRIX Outbox Environment Subsystem and obtain the patch(es) made available by SGI.

You can temporarily change permissions until the patch is applied:

  1. Become the root user on the system.
  2. Change the permissions on the programs by typing:
    /bin/chmod 400 /var/www/cgi-bin/webdist.cgi
    /bin/chmod 400 /var/www/cgi-bin/handler
    /bin/chmod 400 /var/www/cgi-bin/wrap
    By changing the permissions on these programs as above, these programs cannot be executed by any user.
References:

Silicon Graphics Inc. Security Advisory 19970501-02-PX, IRIX webdist.cgi, handler and wrap programs, ftp://sgigate.sgi.com/security/19970501-02-PX

AUSCERT Advisory AA-97.14, SGI IRIX webdist.cgi Vulnerability, ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-97.14.SGI.webdist.cgi.vul

Silicon Graphics Inc. Security Advisory 19970501-01-A, Vulnerability in webdist.cgi, ftp://sgigate.sgi.com/security/19970501-01-A

CERT Advisory CA-97.12, Vulnerability in webdist.cgi, http://www.cert.org/advisories/CA-97.12.webdist.html


SGI IRIX cgi-bin wrap directory listing vulnerability

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: Wrap Check
Platforms: | IRIX: 5.3, IRIX: 6.0.1, IRIX: 6.1, IRIX: 6.2, IRIX: 6.3, IRIX: 6.4, IRIX: 6.0, Common Gateway Interface (CGI)
Description: | The wrap CGI program contains a vulnerability that allows a remote attacker to obtain a listing of files on the server. The information gleaned from this exploit could be used in later attacks. The wrap program is part of the Outbox Environment Subsystem for IRIX, installed by default on all SGI systems running IRIX 6.2 or newer. Older versions of IRIX may have this package optionally installed.
Remedy: | Disable the scripts included with the IRIX Outbox Environment Subsystem and obtain the patch(es) made available by SGI.
References: | Silicon Graphics Inc. Security Advisory 19970501-02-PX, IRIX webdist.cgi, handler and wrap programs, ftp://sgigate.sgi.com/security/19970501-02-PX


HTTP server with unresolvable local links

Risk Level: | Low risk vulnerability Low | Check or Attack Name: unreslink
Platforms: | HTTP
Description: | An unresolved link was detected. Web browsers will receive an error when accessing this link. This issue does not indicate a serious vulnerability, and is only noted as a courtesy.
Remedy: | Notify your Webmaster, since this dead link represents a bug in the web page.
References: |


WebGais websendmail allows remote command execution

Risk Level: High risk vulnerability High

Check or Attack Name: Websendmail
Platforms: WEBGais, Common Gateway Interface (CGI)
Description:

The websendmail program allows a remote attacker to execute arbitrary commands on vulnerable systems. Websendmail is a cgi-bin program that comes with the WEBgais package. WEBgais is a collection of CGI gateway programs, which incorporate the Global Area Intelligent Search (GAIS) index/query system so that it can be used as a search engine in WWW information servers. Websendmail reads input from a form and sends e-mail to the specified destination. Versions of WEBgais up to v1.0b2 are vulnerable.
Remedy:

Temporary Fix: As root on the vulnerable machine, type: # /bin/chmod 400 /usr/local/etc/httpd/cgi-bin/websendmail (replace with your cgi-bin directory as appropriate).

Patches: No patches are available as of December 1998. You should disable websendmail with the temporary fix.
References:

BUGTRAQ Mailing List, Vulnerability in websendmail, http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.3.95.970704113121.1475A-100000@pop3.kappa.ro


WebSite 1.1 uploader vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: Uploader
Platforms: O'Reilly Website: 2.0 and earlier, Common Gateway Interface (CGI)
Description:

The uploader.exe program included as part of the WebSite 1.1 web server allows a remote attacker to upload a file to the cgi-win directory of the web server, which may then possibly be executed. The uploader.exe program is installed by default in the cgi-win directory of the O'Reilly WebSite web server. WebSite software prior to v1.1g and v2.0 beta are vulnerable, but the 2.0 release is not vulnerable.
Remedy:

Delete the uploader.exe file and obtain a patch from O'Reilly. You should upgrade to WebSite 2.0 or greater.
References:

O'Reilly Software, WebSite and WebSite Professional Updates, http://software.ora.com/techsupport/software/support_library_ws_frame.html

O'Reilly Software, Uploader Security Fix, ftp://ftp.software.ora.com/pub/techsupport/software/uploader.zip


WebSite 1.1 for Windows NT winsample vulnerability

Risk Level: High risk vulnerability High

Check or Attack Name: WinSample
Platforms: O'Reilly Website: 2.0 and earlier, Common Gateway Interface (CGI)
Description:

The win-c-sample.exe program included with O'Reilly WebSite versions previous to 2.0 contains a buffer overflow that could allow a remote attacker to execute arbitrary commands on the server. The commands will be executed with the privileges of the user owning the server process.
Remedy:

Remove the win-c-sample.exe program from the CGI-SHL directory and upgrade to the latest version of WebSite.
References:

O'Reilly Software, WebSite and WebSite Professional Updates, http://software.ora.com/techsupport/software/support_library_ws_frame.html

The NT Shop, WebSite v1.1e for Windows NT and '95 vulnerable in the example CGI programs, http://www.ntsecurity.net/security/website.htm


IIS ASP DATA bug in Windows NT-based web servers

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: DATA bug
Platforms: IIS: 2.0, IIS: 3.0, IIS: 4.0, IIS: 1.0
Description:

Microsoft's Internet Information Server (IIS) contains a vulnerability in how it handles the multiple data streams NTFS provides for each file. By appending the string ::$DATA, a remote user could view the contents of a file that is normally set to be acted upon by an Application Mapping, such as Active Server Pages (ASP). The attacker, however, must previously have read access to this file to view its contents.
Remedy:

Users of IIS previous to 3.0 should upgrade to a more recent version (3.0 or 4.0). The following hotfixes have been made available for IIS 3.0 and 4.0:

  • IIS 3.0 (Intel x86) hotfix, /iis3-datafix/iis3fixi.exe
  • IIS 3.0 (Alpha) hotfix, /iis3-datafix/iis3fixa.exe
  • IIS 4.0 (Intel x86) hotfix, /iis4-datafix/iis4fixi.exe
  • IIS 4.0 (Alpha) hotfix, /iis4-datafix/iis4fixa.exe
References:

Microsoft Security Bulletin MS98-003, File Access Issue with Windows NT Internet Information Server (IIS), http://www.microsoft.com/security/bulletins/ms98-003.asp

Microsoft Knowledge Base Article Q188806, ::$DATA Data Stream Name of a File May Return Source, http://support.microsoft.com/support/kb/articles/q188/8/06.asp

NTBUGTRAQ Mailing List, ASP vulnerability with Alternate Data Streams, http://www.ntbugtraq.com/page_archives_wa.asp?A2=ind9807&L=NTBUGTRAQ&P=R428

Allaire Security Bulletin ASB99-03, ASB99-03: Microsoft Internet Information Server Exposure of Source Code with '::$DATA', http://www.allaire.com/handlers/index.cfm?ID=8729&Method=Full


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 97 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Browser
Zone Active X execution | Zone ActiveX execution
Zone active scripting | Zone active scripting
Zone auto authenticate | Zone auto user authentication
Zone desktop install | Zone desktop install
Zone file download | Zone file download
Zone file launch | Zone file launch
Zone java scripting | Zone Java scripting
Zone low channel permissions | Zone low channel permissions
Zone low java permissions | URL Security Zone low Java permissions
Zone non-secure form submission | Zone non-secure form submission
Zone safe scripting enabled | Zone ActiveX safe scripting enabled
Zone signed download | Zone signed ActiveX download
Zone unsafe scripting enabled | Zone scripting of unsafe ActiveX controls
Zone unsigned download | URL security zone unsigned ActiveX download
DCOM
DCOM | DCOM is enabled
DCOM Access Permission | DCOM access permission incorrect
DCOM Auth Level | DCOM default authentication level
DCOM Config Writable | DCOM configuration writable
DCOM Default Access | DCOM default access
DCOM Default Launch | DCOM default launch
DCOM Launch Permission | DCOM launch permission incorrect
DCOM RunAs | DCOM RunAs value altered
Daemons
SybaseDetectTCP Database service detected via TCP
E-mail
ExchangeAnonIMAP Exchange anonymous IMAP allowed
LDAP
LDAP Config | LDAP config information available
LDAP Exchange Overflow | LDAP Exchange overflow crashes LDAP server
LDAP NullBase | LDAP null base returns information
LDAP NullBind | LDAP anonymous access to directory
LDAP NullSubtree | LDAP null subtree allows user to gain information
LDAP Schema | LDAP schema information gathering
LDAP monitor | LDAP monitor information gathering
NT Patches
IIS CGI Overflow | IIS can be remotely crashed by excessively long client requests
MsrpcLsaLookupnamesDos | Windows NT Local Security Authority (LSA) can be remotely crashed, requiring a system reboot
NT Help Overflow | Windows NT 4.0 help file utility contains a locally exploitable buffer overflow
NT RAS Overflow | Windows NT RAS client contains an exploitable buffer overflow
NT SNMPAgent Leak | Windows NT SNMP agent has a serious memory leak
NTKnownDLLsList | Windows NT 4.0 domain caching feature can be exploited to gain administrator privileges
NTSP4AuthError | Windows NT 4.0 SP4 could allow null passwords to be used for access
NTScreenSaver | Windows NT screen saver can be used to compromise admin privileges
NTginaPaste | Windows NT gina flaw allows some clipboard text to be revealed
NTnprpcDoS | Windows NT RPC services can be used to deplete system resources
NtCsrssDos | Windows NT CSRSS denial of service attack
NtMalformedImageHeader | Windows NT can be crashed by executables containing malformed image headers
RRASIncomingStop | RRAS under stress stops responding to incoming calls
RRASPasswordFix | RRAS caches security credentials when using Dial-up Networking client
Snork DoS | Windows NT "snork" attack can disable machines
Network Sniffers
NetXRay3Probe | NetXRay 3.x probe detect
NetXRay3ProbeNoPass | NetXRay 3.x probe unpassworded
RPC
ToolTalk Overflow | CDE rpc.ttdbserver daemon allows remote root access
irixfam | FAM server lists files on IRIX systems
Router/Switch
SNMPCiscoPingball | Cisco equipment can be used to send ICMP pings via SNMP
SNMPCiscoRTTMONKill | Cisco SNMP agent can be instructed to shut down the RTT monitor service
SNMPRMONGetEventCommunityStrings | Cisco SNMP agent can reveal event community strings
SNMP
NT Delete Records | WINS records deletion via SNMP
NT Wins Dump | Windows NT/WINS exploit using SNMP
SNMP Community | SNMP community name is world readable by default
SNMP kill interface | SNMP kill interface
SNMPKillAuthTrap | SNMP agents can be instructed not to notify management stations
SNMPShowInterface | SNMP agents reveal information about network interfaces
SNMPShowRMON | SNMP RMON agents can monitor network and application activity
SNMPShowRoutes | SNMP agents reveal information about network routing
Snmp - NetBIOS | NetBIOS information available from SNMP
Snmp Get Any Community | SNMP_Get able to retrieve any Community Name
Snmp Get Guessable Community | SNMP_Get able to guess Community Name
Snmp Get Public Community | SNMP_Get able to retrieve Public Community Name
Snmp Set Any Community | SNMP_Set used any Community Name to change system information
Snmp Set Guessable Community | SNMP_Set guessed Community Name and changed system information
Snmp Set Public Community | SNMP_Set used Public Community Name to change system information
snmp_comm | SNMP server configured without communities
snmp_info | SNMP public information
Shares
NetBIOS share | NetBIOS share found
Open NetBIOS share | NetBIOS share has no access control
Open Samba Share | Samba open share
Root Share | SMB NetBIOS entire drive available
Samba Overflow | Samba buffer overflow
Writable NetBIOS share | NetBIOS share writable
insecure file system | File system insecure
nbperm | NetBIOS permutations attack vulnerability
nbsmbpwl | Password cache files accessible
NT Patches
Apache cookie | Apache cookies buffer overflow
Aspdot check | IIS ASP dot bug
Convert Check | Novell Convert.bas web server script vulnerability
DATA bug | IIS ASP DATA bug in Windows NT-based web servers
Handler Check | IRIX handler CGI allows remote command execution
ScriptAlias | ScriptAlias directive allows remote CGI script access
Uploader | WebSite 1.1 uploader vulnerability
Webdist | SGI Webdist CGI script allows remote command execution
Websendmail | WebGais websendmail allows remote command execution
WinSample | WebSite 1.1 for Windows NT winsample vulnerability
Wrap Check | SGI IRIX cgi-bin wrap directory listing vulnerability
aspsource | IIS ASP dot bug
httpd | HTTP (WWW server) port active
httppassword | HTTP basic authorization password guessed
iiscmd | Win32 web servers could allow remote command execution through .CMD and .BAT files
noindex | Web server directories without an index file
rootdotdot | Root dot dot
unreslink | HTTP server with unresolvable local links


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 97 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
Apache cookie | Apache cookies buffer overflow
Handler Check | IRIX handler CGI allows remote command execution
LDAP Exchange Overflow | LDAP Exchange overflow crashes LDAP server
NT Help Overflow | Windows NT 4.0 help file utility contains a locally exploitable buffer overflow
NT RAS Overflow | Windows NT RAS client contains an exploitable buffer overflow
NTKnownDLLsList | Windows NT 4.0 domain caching feature can be exploited to gain administrator privileges
NTSP4AuthError | Windows NT 4.0 SP4 could allow null passwords to be used for access
NTScreenSaver | Windows NT screen saver can be used to compromise admin privileges
Samba Overflow | Samba buffer overflow
Snmp Set Any Community | SNMP_Set used any Community Name to change system information
Snmp Set Guessable Community | SNMP_Set guessed Community Name and changed system information
Snmp Set Public Community | SNMP_Set used Public Community Name to change system information
ToolTalk Overflow | CDE rpc.ttdbserver daemon allows remote root access
Uploader | WebSite 1.1 uploader vulnerability
Webdist | SGI Webdist CGI script allows remote command execution
Websendmail | WebGais websendmail allows remote command execution
WinSample | WebSite 1.1 for Windows NT winsample vulnerability
Writable NetBIOS share | NetBIOS share writable
httpd | HTTP (WWW server) port active
httppassword | HTTP basic authorization password guessed
iiscmd | Win32 web servers could allow remote command execution through .CMD and .BAT files
nbperm | NetBIOS permutations attack vulnerability
Low
DCOM | DCOM is enabled
ExchangeAnonIMAP | Exchange anonymous IMAP allowed
NTginaPaste | Windows NT gina flaw allows some clipboard text to be revealed
NetBIOS share | NetBIOS share found
NtMalformedImageHeader | Windows NT can be crashed by executables containing malformed image headers
RRASIncomingStop | RRAS under stress stops responding to incoming calls
SNMP Community | SNMP community name is world readable by default
SNMPCiscoRTTMONKill | Cisco SNMP agent can be instructed to shut down the RTT monitor service
SNMPShowInterface | SNMP agents reveal information about network interfaces
SNMPShowRMON | SNMP RMON agents can monitor network and application activity
SNMPShowRoutes | SNMP agents reveal information about network routing
ScriptAlias | ScriptAlias directive allows remote CGI script access
Snmp Get Any Community | SNMP_Get able to retrieve any Community Name
Snmp Get Guessable Community | SNMP_Get able to guess Community Name
Snmp Get Public Community | SNMP_Get able to retrieve Public Community Name
SybaseDetectTCP | Database service detected via TCP
Zone active scripting | Zone active scripting
Zone auto authenticate | Zone auto user authentication
Zone desktop install | Zone desktop install
Zone file download | Zone file download
Zone file launch | Zone file launch
Zone java scripting | Zone Java scripting
Zone low channel permissions | Zone low channel permissions
Zone non-secure form submission | Zone non-secure form submission
Zone safe scripting enabled | Zone ActiveX safe scripting enabled
Zone signed download | Zone signed ActiveX download
insecure file system | File system insecure
irixfam | FAM server lists files on IRIX systems
noindex | Web server directories without an index file
snmp_comm | SNMP server configured without communities
snmp_info | SNMP public information
unreslink | HTTP server with unresolvable local links
High
Aspdot check | IIS ASP dot bug
Convert Check | Novell Convert.bas web server script vulnerability
DATA bug | IIS ASP DATA bug in Windows NT-based web servers
DCOM Access Permission | DCOM access permission incorrect
DCOM Auth Level | DCOM default authentication level
DCOM Config Writable | DCOM configuration writable
DCOM Default Access | DCOM default access
DCOM Default Launch | DCOM default launch
DCOM Launch Permission | DCOM launch permission incorrect
DCOM RunAs | DCOM RunAs value altered
IIS CGI Overflow | IIS can be remotely crashed by excessively long client requests
LDAP Config | LDAP config information available
LDAP NullBase | LDAP null base returns information
LDAP NullBind | LDAP anonymous access to directory
LDAP NullSubtree | LDAP null subtree allows user to gain information
LDAP Schema | LDAP schema information gathering
LDAP monitor | LDAP monitor information gathering
MsrpcLsaLookupnamesDos | Windows NT Local Security Authority (LSA) can be remotely crashed, requiring a system reboot
NT Delete Records | WINS records deletion via SNMP
NT SNMPAgent Leak | Windows NT SNMP agent has a serious memory leak
NT Wins Dump | Windows NT/WINS exploit using SNMP
NTnprpcDoS | Windows NT RPC services can be used to deplete system resources
NetXRay3Probe | NetXRay 3.x probe detect
NetXRay3ProbeNoPass | NetXRay 3.x probe unpassworded
NtCsrssDos | Windows NT CSRSS denial of service attack
Open NetBIOS share | NetBIOS share has no access control
Open Samba Share | Samba open share
RRASPasswordFix | RRAS caches security credentials when using Dial-up Networking client
Root Share | SMB NetBIOS entire drive available
SNMP kill interface | SNMP kill interface
SNMPCiscoPingball | Cisco equipment can be used to send ICMP pings via SNMP
SNMPKillAuthTrap | SNMP agents can be instructed not to notify management stations
SNMPRMONGetEventCommunityStrings | Cisco SNMP agent can reveal event community strings
Snmp - NetBIOS | NetBIOS information available from SNMP
Snork DoS | Windows NT "snork" attack can disable machines
Wrap Check | SGI IRIX cgi-bin wrap directory listing vulnerability
Zone Active X execution | Zone ActiveX execution
Zone low java permissions | URL Security Zone low Java permissions
Zone unsafe scripting enabled | Zone scripting of unsafe ActiveX controls
Zone unsigned download | URL security zone unsigned ActiveX download
aspsource | IIS ASP dot bug
nbsmbpwl | Password cache files accessible
rootdotdot | Root dot dot