List of PlugIn IDs

Plugin ID: 24260

HyperText Transfer Protocol (HTTP) Information

Synopsis
Some information about the remote HTTP configuration can be extracted.

List of Hosts

192.168.0.40

Plugin Output

Protocol version : HTTP/1.1
SSL : no
Keep-Alive : yes
Options allowed : (Not implemented)
Headers :

Date: Fri, 27 Jan 2012 11:13:30 GMT
Server: Apache/2.2.16 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 2608
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

Description
This test gives some information about the remote HTTP protocol - the
version used, whether HTTP Keep-Alive and HTTP pipelining are enabled,
etc...

This test is informational only and does not denote any security
problem.

Solution
n/a

Risk Factor
None

Plugin ID: 19506

Nessus Scan Information

Synopsis
Information about the Nessus scan.

List of Hosts

192.168.0.40

Plugin Output
Information about this scan :

Nessus version : 4.4.1
Plugin feed version : 201201250536
Type of plugin feed : HomeFeed (Non-commercial use only)
Scanner IP : 192.168.0.27
Port scanner(s) : nessus_syn_scanner
Port range : default
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report Verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
CGI scanning : disabled
Web application tests : disabled
Max hosts : 80
Max checks : 5
Recv timeout : 5
Backports : Detected
Scan Start Date : 2012/1/27 18:11
Scan duration : 140 sec

Description
This script displays, for each tested host, information about the
scan itself :

- The version of the plugin set
- The type of plugin feed (HomeFeed or ProfessionalFeed)
- The version of the Nessus Engine
- The port scanner(s) used
- The port range scanned
- Whether credentialed or third-party patch management
checks are possible
- The date of the scan
- The duration of the scan
- The number of hosts scanned in parallel
- The number of checks done in parallel

Solution
n/a

Risk Factor
None

Plugin ID: 25220

TCP/IP Timestamps Supported

Synopsis
The remote service implements TCP timestamps.

List of Hosts

192.168.0.40

Description
The remote host implements TCP timestamps, as defined by RFC1323. A
side effect of this feature is that the uptime of the remote host can
sometimes be computed.

Solution
n/a

See also
http://www.ietf.org/rfc/rfc1323.txt

Risk Factor
None

Plugin ID: 10267

SSH Server Type and Version Information

Synopsis
An SSH server is listening on this port.

List of Hosts

192.168.0.40

Plugin Output

SSH version : SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu6
SSH supported authentication : publickey,password

Description
It is possible to obtain information about the remote SSH
server by sending an empty authentication request.

Solution
n/a

Risk Factor
None

Plugin ID: 10107

HTTP Server Type and Version

Synopsis
A web server is running on the remote host.

List of Hosts

192.168.0.40

Plugin Output
The remote web server type is :

Apache/2.2.16 (Ubuntu)

You can set the directive 'ServerTokens Prod' to limit the information
emanating from the server in its response headers.

Description
This plugin attempts to determine the type and the version of the
remote web server.

Solution
n/a

Risk Factor
None

Plugin ID: 54615

Device Type

Synopsis
It is possible to guess the remote device type.

List of Hosts

192.168.0.40

Plugin Output
Remote device type : general-purpose
Confidence level : 95

Description
Based on the remote operating system, it is possible to determine
what the remote system type is (eg: a printer, router, general-purpose
computer, etc).

Solution
n/a

Risk Factor
None

Plugin ID: 43111

HTTP Methods Allowed (per directory)

Synopsis
This plugin determines which HTTP methods are allowed on various CGI directories.

List of Hosts

192.168.0.40

Plugin Output
Based on the response to an OPTIONS request :

- HTTP methods GET HEAD OPTIONS POST are allowed on :

/

Description
By calling the OPTIONS method, it is possible to determine which HTTP
methods are allowed on each directory.

As this list may be incomplete, the plugin also tests - if 'Thorough
tests' are enabled or 'Enable web applications tests' is set to 'yes'
in the scan policy - various known HTTP methods on each directory and
considers them as unsupported if it receives a response code of 400,
403, 405, or 501.

Note that the plugin output is only informational and does not
necessarily indicate the presence of any security vulnerabilities.

Solution
n/a

Risk Factor
None

Plugin ID: 39520

Backported Security Patch Detection (SSH)

Synopsis
Security patches are backported.

List of Hosts

192.168.0.40

Plugin Output
Give Nessus credentials to perform local checks.

Description
Security patches may have been 'back ported' to the remote SSH server
without changing its version number.

Banner-based checks have been disabled to avoid false positives.

Note that this test is informational only and does not denote any
security problem.

Solution
N/A

See also
http://www.nessus.org/u?d636c8c7

Risk Factor
None

Plugin ID: 10287

Traceroute Information

Synopsis
It was possible to obtain traceroute information.

List of Hosts

192.168.0.40

Plugin Output
For your information, here is the traceroute from 192.168.0.27 to 192.168.0.40 :
192.168.0.27
192.168.0.40

Description
Makes a traceroute to the remote host.

Solution
n/a

Risk Factor
None

Plugin ID: 18261

Apache Banner Linux Distribution Disclosure

Synopsis
The name of the Linux distribution running on the remote host was found in the banner of the web server.

List of Hosts

192.168.0.40

Plugin Output

The linux distribution detected was :
- Ubuntu 10.10 (maverick)

Description
This script extracts the banner of the Apache web server and attempts
to determine which Linux distribution the remote host is running.

Solution
If you do not wish to display this information, edit httpd.conf and
set the directive 'ServerTokens Prod' and restart Apache.

Risk Factor
None

Plugin ID: 11936

OS Identification

Synopsis
It is possible to guess the remote operating system.

List of Hosts

192.168.0.40

Plugin Output

Remote operating system : Linux Kernel 2.6 on Ubuntu 10.10 (maverick)
Confidence Level : 95
Method : SSH


The remote host is running Linux Kernel 2.6 on Ubuntu 10.10 (maverick)

Description
Using a combination of remote probes, (TCP/IP, SMB, HTTP, NTP, SNMP, etc...)
it is possible to guess the name of the remote operating system in use, and
sometimes its version.

Solution
N/A

Risk Factor
None

Plugin ID: 35716

Ethernet Card Manufacturer Detection

Synopsis
The manufacturer can be deduced from the Ethernet OUI.

List of Hosts

192.168.0.40

Plugin Output

The following card manufacturers were identified :

10:78:d2:36:65:a4 : ELITEGROUP COMPUTER SYSTEM CO., LTD.

Description
Each ethernet MAC address starts with a 24-bit 'Organizationally
Unique Identifier'.
These OUI are registered by IEEE.

Solution
n/a

See also
http://standards.ieee.org/faqs/OUI.html
http://standards.ieee.org/regauth/oui/index.shtml

Risk Factor
None

Plugin ID: 22964

Service Detection

Synopsis
The remote service could be identified.

List of Hosts

192.168.0.40

Plugin Output
The service closed the connection without sending any data.
It might be protected by some sort of TCP wrapper.

Description
It was possible to identify the remote service by its banner or by looking
at the error message it sends when it receives an HTTP request.

Solution
n/a

Risk Factor
None

Plugin ID: 22964

Service Detection

Synopsis
The remote service could be identified.

List of Hosts

192.168.0.40

Plugin Output
A web server is running on this port.

Description
It was possible to identify the remote service by its banner or by looking
at the error message it sends when it receives an HTTP request.

Solution
n/a

Risk Factor
None

Plugin ID: 22964

Service Detection

Synopsis
The remote service could be identified.

List of Hosts

192.168.0.40

Plugin Output
An SSH server is running on this port.

Description
It was possible to identify the remote service by its banner or by looking
at the error message it sends when it receives an HTTP request.

Solution
n/a

Risk Factor
None

Plugin ID: 12218

mDNS Detection

Synopsis
It is possible to obtain information about the remote host.

List of Hosts

192.168.0.40

Plugin Output
Nessus was able to extract the following information :

- mDNS hostname : is2c-dojo.local.

- Advertised services :
o Service name : is2c-dojo [10:78:d2:36:65:a4]._workstation._tcp.local.
Port number : 9
o Service name : saned._sane-port._tcp.local.
Port number : 6566

- CPU type : I686
- OS : LINUX

Description
The remote service understands the Bonjour (also known as ZeroConf or
mDNS) protocol, which allows anyone to uncover information from the
remote host such as its operating system type and exact version, its
hostname, and the list of services it is running.

Solution
Filter incoming traffic to UDP port 5353 if desired.

Risk Factor
Medium/ CVSS Base Score: 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Plugin ID: 45590

Common Platform Enumeration (CPE)

Synopsis
It is possible to enumerate CPE names that matched on the remote system.

List of Hosts

192.168.0.40

Plugin Output

The remote operating system matched the following CPE :

cpe:/o:canonical:ubuntu_linux:10.10

Following application CPE's matched on the remote system :

cpe:/a:openbsd:openssh:5.5
cpe:/a:apache:http_server:2.2.16 -> Apache Software Foundation Apache HTTP Server 2.2.16

Description
By using information obtained from a Nessus scan, this plugin reports
CPE (Common Platform Enumeration) matches for various hardware and
software products found on a host.

Note that if an official CPE is not available for the product, this
plugin computes the best possible CPE based on the information
available from the scan.

Solution
n/a

See also
http://cpe.mitre.org/

Risk Factor
None

Plugin ID: 10881

SSH Protocol Versions Supported

Synopsis
A SSH server is running on the remote host.

List of Hosts

192.168.0.40

Plugin Output
The remote SSH daemon supports the following versions of the
SSH protocol :

- 1.99
- 2.0


SSHv2 host key fingerprint : d1:7d:e9:a8:58:83:f6:1c:82:b4:f1:98:2d:7f:58:30

Description
This plugin determines the versions of the SSH protocol supported by
the remote SSH daemon.

Solution
n/a

Risk Factor
None

Plugin ID: 10114

ICMP Timestamp Request Remote Date Disclosure

Synopsis
It is possible to determine the exact time set on the remote host.

List of Hosts

192.168.0.40

Plugin Output
The difference between the local and remote clocks is -1 seconds.

Description
The remote host answers to an ICMP timestamp request. This allows an
attacker to know the date that is set on the targeted machine.

This may help an attacker to defeat all time-based authentication
protocols.

Solution
Filter out the ICMP timestamp requests (13), and the outgoing ICMP
timestamp replies (14).

Risk Factor
None

CVE
CVE-1999-0524

Other references
OSVDB:94
CWE:200

Plugin ID: 39521

Backported Security Patch Detection (WWW)

Synopsis
Security patches are backported.

List of Hosts

192.168.0.40

Plugin Output
Give Nessus credentials to perform local checks.

Description
Security patches may have been 'back ported' to the remote HTTP server
without changing its version number.

Banner-based checks have been disabled to avoid false positives.

Note that this test is informational only and does not denote any
security problem.

Solution
N/A

See also
http://www.nessus.org/u?d636c8c7

Risk Factor
None