Tenable NeWT Security Reports
Start Time: Mon Mar 22 14:20:26 2004 Finish Time: Mon Mar 22 14:31:26 2004
localhost
5 Open Ports, 15 Notes, 6 Infos, 2 Holes.
127.0.0.1 [Return to top]
http (80/tcp)
Port is open
Plugin ID : 11219

A web server is running on this port
Plugin ID : 10330

The following CGI have been discovered :

Syntax : cginame (arguments [default value])

/upload_here/index.mhtml (userfile [] upload [Upload] )
/index.mhtml (userfile [] upload [Upload] )

Plugin ID : 10662

Nessus was not able to reliably identify this server. It might be:
Ipswitch-IMail/8.02
The fingerprint differs from these known signatures on 17 point(s)

Plugin ID : 11919

The remote web server type is :

Tontito's Mirc Web Server v4.2.3

Solution : We recommend that you configure (if possible) your web server to return
a bogus Server header in order to not leak information.

Plugin ID : 10107

epmap (135/tcp)
The remote host is running a version of Windows which has a flaw in
its RPC interface, which may allow an attacker to execute arbitrary code
and gain SYSTEM privileges.

An attacker or a worm could use it to gain the control of this host.

Note that this is NOT the same bug as the one described in MS03-026
which fixes the flaw exploited by the 'MSBlast' (or LoveSan) worm.

Solution: see http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx

Risk factor : High
CVE : CAN-2003-0715, CAN-2003-0528, CAN-2003-0605
BID : 8458
Other references : IAVA:2003-A-0012

Plugin ID : 11835

Port is open
Plugin ID : 11219

microsoft-ds (445/tcp)
It was possible to log into the remote host using the following
login/password combinations :
'administrator'/''
'administrator'/'administrator'
'guest'/''
'guest'/'guest'

It was possible to log into the remote host using a NULL session.
The concept of a NULL session is to provide a null username and
a null password, which grants the user the 'guest' access

To prevent null sessions, see MS KB Article Q143474 (NT 4.0) and
Q246261 (Windows 2000).
Note that this won't completely disable null sessions, but will
prevent them from connecting to IPC$
Please see http://msgs.securepoint.com/cgi-bin/get/nessus-0204/50/1.html

The remote host defaults to guest when a user logs in using an invalid
login. For instance, we could log in using the account 'nessus/nessus'


All the smb tests will be done as 'administrator'/'' in domain WORKGROUP
CVE : CAN-1999-0504, CAN-1999-0506, CVE-2000-0222, CAN-1999-0505, CAN-2002-1117
BID : 494, 990
Plugin ID : 10394

The remote registry can be accessed remotely using the login / password
combination used for the SMB tests.

Having the registry accessible to the world is not a good thing as it gives
extra knowledge to a hacker.

Solution : Apply service pack 3 if not done already, and set the key
HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
to restrict what can be browsed by non administrators.

In addition to this, you should consider filtering incoming packets to this
port.

Risk factor : Low
CVE : CAN-1999-0562

Plugin ID : 10400

Here is the list of the SMB shares of this host :

DRIVERS -
IPC$ - Remote IPC
G$ - Default share
Downloads -
F$ - Default share
ADMIN$ - Remote Admin
C$ - Default share


This is potentially dangerous as this may help the attack
of a potential hacker.

Solution : filter incoming traffic to this port
Risk factor : Medium

Plugin ID : 10395

The host Security Identifier (SID) can be obtained remotely. Its value is :

TONTITO : 5-21-50732105-267890793-1801674531

An attacker can use it to obtain the list of the local users of this host

Solution : filter the ports 137-139 and 445
Risk factor : Low

CVE : CVE-2000-1200
BID : 959

Plugin ID : 10859

Here is the browse list of the remote host :

TONTITO -


This is potentially dangerous as this may help the attack
of a potential hacker by giving him extra targets to check for

Solution : filter incoming traffic to this port
Risk factor : Low

Plugin ID : 10397

Here is a list of files which have been found on the remote SMB shares.
Some of these files may contain copyrighted materials, such as commercial
movies or music files.

If any of this file actually contains copyrighted material and if
they are freely swapped around, your organization might be held liable
for copyright infrigement by associations such as the RIAA or the MPAA.

+ C$ :



+ ADMIN$ :



+ F$ :



+ Downloads :



+ G$ :



+ IPC$ :



+ DRIVERS :





Solution : Delete all the copyrighted files

Plugin ID : 11777

Port is open
Plugin ID : 11219

A CIFS server is running on this port
Plugin ID : 11011

The remote native lan manager is : Windows 2000 LAN Manager
The remote Operating System is : Windows 5.1
The remote SMB Domain Name is : WORKGROUP

Plugin ID : 10785

Nessus did not access the remote registry completely,
because this needs to be logged in as administrator.

If you want the permissions / values of all the sensitive
registry keys to be checked for, we recommend that
you fill the 'SMB Login' options in the
'Prefs.' section of the client by the administrator
login name and password.

Risk factor : None

Plugin ID : 10428

mysql (3306/tcp)
The remote host is running Remote PC Access Server.

This service could be used by an attacker to partially take control of the remote
system if they obtain the credentials necessary to log in (through a brute force
attack or by sniffing the network, as this protocol transmits usernames and
passwords in plain text).

An attacker may use it to steal your password or prevent your system from working
properly.


Solution : Disable this service if you do not use it.
Risk factor : Medium

Plugin ID : 11673

Port is open
Plugin ID : 11219

An unknown service is running on this port.
It is usually reserved for MySQL
Plugin ID : 10330

Remote MySQL version : 4.0.17-nt
Plugin ID : 10719

general/tcp
127.0.0.1 resolves as localhost.
Plugin ID : 12053

ntp (123/udp)
A NTP (Network Time Protocol) server is listening on this port.

Risk factor : Low

Plugin ID : 10884