INTRODUCTION
A Security Auditor's Research Assistant (SARA) security scan was performed on hosts on the psc_server sub-nets. The SARA scan was performed to identify potential security vulnerabilities in the psc_server sub-domain. The last scan was completed on 2006/11/02 06:17:23 and its scan mode was set to extreme. The version of SARA was Version 7.0.2c.
DISCUSSION
SARA is a third generation security analysis tool that analyzes network-based services on the target computers.
SARA classifies a detected service in one of five categories:
A total of 7 devices were detected of which 2 are possibly vulnerable. Figure 1 summarizes this scan by color where the Green bar indicates hosts with no detected vulnerabilities. Gray indicates hosts with no services. The Red bar indicates hosts that have one or more red vulnerabilities. The Yellow bar indicates hosts that have one or more yellow vulnerabilities (but no red). And the Brown bar indicates hosts that have one or more brown problems (but no red or yellow).
Green (5) |
Grey (0) |
Red (1) |
Yellow (1) |
Brown (0) |
Figure 1 Host Summary by Color
The SARA scan results are distributed as appendices to this paper:
Appendices are hyper-linked to assist the reader in navigating through this report. The report includes information on all hosts that have one or more vulnerabilities.
RECOMMENDATION
The identified hosts should be analyzed immediately.
Grn | Red | Yel | Brn | FP | ||||
158.74.241.12 | 158.74.241.12 | 9 | 0 | 0 | 0 | 0 | ||
158.74.241.15 | 158.74.241.15 | 10 | 0 | 0 | 0 | 0 | ||
158.74.241.18 | 158.74.241.18 | 11 | 0 | 0 | 0 | 0 | ||
158.74.241.25 | 158.74.241.25 | 10 | 0 | 0 | 0 | 0 | ||
158.74.241.28 | 158.74.241.28 | 10 | 0 | 0 | 0 | 0 | ||
158.74.241.3 | 158.74.241.3 | 12 | 0 | 1 | 0 | 0 | ||
158.74.241.9 | 158.74.241.9 | 13 | 2 | 2 | 2 | 0 |
158.74.241.3 | 158.74.241.3 |
Non Vulnerable services
domain (53) ms-sql-m (1434) ssh (22) |
h323gatedisc (1718) pop3s (995) sunrpc (111) |
h323gatestat (1719) smux (199) telnet (23) |
h323hostcall (1720) snmp (161) xdmcp (177) |
Vulnerabilities
Severity | CVE No. | Top20 | |
Vulnerable CGI Script test-cgi is active and may be vulnerable (http) |
yellow | CVE-1999-0045 |
False Positives
<None>
158.74.241.9 | 158.74.241.9 |
Non Vulnerable services
domain (53) ms-sql-m (1434) snmp (161) xdmcp (177) |
h323gatedisc (1718) nfs (2049) ssh (22) |
h323gatestat (1719) pop3s (995) sunrpc (111) |
h323hostcall (1720) smux (199) telnet (23) |
Vulnerabilities
Severity | CVE No. | Top20 | |
unrestricted NFS export Exports /backup to everyone |
red | ARC-012 |
|
Oracle Listener Arbitrary files can be overwritten |
red | CVE-2000-0818 |
|
Oracle Listener Weaknesses Listener is not password protected |
yellow | ARC-013 |
|
Oracle Version Oracle version may be subject to multiple vulnerabilities |
yellow | ARC-018 |
|
possible sendmail version sendmail unknown version may be vulnerable to buffer overflow |
brown | CVE-2003-0694 |
|
sendmail configuration sendmail EXPN command may provide hacker information |
brown | ARC-022 |
False Positives
<None>
Critical Vulnerabilities (RED)
Probable Vulnerabilities (YELLOW)
158.74.241.3 | test-cgi is active and may be vulnerable (http) |
158.74.241.9 | Listener is not password protected |
158.74.241.9 | Oracle version may be subject to multiple vulnerabilities |
Possible Vulnerabilities (BROWN)
158.74.241.9 | sendmail unknown version may be vulnerable to buffer overflow |
158.74.241.9 | sendmail EXPN command may provide hacker information |
Labeled as False Positive (GRAY)
Vulnerability Summary: ARC-012 |
Orirignal release date: 2006-05-01 Source: Advanced Research Corporation ®
Overview
Impact
Range: remote Authentication: Impact Type:
Reference to Advisories, Solutions, and Tools
Vulnerable Software and Vendor
Technical Details
|
Vulnerability Summary: ARC-013 |
Orirignal release date: 2006-05-01 Source: Advanced Research Corporation ®
Overview
Impact
Range: remote Authentication: Impact Type:
Reference to Advisories, Solutions, and Tools
Vulnerable Software and Vendor
Technical Details
|
Vulnerability Summary: ARC-018 |
Orirignal release date: 2006-05-01 Source: Advanced Research Corporation ®
Overview
Impact
Range: remote Authentication: Impact Type:
Reference to Advisories, Solutions, and Tools
Vulnerable Software and Vendor
Technical Details
|
Vulnerability Summary: ARC-022 |
Orirignal release date: 2006-05-01 Source: Advanced Research Corporation ®
Overview
Impact
Range: remote Authentication: Impact Type:
Reference to Advisories, Solutions, and Tools
Vulnerable Software and Vendor
Technical Details
|
Vulnerability Summary: CVE-1999-0045 |
Orirignal release date: 1996-12-10 Source: US-CERT/NIST
Overview
Impact
Range: remote Authentication: input,config Impact Type: sec_prot
Reference to Advisories, Solutions, and Tools
Name: CA-97.07.nph-test-cgi_script Hyperlink: http://www.cert.org/advisories/CA-97.07.nph-test-cgi_script.html
External Source: Security Focus
External Source: ISS X-Force
Vulnerable Software and Vendor
Communications Server (Netscape) Enterprise Server (Netscape) Commerce Server (Netscape) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0045 |
Vulnerability Summary: CVE-2000-0818 |
Orirignal release date: 2000-12-19 Source: US-CERT/NIST
Overview
Impact
Range: local,remote Authentication: design Impact Type: sec_prot admin="1"
Reference to Advisories, Solutions, and Tools
Name: http://xforce.iss.net/alerts/advise66.php adv=1 Hyperlink: http://xforce.iss.net/alerts/advise66.php adv=1
External Source: Oracle
Vulnerable Software and Vendor
Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0818 |
Vulnerability Summary: CVE-2003-0694 |
Orirignal release date: 2003-10-06 Source: US-CERT/NIST
Overview
Impact
Range: remote Authentication: input buffer="1" Impact Type: sec_prot admin="1"
Reference to Advisories, Solutions, and Tools
Name: Sendmail 8.12.10 Hyperlink: http://www.sendmail.org/8.12.10.html
External Source: CERT
External Source: Security Focus
External Source: BUGTRAQ
External Source: VULNWATCH
External Source: REDHAT
External Source: REDHAT
External Source: CONECTIVA
External Source: MANDRAKE
External Source: DEBIAN
External Source: SCO
External Source: BUGTRAQ
External Source: BUGTRAQ
External Source: OVAL
External Source: OVAL
External Source: OVAL
External Source: FULLDISC
External Source: CERT-VN
External Source: BUGTRAQ
External Source: CONECTIVA
External Source: BUGTRAQ
External Source: BUGTRAQ
External Source: BUGTRAQ
Vulnerable Software and Vendor
AIX (IBM) Mac OS X (Apple) Tru64 (Compaq) Gentoo Linux (Gentoo) Solaris (Sun) Sendmail Pro (Sendmail Inc) Sendmail (Sendmail Consortium) IRIX (SGI) HP-UX (HP) TurboLinux Server (TurboLinux) NetBSD (NetBSD) Sendmail Advanced Message Server (Sendmail Inc) Mac OS X Server (Apple) Sendmail (Sendmail Inc) TurboLinux Advanced Server (TurboLinux) FreeBSD (FreeBSD) Sendmail Switch (Sendmail Inc) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0694 |