安全隐患2，帖子太大，字数限制刚才没发完

killer · 发表于 2007-11-13 19:55:10

漏洞 www (80/tcp) OpenSSL 拒绝服务

远程主机运行的OpenSSL版本早于0.9.6m 或 0.9.7d。

该版本存在多个漏洞，允许攻击者对远程主机发起拒绝服务攻击。

*** Nessus 只是根据远程主机的banner进行判断并发出警告。

解决方案: 升级到 0.9.6m (0.9.7d) 或更新的版本
风险等级: 中
___________________________________________________________________

The remote host is using a version of OpenSSL which is
older than 0.9.6m or 0.9.7d

There are several bug in this version of OpenSSL which may allow
an attacker to cause a denial of service against the remote host.

*** Nessus solely relied on the banner of the remote host
*** to issue this warning

Solution : Upgrade to version 0.9.6m (0.9.7d) or newer
Risk factor : High
CVE_ID : CAN-2004-0079, CAN-2004-0081, CAN-2004-0112
BUGTRAQ_ID : 9899
NESSUS_ID : 12110
Other references : IAVA:2004-B-0006

漏洞 www (80/tcp) mod_frontpage installed

The remote host is using the Apache mod_frontpage module.

mod_frontpage older than 1.6.1 is vulnerable to a buffer
overflow which may allow an attacker to gain root access.

*** Since Nessus was not able to remotely determine the version
*** of mod_frontage you are running, you are advised to manually
*** check which version you are running as this might be a false
*** positive.

If you want the remote server to be remotely secure, we advise
you do not use this module at all.

Solution : Disable this module
Risk factor : High
CVE_ID : CAN-2002-0427
BUGTRAQ_ID : 4251
NESSUS_ID : 11303

警告 www (80/tcp) OpenSSL password interception

The remote host is using a version of OpenSSL which is
older than 0.9.6j or 0.9.7b

This version is vulnerable to a timing based attack which may
allow an attacker to guess the content of fixed data blocks and
may eventually be able to guess the value of the private RSA key
of the server.

An attacker may use this implementation flaw to sniff the
data going to this host and decrypt some parts of it, as well
as impersonate your server and perform man in the middle attacks.

*** Nessus solely relied on the banner of the remote host
*** to issue this warning

See also : http://www.openssl.org/news/secadv_20030219.txt
http://lasecwww.epfl.ch/memo_ssl.shtml
http://eprint.iacr.org/2003/052/

Solution : Upgrade to version 0.9.6j (0.9.7b) or newer
Risk factor : Medium
CVE_ID : CAN-2003-0078, CAN-2003-0147, CAN-2003-0131
BUGTRAQ_ID : 6884, 7148
NESSUS_ID : 11267
Other references : RHSA:RHSA-2003:101-01, SuSE:SUSE-SA:2003:024

提示 www (80/tcp) 开放服务

"WEB"服务运行于该端口
BANNER信息 :

HTTP/1.1 200 OK
Date: Tue, 13 Nov 2007 11:17:57 GMT
Server: Apache/1.3.39 (Unix) mod_fastcgi/2.4.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.30 OpenSSL/0.9.7a
X-Powered-By: PHP/4.4.7
Set-Cookie: Shn_sid=PGzsga
expires=Tue, 20 Nov 2007 11:17:57 GMT
path=/
Set-Cookie: Shn_onlineusernum=4
expires=Tue, 13 Nov 2007 11:22:57 GMT
path=/
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD
NESSUS_ID : 10330

提示 www (80/tcp) http TRACE 跨站攻击

你的webserver支持TRACE 和/或 TRACK 方式。 TRACE和TRACK是用来调试web服务器连接的HTTP方式。

支持该方式的服务器存在跨站脚本漏洞，通常在描述各种浏览器缺陷的时候，把"Cross-Site-Tracing"简称为XST。

攻击者可以利用此漏洞欺骗合法用户并得到他们的私人信息。

解决方案: 禁用这些方式。

如果你使用的是Apache, 在各虚拟主机的配置文件里添加如下语句:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

如果你使用的是Microsoft IIS, 使用URLScan工具禁用HTTP TRACE请求，或者只开放满足站点需求和策略的方式。

如果你使用的是Sun ONE Web Server releases 6.0 SP2 或者更高的版本, 在obj.conf文件的默认object section里添加下面的语句:
<Client method="TRACE">
AuthTrans fn="set-variable"
remove-headers="transfer-encoding"
set-headers="content-length: -1"
error="501"
</Client>

如果你使用的是Sun ONE Web Server releases 6.0 SP2 或者更低的版本, 编译如下地址的NSAPI插件:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603

参见http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603
http://www.kb.cert.org/vuls/id/867593

风险等级: 中
___________________________________________________________________

The remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK
are HTTP methods which are used to debug web server connections.

It has been shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
"Cross-Site-Tracing", when used in conjunction with
various weaknesses in browsers.

An attacker may use this flaw to trick your legitimate web users to
give him their credentials.

Solution :
Add the following lines for each virtual host in your configuration file :

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

See also http://www.kb.cert.org/vuls/id/867593
Risk factor : Medium
BUGTRAQ_ID : 9506, 9561, 11604
NESSUS_ID : 11213

提示 www (80/tcp) Web 映射

此脚本将映射远程web站点并提取一份远程主机所用的CGI列表.

建议你给此插件设置一个较高的超时值.
所要映射的页面需在客户端的'选项'中修改.

风险等级:无
___________________________________________________________________

The following CGI have been discovered :

Syntax : cginame (arguments [default value])

/rss.php (auth [0] )
/forumdisplay.php (fid [2] )
/stats.php (type [forumsrank] )
/redirect.php (tid [5] goto [lastpost] )
/register.php (regsubmit [yes] )
/logging.php (password [] action [login] loginfield [username] username [用户名] referer [] answer [] questionid [] formhash [862cdaf2] loginsubmit [true] cookietime [2592000] )
/space.php (username [%C1%B5%B7%F8%C9%E4] uid [1] )
/archiver/archiver/ (fid-2.html [] )
/tag.php (name [] )
/faq.php (action [message] id [2] searchsubmit [yes] )
/index.php (gid [1] showoldetails [no] )
/member.php (action

killer · 发表于 2007-11-13 19:55:35

提示 pop3 (110/tcp) 开放服务

"POP3"服务运行于该端口
NESSUS_ID : 10330

漏洞 smtp (25/tcp) Exim多个溢出

远程主机正运行一个存在许多远程缓冲区溢出缺陷的Exim MTA版本。特别是，如果
在exim.conf文件中设置了'headers_check_syntax' 或者 'sender_verify = true'，
那么远程攻击者可以用一种经典的基于堆的溢出，并且不正常的访问机器。

*** 如果你正在运行有safe_checks启用的检查，这也许是一个误判断，因为
只有banner被用来评估风险。***

已经知道Exim 3.35和4.32存在缺陷。

解决方案 : 升级到Exim最新的版本

风险等级 : 高
___________________________________________________________________

The remote host is running a version of the Exim MTA which is vulnerable
to several remote buffer overflows. Specifically, if either
'headers_check_syntax' or 'sender_verify = true' is in the exim.conf
file, then a remote attacker may be able to execute a classic stack-
based overflow and gain inappropriate access to the machine.

*** If you are running checks with safe_checks enabled, this may be a
false positive as only banners were used to assess the risk! ***

It is known that Exim 3.35 and 4.32 are vulnerable.

Solution : Upgrade to Exim latest version

Risk factor : High
NESSUS_ID : 12232

漏洞 smtp (25/tcp) Interscan 3.32 SMTP Denial

It was possible to perform
a denial of service against the remote
Interscan SMTP server by sending it a special long HELO command.

This problem allows an attacker to prevent
your Interscan SMTP server from handling requests.

Solution : contact your vendor for a patch.

Risk factor : High
CVE_ID : CAN-1999-1529
BUGTRAQ_ID : 787
NESSUS_ID : 10353

提示 smtp (25/tcp) 开放服务

"SMTP"服务运行于该端口
BANNER信息 :

220-carp.lunarservers.com ESMTP Exim 4.68 #1 Tue, 13 Nov 2007 03:17:57 -0800
NESSUS_ID : 10330

提示 smtp (25/tcp) SMTP 服务端类型和版本

通过连接服务器并处理缓冲区里接收到的数据，当前脚本检测了SMTP 服务端类型和版本。
该信息向攻击者提供了更多系统信息。应该适当隐藏服务程序的版本和类型。

解决方案: 修改登陆banner不包含相关标识信息

风险等级: 低
___________________________________________________________________

Remote SMTP server banner :
220-carp.lunarservers.com ESMTP Exim 4.68 #1 Tue, 13 Nov 2007 03:22:25 -0800
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.

This is probably: Exim version 4.68
NESSUS_ID : 10263

提示 smtp (25/tcp) SMTP防病毒过滤器拒绝服务

本脚本发送42.zip到邮件服务器，如果该服务器上有防病毒代理并且配置有误，则可能导致CPU过载或内存满负荷。

Solution: 升级或重新配置你的防病毒软件

Risk factor : 高
___________________________________________________________________

For some reason, we could not send the 42.zip file to this MTA
BUGTRAQ_ID : 3027
NESSUS_ID : 11036

提示 tcp 查找主机的FQDN

如果主机可以被解析得到FQDN，这个插件将在报告中显示主机的FQDN。
这是正常的信息泄露。

风险等级：无
___________________________________________________________________

xxx.xxx.xxx.xxx resolves as xxx.com.
NESSUS_ID : 12053

killer · 发表于 2007-11-13 19:56:04

晕，第一篇帖子号称要管理员审核- -！

killer · 发表于 2007-11-13 19:56:37

这个应该不是蜜罐，我要想更换提示里面的老版本是不是没有办法？

大漠孤狼 · 发表于 2007-11-13 20:52:33

更换版本要服务器那边操作，虚拟主机用户操作不了

fanqi1234 · 发表于 2007-11-13 21:02:17

看了一堆，但是没看到真正的安全威胁

killer · 发表于 2007-11-13 21:06:16

有端口存在溢出。这还不算真正的安全威胁。汗。虽说不一定半分之百成功。

killer · 发表于 2007-11-13 21:06:42

原帖由 大漠孤狼 于 2007-11-13 08:52 PM 发表
更换版本要服务器那边操作，虚拟主机用户操作不了

只有听天由命了。

大漠孤狼 · 发表于 2007-11-13 21:09:16

一般来说软件有漏洞主机商都会及时收到通知并修复的，可以向他们反映一下

killer · 发表于 2007-11-13 21:11:58

恩，好的，我去发个信问问，谢谢您的回答