Eftersom ni tjafsar emot måste jag således göra följande
------------------------------------------------------
Vulnerability found on port ssh (22/tcp)
You are running a version of OpenSSH which is older than 3.7.1
Versions older than 3.7.1 are vulnerable to a flaw in the buffer management
functions which might allow an attacker to execute arbitrary commands on this
host.
An exploit for this issue is rumored to exist.
Note that several distribution patched this hole without changing
the version number of OpenSSH. Since Nessus solely relied on the
banner of the remote SSH server to perform this check, this might
be a false positive.
If you are running a RedHat host, make sure that the command :
rpm -q openssh-server
Returns :
openssh-server-3.1p1-13 (RedHat 7.x)
openssh-server-3.4p1-7 (RedHat 8.0)
openssh-server-3.5p1-11 (RedHat 9)
Solution : Upgrade to OpenSSH 3.7.1
See also : http://marc.theaimsgroup.com/?l=openbsd-misc&m=106375452423794&w=2
http://marc.theaimsgroup.com/?l=openbsd-misc&m=106375456923804&w=2
Risk factor : High
CVE : CAN-2003-0693, CAN-2003-0695
BID : 8628
Nessus ID : 11837
Denna är troligen fixad med Apples senaste patch som ju heter; OpenSSH_3.6.1p1+CAN-2003-0693, o andra sidan återstår ju 0695
------------------------------------------------------
Vulnerability found on port http (80/tcp)
The remote host appears to be running a version of Apache which is older
than 1.3.29
There are several flaws in this version, which may allow an attacker to
possibly execute arbitrary code through mod_alias and mod_rewrite.
You should upgrade to 1.3.29 or newer.
*** Note that Nessus solely relied on the version number
*** of the remote server to issue this warning. This might
*** be a false positive
Solution : Upgrade to version 1.3.29
See also : http://www.apache.org/dist/httpd/Announcement.html
Risk factor : High
CVE : CAN-2003-0542
Nessus ID : 11915
------------------------------------------------------
Vulnerability found on port https (443/tcp)
The remote host appears to be running a version of Apache which is older
than 1.3.29
There are several flaws in this version, which may allow an attacker to
possibly execute arbitrary code through mod_alias and mod_rewrite.
You should upgrade to 1.3.29 or newer.
*** Note that Nessus solely relied on the version number
*** of the remote server to issue this warning. This might
*** be a false positive
Solution : Upgrade to version 1.3.29
See also : http://www.apache.org/dist/httpd/Announcement.html
Risk factor : High
CVE : CAN-2003-0542
Nessus ID : 11915
------------------------------------------------------
Vulnerability found on port unknown (1220/tcp)
Cross site scripting, buffer overflow and remote command
execution on QuickTime/Darwin Streaming Administration
Server.
This is due to parsing problems with per script:
parse_xml.cgi.
The worst of these vulnerabilities allows for remote
command execution usually as root or administrator.
These servers are installed by default on port 1220.
See:
http://www.atstake.com/research/advisories/2003/a022403-1.txt
Solution: Obtain a patch or new software from Apple or
block this port (TCP 1220) from internet access.
*** Nessus reports this vulnerability using only
*** information that was gathered. Only the existance
*** of the potentially vulnerable cgi script was tested.
Risk factor : High
CVE : CAN-2003-0050, CAN-2003-0051, CAN-2003-0052, CAN-2003-0053, CAN-2003-0054, CAN-2003-0055
BID : 6954, 6955, 6956, 6957, 6958, 6960, 6990
Nessus ID : 11278
------------------------------------------------------
Räcker det för herrarna som var skeptiska?
