Scan Results May 29, 2012

Size: px

Start display at page:

Download "Scan Results May 29, 2012"

Aubrie Lane
5 years ago
Views:

1 Scan Results May 29, 2012 Report Summary User Name: Roberto Chana Login Name: sebyt-rc Company: SELLBYTEL GROUP S.A User Role: Manager Address: Guitard 43, 3ra planta City: Barcelona State: ne Zip: Country: Spain Created: 05/29/2012 at 09:25:44 (GMT+0200) Date: 05/25/2012 at 14:37:12 (GMT+0200) Active Hosts: 1 Total Hosts: 1 Type: On demand Status: Finished Reference: scan/ Scanner Appliances: is_sebyt-ek (Scanner , Web , Vulnerability Signatures ) Duration: 00:50:12 Title: Scan Eventlog Asset Groups: - IPs: Excluded IPs: - Options Profile: Payment Card Industry (PCI) Options Summary of Vulnerabilities Vulnerabilities Total 20 Security Risk (Avg) 3.0 by Severity Severity Confirmed Potential Information Gathered Total Total Biggest Categories Category Confirmed Potential Information Gathered Total Web Application Information gathering Web server TCP/IP Windows Total Scan Results page 1

2 Vulnerabilities by Severity Operating Systems Detected Services Detected Detailed Results Scan Results page 2

3 (it-eventlog-01.sellbytel.es, IT-EVENTLOG-01) Windows 2003 R2 Service Pack 2 Vulnerabilities (7) 3 Apache Tomcat Multiple Content Length Headers Information Disclosure Vulnerability port 8400/tcp QID: CVSS Base: 4.3 Web server CVSS Temporal: 3.4 CVE ID: CVE Vendor Reference: Apache Tomcat 4, Apache Tomcat 5, Apache Tomcat 6 Bugtraq ID: Service Modified: 07/15/2008 Yes This vulnerability exists in Apache Tomcat Versions 4, 5 and 6 when the server doesn't reject multiple content length header requests. When these kinds of requests are processed by firewalls, caches, proxies and Tomcat, they may result in Web cache poisoning, XSS attack and information disclosure. Refer to this Apache Tomcat Web site ( for details about the latest versions. t Applicable POST /index.jsp HTTP/1.0 Content-Length: 0 Content-Length: 0 <html><head><title>- - Error report</title><style></style> </head><body><h1>http Status /index.jsp</h1><hr size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/index.jsp</u></p><p><b>description</b> <u>the requested resource (/index.jsp) is not available.</u></p><hr size="1" noshade="noshade"><h3>-</h3></body></html>post /index.html HTTP/1.0 Content-Length: 0 Content-Length: 0 HTTP/ OK Set-Cookie: JSESSIONID=24EDE82035A5192CC F27EA6B; Path=/ ETag: W/" " Last-Modified: Fri, 25 May :32:47 GMT Content-Type: text/html Content-Length: 98 Date: Fri, 25 May :45:10 GMT Server: Apache-Coyote/1.1 Connection: close <html> Scan Results page 3

4 <head> <meta http-equiv="refresh" content="0.25;url=../event/index2.do"/> </head> </html> 3 Slow HTTP headers vulnerability port 8400/tcp QID: CVSS Base: 6.8 [1] Web Application CVSS Temporal: 6.1 Service Modified: 06/02/2011 Application scanner discovered, that web application is probably vulnerable to slow HTTP headers DDoS attack - an application level (Layer 7) DDoS, that occurs when an attacker holds server connections open by sending partial HTTP requests, and continues to send subsequent headers at some interval to prevent the server from closing sockets. In this way, the web server becomes unavailable because the number of available sockets decreases and memory usage may increase, especially if the server allocates a thread per connection. One of the reasons for this behavior is that some servers have "no data" timers, that reset each time a byte arrives at the socket, but the server does not enforce an overall time limit for a connection. For example, the attacker sends the data for its request one byte at a time over several minutes rather than following the expected behavior of transmitting a complete request of several hundred bytes in a single packet. This enables the attacker to prolong the connection virtually forever. More information can be found at the Slowloris HTTP DoS ( All other services remain intact but the web server itself becomes completely inaccessible. Solution is server-specific. Countermeasures for Apache are described here ( Easy to use tool for intrusive testing is available here ( t Applicable url: matched: Vulnerable to slow HTTP headers attack Server resets timeout after accepting header data from peer. 3 Slow HTTP POST vulnerability port 8400/tcp QID: CVSS Base: 6.8 [1] Web Application CVSS Temporal: 6.1 Service Modified: 06/02/2011 Scan Results page 4

5 Application scanner discovered, that web application is probably vulnerable to slow HTTP POST DDoS attack - an application level (Layer 7) DDoS, that occurs when an attacker holds server connections open by sending properly crafted HTTP POST headers, that contain a legitimate Content-Length header to inform the web server how much of data to expect. After the HTTP POST headers are fully sent, the HTTP POST message body is sent at slow speeds to prolong the completion of the connection and lock up server resources.by waiting for complete request body, server supports clients with slow or intermittent connections More information can be found at the in this presentation ( All other services remain intact but the web server itself becomes completely inaccessible. Solution would be server-specific, but general recommendations are: - to limit the size of the acceptable request to each form requirements - establish minimal acceptable speed rate - establish absolute request timeout for connection with POST request Easy to use tool for intrusive testing is available here ( t Applicable url: matched: Vulnerable to slow HTTP POST attack Server resets timeout after accepting request data from peer. 2 SMB Signing Disabled or SMB Signing t Required QID: CVSS Base: 2.1 [1] Windows CVSS Temporal: 1.8 Service Modified: 01/20/2010 This host does not seem to be using SMB (Server Message Block) signing. SMB signing is a security mechanism in the SMB protocol and is also known as security signatures. SMB signing is designed to help improve the security of the SMB protocol. SMB signing adds security to a network using NetBIOS, avoiding man-in-the-middle attacks. When SMB signing is enabled on both the client and server SMB sessions are authenticated between the machines on a packet by packet basis. Unauthorized users sniffing the network could catch many challenge/response exchanges and replay the whole thing to grab particular session keys, and then authenticate on the Domain Controller. Scan Results page 5

6 Without SMB signing, a device could intercept SMB network packets from an originating computer, alter their contents, and broadcast them to the destination computer. Since, digitally signing the packets enables the recipient of the packets to confirm their point of origination and their authenticity, it is recommended that SMB signing is enabled and required. Please refer to Microsoft's article ( for information on enabling SMB signing. t Applicable results available 2 Path-Based Vulnerability port 8400/tcp QID: CVSS Base: 2.1 [1] Web Application CVSS Temporal: 1.9 Service Modified: 10/19/2007 A potentially sensitive file, directory, or directory listing was discovered on the Web server. The contents of this file or directory may disclose sensitive information. Verify that access to this file or directory is permitted. If necessary, remove it or apply access controls to it. t Applicable url: comment: This directory was discovered during the crawl phase. matched: <html> <head> <title>directory Listing For /styles/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;background-col url: comment: This directory was discovered during the crawl phase. Scan Results page 6

7 matched: <html> <head> <title>directory Listing For /images/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;background-col url: comment: This directory was discovered during the crawl phase. matched: <html> <head> <title>directory Listing For /javascript/mini/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;backg url: comment: This directory was discovered during the crawl phase. matched: <html> <head> <title>directory Listing For /javascript/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;background 2 Directory Listing port 8400/tcp QID: CVSS Base: 5 [1] Web Application CVSS Temporal: 4.5 Service Modified: 06/12/2009 Yes The Web server presents a directory listing. All file names in this directory are exposed. The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application. t Applicable url: comment: This directory was discovered during the crawl phase. matched: <html> <head> Scan Results page 7

8 <title>directory Listing For /javascript/mini/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;backg url: comment: This directory was discovered during the crawl phase. matched: <html> <head> <title>directory Listing For /javascript/</title> <STYLE><!--H1 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:22px;} H2 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:16px;} H3 {font-family:tahoma,arial,sans-serif;color:white;background-color:#525d76;font-size:14px;} BODY {font-family:tahoma,arial,sans-serif;color:black;background-color:white;} B {font-family:tahoma,arial,sans-serif;color:white;background 1 Possible Clickjacking Vulnerability port 8400/tcp QID: CVSS Base: 2.1 [1] Web Application CVSS Temporal: 1.7 Service Modified: 06/02/2011 An attack can trick the user into clicking on the link by framing the original page and showing a layer on top of it with dummy buttons. Attacks like CSRF can be performed using Clickjacking techniques. Two of the most popular preventions are: X-Frame-Options: This header works with most of the modern browsers and can be used to prevent framing of the page. Framekiller: JavaScript code that prevents the malicious user from framing the page. t Applicable url: matched: The response for this request did not have an "X-FRAME-OPTIONS" header present. url: matched: The response for this request did not have an "X-FRAME-OPTIONS" header present. url: matched: The response for this request did not have an "X-FRAME-OPTIONS" header present. url: matched: The response for this request did not have an "X-FRAME-OPTIONS" header present. Scan Results page 8

9 url: matched: The response for this request did not have an "X-FRAME-OPTIONS" header present. Potential Vulnerabilities (1) 3 Service Stopped Responding port 9005/tcp over SSL QID: CVSS Base: 5 [1] General remote services CVSS Temporal: 4 Service Modified: 06/12/2009 Yes The service/daemon listening on the port shown stopped responding to TCP connection attempts during the scan. The service/daemon is vulnerable to a denial of service attack. This QID can be posted for a number of reasons (e.g., service crash, bandwidth utilization, or a device with IPS-like behavior). If the service has crashed, report the incident to Customer Support or your QualysGuard re-seller, and stop scanning the service's listening port until the issue is resolved. If the issue is bandwidth related, modify the Qualys performance settings to lower the scan impact. If you do not find any service/daemon listening on this port, it may be a dynamic port and you may ignore this report. This is posted as a PCI fail since the service stopped responding. Further checks were not launched for that service and therefore the PCI assessment was incomplete. t Applicable 3 consecutive connection attempts failed after a total number of 3 successful connections. Information Gathered (12) 2 Operating System Detected QID: Information gathering Scan Results page 9

10 Service Modified: 02/09/2005 Several different techniques can be used to identify the operating system (OS) running on a host. A short description of these techniques is provided below. The specific technique used to identify the OS on this host is included in the RESULTS section of your report. 1) TCP/IP Fingerprint: The operating system of a host can be identified from a remote system using TCP/IP fingerprinting. All underlying operating system TCP/IP stacks have subtle differences that can be seen in their responses to specially-crafted TCP packets. According to the results of this "fingerprinting" technique, the OS version is among those listed below. te that if one or more of these subtle differences are modified by a firewall or a packet filtering device between the scanner and the host, the fingerprinting technique may fail. Consequently, the version of the OS may not be detected correctly. If the host is behind a proxy-type firewall, the version of the operating system detected may be that for the firewall instead of for the host being scanned. 2) NetBIOS: Short for Network Basic Input Output System, an application programming interface (API) that augments the DOS BIOS by adding special functions for local-area networks (LANs). Almost all LANs for PCs are based on the NetBIOS. Some LAN manufacturers have even extended it, adding additional network capabilities. NetBIOS relies on a message format called Server Message Block (SMB). 3) PHP Info: PHP is a hypertext pre-processor, an open-source, server-side, HTML-embedded scripting language used to create dynamic Web pages. Under some configurations it is possible to call PHP functions like phpinfo() and obtain operating system information. 4) SNMP: The Simple Network Monitoring Protocol is used to monitor hosts, routers, and the networks to which they attach. The SNMP service maintains Management Information Base (MIB), a set of variables (database) that can be fetched by Managers. These include "MIB_II.system.sysDescr" for the operating system. t applicable t applicable t Applicable Operating System Technique ID Windows 2003 R2 Service Pack 2 CIFS via TCP Port 445 Windows 2003 TCP/IP Fingerprint U1752:135 Windows 2003/XP/Vista/2008 MS-RPC Fingerprint Windows 2003/XP 64 bit Edition NTLMSSP 1 DNS Host Name QID: 6 Information gathering Service Modified: 01/01/1999 Scan Results page 10

11 The fully qualified domain name of this host, if it was obtained from a DNS server, is displayed in the RESULT section. t Applicable IP address Host name registered hostname 1 Firewall Detected QID: Firewall Service Modified: 10/17/2001 A packet filtering device protecting this IP was detected. This is likely to be a firewall or a router using access control lists (ACLs). t Applicable Some of the ports filtered by the firewall are: 20, 21, 22, 23, 25, 53, 111, 1, 7, 11. Listed below are the ports filtered by the firewall. response has been received when any of these ports is probed. 1-79,81-134,136,138, , ,444, , , , , , , , , , , , , , , , , , , , , , , , , Traceroute QID: Information gathering Scan Results page 11

12 Service Modified: 05/09/2003 Traceroute describes the path in realtime from the scanner to the remote host being contacted. It reports the IP addresses of all the routers in between. t Applicable Hops IP Round Trip Time Probe ms TCP ms TCP ms TCP 1 Host Scan Time QID: Information gathering Service Modified: 11/19/2004 The Host Scan Time is the period of time it takes the scanning engine to perform the vulnerability assessment of a single target host. The Host Scan Time for this host is reported in the Result section below. The Host Scan Time does not have a direct correlation to the Duration time as displayed in the Report Summary section of a scan results report. The Duration is the period of time it takes the service to perform a scan task. The Duration includes the time it takes the service to scan all hosts, which may involve parallel scanning. It also includes the time it takes for a scanner appliance to pick up the scan task and transfer the results back to the service's Secure Operating Center. Further, when a scan task is distributed across multiple scanners, the Duration includes the time it takes to perform parallel host scanning on all scanners. N/A N/A t Applicable Scan Results page 12

13 Scan duration: 2445 seconds Start time: Fri, May , 12:39:24 GMT End time: Fri, May , 13:20:09 GMT 1 Host Names Found QID: Information gathering Service Modified: 02/14/2005 The following host names were discovered for this computer using various methods such as DNS look up, NetBIOS query, and SQL server name query. N/A N/A t Applicable Host Name IT-EVENTLOG-01.sellbytel.es IT-EVENTLOG-01 Source NTLM DNS NTLM NetBIOS 1 Open UDP Services List QID: TCP/IP Service Modified: 07/12/2005 A port scanner was used to draw a map of all the UDP services on this host that can be accessed from the Internet. Scan Results page 13

14 te that if the host is behind a firewall, there is a small chance that the list includes a few ports that are filtered or blocked by the firewall but are not actually open on the target host. This (false positive on UDP open ports) may happen when the firewall is configured to reject UDP packets for most (but not all) ports with an ICMP Port Unreachable packet. This may also happen when the firewall is configured to allow UDP packets for most (but not all) ports through and filter/block/drop UDP packets for only a few ports. Both cases are uncommon. Unauthorized users can exploit this information to test vulnerabilities in each of the open services. Shut down any unknown or unused service on the list. If you have difficulty working out which service is provided by which process or program, contact your provider's support team. For more information about commercial and open-source Intrusion Detection Systems available for detecting port scanners of this kind, visit the CERT Web site ( t Applicable Port IANA Assigned Ports/Services Description Service Detected 137 netbios-ns NETBIOS Name Service unknown 1 Open TCP Services List QID: TCP/IP Service Modified: 06/15/2009 The port scanner enables unauthorized users with the appropriate tools to draw a map of all services on this host that can be accessed from the Internet. The test was carried out with a "stealth" port scanner so that the server does not log real connections. The Results section displays the port number (Port), the default service listening on the port (IANA Assigned Ports/Services), the description of the service (Description) and the service that the scanner detected using service discovery (Service Detected). Unauthorized users can exploit this information to test vulnerabilities in each of the open services. Shut down any unknown or unused service on the list. If you have difficulty figuring out which service is provided by which process or program, contact your provider's support team. For more information about commercial and open-source Intrusion Detection Systems available for detecting port scanners of this kind, visit the CERT Web site ( t Applicable Scan Results page 14

15 Port IANA Assigned Ports/Services Description Service Detected OS On Redirected Port 135 msrpc-epmap epmap DCE endpoint resolution DCERPC Endpoint Mapper 139 netbios-ssn NETBIOS Session Service netbios ssn 445 microsoft-ds Microsoft-DS microsoft-ds 8400 cvd cvd http 9004 unknown unknown unknown over ssl 9005 lucent-firewall-management LMF Lucent Firewall Management port unknown over ssl 1 Web Server Version port 8400/tcp QID: Web server Service Modified: 01/01/1999 t Applicable Server Version Apache-Coyote/1.1 Server Banner Apache-Coyote/1.1 1 Links Crawled port 8400/tcp QID: Web Application Service Modified: 10/22/2008 The list of unique links crawled by the Web application scanner appear in the Results section. This list may contain fewer links than the maximum threshold defined at scan launch. The maximum links to crawl includes links in this list, requests made via HTML forms, and requests for the same link made as an anonymous and authenticated user. N/A N/A t Applicable Scan Results page 15

16 Duration of crawl phase (seconds): Number of links: 184 (This number excludes form requests and links re-requested during authentication.) Scan Results page 16

17 Scan Results page

18 External Links Discovered port 8400/tcp QID: Web Application Service Modified: 10/19/2007 The external links discovered by the Web application scanning engine are provided in the Results section. These links were present on the target Web application, but were not crawled. N/A N/A t Applicable Scan Results page 18

19 Number of links: mailto:eventlog-support@manageengine.com Scan Diagnostics port 8400/tcp QID: Web Application Service Modified: 01/16/2009 This check provides various details of the scan's performance and behavior. In some cases, this check can be used to identify problems that the scanner encountered when crawling the target Web application. The scan diagnostics data provides technical details about the crawler's performance and behavior. This information does not necessarily imply problems with the Web application. action is required. t Applicable Collected 230 links overall. Path manipulation: estimated time < 1 minute (97 tests, 3 inputs) Path manipulation: 97 vulnsigs tests, completed 186 requests, 0 seconds. All tests completed. WS enumeration: estimated time < 1 minute (9 tests, 3 inputs) WS enumeration: 9 vulnsigs tests, completed 18 requests, 0 seconds. All tests completed. HTTP call manipulation: estimated time < 1 minute (32 tests, 0 inputs) HTTP call manipulation: 32 vulnsigs tests, completed 0 requests, 0 seconds. tests to execute. Cookie manipulation: estimated time < 1 minute (32 tests, 2 inputs) Cookie manipulation: 32 vulnsigs tests, completed 81 requests, 1 seconds. XSS optimization removed 115 links. Completed 81 requests of 320 estimated requests (25%). All tests completed. Header manipulation: estimated time < 1 minute (32 tests, 5 inputs) Header manipulation: 32 vulnsigs tests, completed 85 requests, 0 seconds. XSS optimization removed 115 links. Completed 85 requests of 320 estimated requests (27%). All tests completed. Total requests made: 623 Average server response time: 0.01 seconds Most recent links: Scan Results page 19

20 Scan launched using PCI WAS combined mode. HTML form authentication unavailable, no WEBAPP entry found Scan Results page 20

21 Appendix Hosts Scanned Target distribution across scanner appliances is_sebyt-ek : Options Profile Payment Card Industry (PCI) Options Scan Settings Ports: Scanned TCP Ports: Full Scanned UDP Ports: Standard Scan Scan Dead Hosts: Off Load Balancer Detection: Off Perform 3-way Handshake: Off Vulnerability Detection: Complete Password Brute Forcing: System: Standard Custom: Disabled Authentication: Windows: Disabled Unix/Cisco IOS: Disabled Oracle: Disabled Oracle Listener: Disabled SNMP: Disabled Overall Performance: Custom Hosts to Scan in Parallel: Use Appliance Parallel ML Scaling: Off External Scanners: 2 Scanner Appliances: 2 Processes to Run in Parallel: Total: 10 HTTP: 10 Packet (Burst) Delay: Medium Port Scanning and Host Discovery: Intensity: rmal Share Enumeration: Windows Share Enumeration: Disabled Advanced Settings Host Discovery: TCP Standard Scan, UDP Standard Scan, ICMP On Ignore firewall-generated TCP RST packets: Off Ignore all TCP RST packets: Off Ignore firewall-generated TCP SYN-ACK packets: Off Do not send TCP ACK or SYN-ACK packets during host discovery: Off Report Legend Scan Results page 21

22 Vulnerability Levels A Vulnerability is a design flaw or mis-configuration which makes your network (or a host on your network) susceptible to malicious attacks from local or remote users. Vulnerabilities can exist in several areas of your network, such as in your firewalls, FTP servers, Web servers, operating systems or CGI bins. Depending on the level of the security risk, the successful exploitation of a vulnerability can vary from the disclosure of information about the host to a complete compromise of the host. Severity Level Description 1 Minimal Intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities. 2 Medium Intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions. 3 Serious Intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mail-relaying. 4 Critical Intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host. 5 Urgent Intruders can easily gain control of the host, which can lead to the compromise of your entire network security. For example, vulnerabilities at this level may include full read and write access to files, remote execution of commands, and the presence of backdoors. Potential Vulnerability Levels A potential vulnerability is one which we cannot confirm exists. The only way to verify the existence of such vulnerabilities on your network would be to perform an intrusive scan, which could result in a denial of service. This is strictly against our policy. Instead, we urge you to investigate these potential vulnerabilities further. Severity Level Description 1 Minimal If this vulnerability exists on your system, intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities. 2 Medium If this vulnerability exists on your system, intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions. 3 Serious If this vulnerability exists on your system, intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mail-relaying. 4 Critical If this vulnerability exists on your system, intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host. 5 Urgent If this vulnerability exists on your system, intruders can easily gain control of the host, which can lead to the compromise of your entire network security. For example, vulnerabilities at this level may include full read and write access to files, remote execution of commands, and the presence of backdoors. Information Gathered Information Gathered includes visible information about the network related to the host, such as traceroute information, Internet Service Provider (ISP), or a list of reachable hosts. Information Gathered severity levels also include Network Mapping data, such as detected firewalls, SMTP banners, or a list of open TCP services. Severity Level Description 1 Minimal Intruders may be able to retrieve sensitive information related to the host, such as open UDP and TCP services lists, and detection of firewalls. Scan Results page 22

23 Severity Level Description 2 Medium Intruders may be able to determine the operating system running on the host, and view banner versions. 3 Serious Intruders may be able to detect highly sensitive data, such as global system user lists. Footnotes This footnote indicates that the CVSS Base score that is displayed for the vulnerability is not supplied by NIST. When the service looked up the latest NIST score for the vulnerability, as published in the National Vulnerability Database (NVD), NIST either listed the CVSS Base score as 0 or did not provide a score in the NVD. In this case, the service determined that the severity of the vulnerability warranted a higher CVSS Base score. The score provided by the service is displayed. CONFIDENTIAL AND PROPRIETARY INFORMATION. Qualys provides the QualysGuard Service "As Is," without any warranty of any kind. Qualys makes no warranty that the information contained in this report is complete or error-free. Copyright 2012, Qualys, Inc. Scan Results page 23

Payment Card Industry (PCI) Executive Report 11/07/2017

Payment Card Industry (PCI) Executive Report 11/07/2017 ASV Scan Report Attestation of Scan Compliance A1. Scan Customer Information A2. Approved Scanning Vendor Information Company: Allied Collection