Scan Results - ( Essentials - Onsharp )

Transcription

1 Scan Results - ( Essentials - Onsharp ) Overview Open Ports (18) Scan ID: Target: Max Score: 2.6 Compliance: Passing PCI compliance, Expires undefined Profile: 15 vulnerabilities, 18 ports open Start: :40:43 scheduled Finish: :10:21 Duration: 0:29:38 Scan Version: Port Protocol Program 21 TCP ProFTPD 1.3.5d 22 TCP OpenSSH 6.7p1 Debian 5+deb8u3 25 TCP Postfix smtpd 53 TCP ISC BIND none 53 UDP ISC BIND none 80 TCP Apache httpd 106 TCP poppassd 110 TCP Dovecot pop3d 143 TCP Dovecot imapd 443 TCP nginx 465 TCP Postfix smtpd 993 TCP Dovecot imapd 995 TCP Dovecot pop3d 4190 TCP Dovecot Pigeonhole sieve 1.0

2 7080 TCP Apache httpd 7081 TCP Apache httpd 8443 TCP sw-cp-server 8880 TCP cddbp-alt Vulnerabilities (15) + Score Title Protocol Port Service False Positive 2.60 POP3 Cleartext Logins Permitted TCP 110 pop3

3 The remote POP3 daemon allows credentials to be transmitted in cleartext. The remote host is running a POP3 daemon that allows cleartext logins over unencrypted connections. An attacker can uncover user names and passwords by sniffing traffic to the POP3 daemon if a less secure authentication mechanism (eg, USER command, AUTH PLAIN, AUTH LOGIN) is used. Resolution Contact your vendor for a fix or encrypt traffic with SSL / TLS using stunnel. The following cleartext methods are supported: USER SASL PLAIN LOGIN DIGEST-MD5 CRAM-MD5 CVE CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N IP Protocols Scan TCP general

4 This plugin detects the protocols understood by the remote IP stack. This plugin detects the protocols understood by the remote IP stack. The following IP protocols are accepted on this host: 1 ICMP 2 IGMP 6 TCP 17 UDP 47 GRE 51 AH 103 PIM 132 SCTP 136 UDPLite 1.00 Additional DNS Hostnames TCP general

5 SecurityMetrics has detected potential virtual hosts. Hostnames different from the current hostname have been collected by miscellaneous plugins. SecurityMetrics has generated a list of hostnames that point to the remote host. Note that these are only the alternate hostnames for vhosts discovered on a web server. Different web servers may be hosted on name-based virtual hosts. Resolution If you want to test them, re-scan using the special vhost syntax, such as: The following hostnames point to the remote host: - essentials-host.onsharp.com 1.00 DNS Server Detection UDP 53 dns

6 A DNS server is listening on the remote host. The remote service is a Domain Name System (DNS) server, which provides a mapping between hostnames and IP addresses. Resolution Disable this service if it is not needed or restrict access to internal hosts only if the service is available externally DNS Server Detection TCP 53 dns A DNS server is listening on the remote host. The remote service is a Domain Name System (DNS) server, which provides a mapping between hostnames and IP addresses. Resolution Disable this service if it is not needed or restrict access to internal hosts only if the service is available externally DNS Server Fingerprinting UDP 53 dns

7 It may be possible to fingerprint the remote DNS server. This script attempts to identify the remote DNS server type and version by sending various invalid requests to the remote DNS server and analyzing the error codes returned. SecurityMetrics was not able to reliably identify the remote DNS server type. It might be: ISC BIND P4 ISC BIND ISC BIND The fingerprint differs from these known signatures on 1 points. If you know the type and version of the remote DNS server, please send the following signature to dns-signatures@securitymetrics.com: 4q:5:5:1q:1:1:1q:1q:1q:5:0AAX:5:5:5Z0:5:5:4q:4q:4q:5:5:5:0AAXD: 1.00 DNS Sender Policy Framework (SPF) Enabled UDP 53 dns

8 The remote domain publishes SPF records. The remote domain publishes SPF records. SPF (Sender Policy Framework) is a mechanism to let an organization specify their mail sending policy, such as which mail servers are authorized to send mail on its behalf. The following SPF records could be extracted for onsharp.com: v=spf1 +a +mx +a:essentials-host.onsharp.com -all 1.00 DNS Server hostname.bind Map Hostname Disclosure UDP 53 dns The DNS server discloses the remote host name. It is possible to learn the remote host name by querying the remote DNS server for 'hostname.bind' in the CHAOS domain. Resolution It may be possible to disable this feature. Consult the vendor's documentation for more information. The remote host name is: essentials-host.onsharp.com 1.00 DNS Server Version Detection TCP 53 dns

9 SecurityMetrics was able to obtain version information on the remote DNS server. SecurityMetrics was able to obtain version information by sending a special TXT record query to the remote host. Note that this version is not necessarily accurate and could even be forged, as some DNS servers send the information based on a configuration file. DNS server answer for "version.bind" (over TCP): none 1.00 IMAP Service Banner Retrieval TCP 143 imap An IMAP server is running on the remote host. An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. The remote imap server banner is: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready IMAP Service Banner Retrieval TCP 993 imap

10 An IMAP server is running on the remote host. An IMAP (Internet Message Access Protocol) server is installed and running on the remote host. The remote imap server banner is: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=CRAM-MD5] Dovecot ready FTP Server Detection TCP 21 ftp An FTP server is listening on a remote port. It is possible to obtain the banner of the remote FTP server by connecting to a remote port. The remote FTP banner is: 220 ProFTPD 1.3.5d Server (ProFTPD) [ ] 1.00 SSH Server Type and Version Information TCP 22 ssh

11 An SSH server is listening on this port. It is possible to obtain information about the remote SSH server by sending an empty authentication request. SSH version: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3 SSH supported authentication: publickey,password 1.00 IMAP Service STARTTLS Command Support TCP 143 imap The remote mail service supports encrypting traffic. The remote IMAP service supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. Here is the IMAP server's SSL certificate that SecurityMetrics was able to collect after sending a 'STARTTLS' command: snip Subject Name: Country: CH Locality: Schaffhausen Organization: Plesk Common Name: Plesk Address: info@plesk.com Issuer Name:

12 Country: CH Locality: Schaffhausen Organization: Plesk Common Name: Plesk Address: Serial Number: 59 0B 84 F8 Version: 1 Signature Algorithm: SHA-256 With RSA Encryption Not Valid Before: May 04 19:46: GMT Not Valid After: May 04 19:46: GMT Public Key Info: Algorithm: RSA Encryption Key Length: 2048 bits Public Key: 00 BE A8 B0 9C 2E F7 C9 DD B9 36 BC 9F A D3 FF B1 27 7B 88 DE D4 6F 7C 57 5F 94 5E E F7 CE 63 B8 EE 1B D0 A8 FA 9A A5 B6 C FD BF F6 E7 EB 7E A A E4 35 8C 6A 04 BF 10 4E 18 4C E 5B BD E9 58 BB AA 0B AD 03 F9 15 E F3 0C BB 32 C8 68 A5 30 DF D2 FE 7C AF EB 3A CC 9B 0D 38 6E B1 3E B8 C9 64 B5 AF C6 2E AA 54 7C FC 05 8D 1C 4F F 66 8C B FA 61 1B 26 6E 94 CA 66 D C6 9A B0 1D 95 E AA 9A B3 A7 27 C6 16 9C C A F0 75 2C 53 4F 3C 81 4A 50 7A C C9 BE F4 1B 2B 40 C E B7 8C 3D 0D DB 79 9B 4C A4 F6 65 FB 8A AB E6 C2 9A 36 4B 2E D1 A4 4F 52 FE 01 1A B1 D2 93 BF FC F7 F4 23 Exponent: Signature Length: 256 bytes / 2048 bits Signature: 00 BB 7B C8 D E A0 F9 F9 06 AE 5B 6E 45 5F D3 D D CA D9 A BA 1C DE AD 5D 3D

13 D3 D D CA D9 A BA 1C DE AD 5D 3D AB 8C 2A 62 0F AF B B3 14 E2 9E E2 C1 B4 2D 44 FF 8E 31 AC FA F5 7E 7F E ED 42 9A F8 02 2F C1 F3 8A 4B AB C8 DF 9B 2F F0 9A 1B 03 4D B3 4F 3A 46 B1 D7 52 2D DE FF 8E BC AD C9 29 D2 D8 F6 15 2D FD F8 59 B5 68 AF 47 D2 EB 75 7E 2F 51 ED C9 BF AC C0 5A DD E6 1E CA C F B3 F5 F5 36 DC 70 BC 42 5F A8 D DD 47 9F D BC D9 38 1D FB 35 6F FE BD FA A2 5D CD DB D3 8B 2F 7D C6 9C 93 2E 61 CA 33 3C 0B 53 3A AD B1 D3 46 8D 36 E0 B1 FA C3 93 AA 30 EC 7D CF 62 F6 8B D 32 B1 1B AA 7E F3 C8 03 3F 74 FB 42 4B 6C 1A 9C B snip POP3 Service STLS Command Support TCP 110 pop3 The remote mail service supports encrypting traffic. The remote POP3 service supports the use of the 'STLS' command to switch from a cleartext to an encrypted communications channel. Here is the POP3 server's SSL certificate that SecurityMetrics was able to collect after sending a 'STLS' command: snip Subject Name: Country: CH Locality: Schaffhausen

14 Locality: Schaffhausen Organization: Plesk Common Name: Plesk Address: Issuer Name: Country: CH Locality: Schaffhausen Organization: Plesk Common Name: Plesk Address: Serial Number: 59 0B 84 F8 Version: 1 Signature Algorithm: SHA-256 With RSA Encryption Not Valid Before: May 04 19:46: GMT Not Valid After: May 04 19:46: GMT Public Key Info: Algorithm: RSA Encryption Key Length: 2048 bits Public Key: 00 BE A8 B0 9C 2E F7 C9 DD B9 36 BC 9F A D3 FF B1 27 7B 88 DE D4 6F 7C 57 5F 94 5E E F7 CE 63 B8 EE 1B D0 A8 FA 9A A5 B6 C FD BF F6 E7 EB 7E A A E4 35 8C 6A 04 BF 10 4E 18 4C E 5B BD E9 58 BB AA 0B AD 03 F9 15 E F3 0C BB 32 C8 68 A5 30 DF D2 FE 7C AF EB 3A CC 9B 0D 38 6E B1 3E B8 C9 64 B5 AF C6 2E AA 54 7C FC 05 8D 1C 4F F 66 8C B FA 61 1B 26 6E 94 CA 66 D C6 9A B0 1D 95 E AA 9A B3 A7 27 C6 16 9C C A F0 75 2C 53 4F 3C 81 4A 50 7A C C9 BE F4 1B 2B 40 C E B7 8C 3D 0D DB 79 9B 4C A4 F6 65 FB 8A AB E6 C2 9A 36

15 4B 2E D1 A4 4F 52 FE 01 1A B1 D2 93 BF FC F7 F4 23 Exponent: Signature Length: 256 bytes / 2048 bits Signature: 00 BB 7B C8 D E A0 F9 F9 06 AE 5B 6E 45 5F D3 D D CA D9 A BA 1C DE AD 5D 3D AB 8C 2A 62 0F AF B B3 14 E2 9E E2 C1 B4 2D 44 FF 8E 31 AC FA F5 7E 7F E ED 42 9A F8 02 2F C1 F3 8A 4B AB C8 DF 9B 2F F0 9A 1B 03 4D B3 4F 3A 46 B1 D7 52 2D DE FF 8E BC AD C9 29 D2 D8 F6 15 2D FD F8 59 B5 68 AF 47 D2 EB 75 7E 2F 51 ED C9 BF AC C0 5A DD E6 1E CA C F B3 F5 F5 36 DC 70 BC 42 5F A8 D DD 47 9F D BC D9 38 1D FB 35 6F FE BD FA A2 5D CD DB D3 8B 2F 7D C6 9C 93 2E 61 CA 33 3C 0B 53 3A AD B1 D3 46 8D 36 E0 B1 FA C3 93 AA 30 EC 7D CF 62 F6 8B D 32 B1 1B AA 7E F3 C8 03 3F 74 FB 42 4B 6C 1A 9C B snip SecurityMetrics. All rights reserved.