192.168.0.110

Repartition of the level of the security problems :

List of open ports :

• http (80/tcp) (Security hole found)
• ssh (22/tcp) (Security notes found)
• domain (53/tcp)
• https (443/tcp) (Security hole found)
• ipp (631/tcp) (Security notes found)

Vulnerability found on port http (80/tcp)

The target is running a version of the Mailman mailing list software
that might suffer from a directory traversal vulnerability in
Cgi/private.py. This flaw comes into play only on web servers that
don't strip extraneous slashes from URLs, such as Apache 1.3.x, and
allows a list subscriber, using a specially crafted web request, to
retrieve arbitrary files from the server - any file accessible by the
user under which the web server operates, including email addresses
and passwords of subscribers of any lists hosted on the server.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Mailman installed
***** there.

See also : http://lists.netsys.com/pipermail/full-disclosure/2005-February/031562.html

Solution : Upgrade to Mailman 2.1.6 as soon as it becomes available or
apply the fix described in the URL above.

Risk factor : High
CVE : CAN-2005-0202
BID : 12504
Nessus ID : 16339

Information found on port http (80/tcp)

A web server is running on this port
Nessus ID : 10330

Information found on port http (80/tcp)

The remote web server type is :

Apache/2.0.52 (Fedora)


Solution : You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Nessus ID : 10107

Information found on port http (80/tcp)

Mailman 2.1.5 was detected on the remote host under the path /mailman.

Mailman is a Python-based mailing list management package from the GNU
Project. See http://www.list.org/ for more information.

Risk factor : None
Nessus ID : 16338

Information found on port ssh (22/tcp)

An ssh server is running on this port
Nessus ID : 10330

Information found on port ssh (22/tcp)

Remote SSH version : SSH-1.99-OpenSSH_3.9p1

Remote SSH supported authentication : publickey,gssapi-with-mic,password


Nessus ID : 10267

Vulnerability found on port https (443/tcp)

The target is running a version of the Mailman mailing list software
that might suffer from a directory traversal vulnerability in
Cgi/private.py. This flaw comes into play only on web servers that
don't strip extraneous slashes from URLs, such as Apache 1.3.x, and
allows a list subscriber, using a specially crafted web request, to
retrieve arbitrary files from the server - any file accessible by the
user under which the web server operates, including email addresses
and passwords of subscribers of any lists hosted on the server.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Mailman installed
***** there.

See also : http://lists.netsys.com/pipermail/full-disclosure/2005-February/031562.html

Solution : Upgrade to Mailman 2.1.6 as soon as it becomes available or
apply the fix described in the URL above.

Risk factor : High
CVE : CAN-2005-0202
BID : 12504
Nessus ID : 16339

Information found on port https (443/tcp)

A SSLv2 server answered on this port

Nessus ID : 10330

Information found on port https (443/tcp)

A web server is running on this port through SSL
Nessus ID : 10330

Information found on port https (443/tcp)

The remote web server type is :

Apache/2.0.52 (Fedora)


Solution : You can set the directive 'ServerTokens Prod' to limit
the information emanating from the server in its response headers.
Nessus ID : 10107

Information found on port https (443/tcp)

Mailman 2.1.5 was detected on the remote host under the path /mailman.

Mailman is a Python-based mailing list management package from the GNU
Project. See http://www.list.org/ for more information.

Risk factor : None
Nessus ID : 16338

Information found on port ipp (631/tcp)

A web server is running on this port
Nessus ID : 10330

Information found on port ipp (631/tcp)

The remote web server type is :

CUPS/1.1

Solution : We recommend that you configure (if possible) your web server to return
a bogus Server header in order to not leak information.

Nessus ID : 10107