MyDoom Virus Backdoor Detection

The MyDoom backdoor is listening on this port. An attacker may connect to it to retrieve sensitive information, e.g. passwords or credit card numbers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. rev 1.7: fixes a bug introduced in rev 1.6 spotted by Phil Bordelon rev 1.6: MyDoom.B detecti...

Microsoft Windows SMB : WindowsUpdate Disabled

The remote host does not have Windows Update enabled. Enabling WindowsUpdate will ensure that the remote Windows host has all the latest Microsoft Patches installed. C Tenable Network Security, Inc. Thanks to Greg Hoglund for suggesting this. include"compat.inc"; if description scriptid12028;...

Bagle Worm Removal

The remote host had the Bagle worm installed. Nessus attempted to remove it by connecting to port 6777 of the host and using the built-in removal command. However, you should verify that : - The worm was removed properly - The remote host has not been altered in any other way. C Tenable Network...

VCATCH Spyware Detection

The remote host is using the VCATCH program. You should ensure that : - the user intended to install VCATCH it is sometimes silently installed - the use of VCATCH matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out ad-aware or spybot. ...

BargainBuddy Software Detection

BargainBuddy is installed on the remote host. This is an adware program that monitors web searches and displays advertisements based on the search terms. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid12010; scriptversion"1.17";...

DOWNLOADWARE Software Detection

The remote host is using the DOWNLOADWARE program. You should ensure that: - the user intended to install DOWNLOADWARE it is sometimes silently installed - the use of DOWNLOADWARE matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out...

Zope < 2.6.3 Multiple Vulnerabilities

The remote web server is a version of Zope which is older than version 2.6.3. There are multiple security issues in all releases prior to version 2.6.3 or 2.7 BETA4 which can be exploited by an attacker to perform cross-site scripting attacks, obtain information about the remote host, or disable...

MS03-049: Buffer Overflow in the Workstation Service (828749)

The remote version of Windows contains a flaw in the function NetpValidateName in the WorkStation service that could allow an attacker to execute arbitrary code on the remote host with the SYSTEM privileges. A series of worms Welchia, Spybot, ... are known to exploit this vulnerability in the wil...

DCN HELLO detection

The remote host is running HELLO, an obsolete routing protocol. If possible, this IP protocol should be disabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. See RFC 831 & gated source hello.h http://www.zvon.org/tmRFC/RFC891/Output/chapter2.html include'deprecatednasllevel.inc';...

BGP Service Detection

The remote host is running BGP, a popular routing protocol. This indicates that the remote host is probably a network router. C Tenable Network Security, Inc. See RFC 1771 include"compat.inc"; ifdescription scriptid11907; scriptversion "1.13"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"B...

EGP Detection

The remote host is running EGP, an obsolete routing protocol. If possible, this IP protocol should be disabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. See RFC 827 & RFC 888 include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid11908; scriptversion"1.19";...

Microsoft IIS ODBC Tool getdrvrs.exe DSN Creation

ODBC tools are present on the remote host. ODBC tools could allow a malicious user to hijack and redirect ODBC traffic, obtain SQL user names and passwords or write files to the local drive of a vulnerable server. Example: http://www.example.com/scripts/tools/getdrvrs.exe %NASLMINLEVEL 70300 This...

FsSniffer Backdoor Detection

This host appears to be running FsSniffer on this port. FsSniffer is backdoor which allows an intruder to steal PoP3/FTP and other passwords you use on your system. An attacker may use it to steal your passwords. This script was written by Joseph Mlodzianowski Changes by Tenable: - Revised plugin...

Solaris sadmind AUTH_SYS Credential Remote Command Execution

The remote host is running the sadmind RPC service. It is possible to misuse this service to execute arbitrary commands on this host as root. C Tenable Network Security, Inc. Greatly improved by H D Moore include"compat.inc"; if description scriptid11841; scriptversion"1.34"; scriptcvsdate"Date:...

MS03-039 Exploitation Backdoor Account Detection

It was possible to log into the remote host with the login 'e' and the password 'asd321'. A widely available exploit, using one of the vulnerabilities described in the Microsoft Bulletin MS03-039 creates such an account. This probably means that the remote host has been compromised by the use of...

MS03-034: Flaw in NetBIOS Could Lead to Information Disclosure (824105) (uncredentialed check)

The remote host is running a version of the NetBT name service that suffers from a memory disclosure problem. An attacker may send a special packet to the remote NetBT name service, and the reply will contain random arbitrary data from the remote host memory. This arbitrary data may be a fragment...

Postfix < 2.0 Multiple Vulnerabilities

The remote host is running a version of Postfix that is as old as or older than 1.1.12. There are two vulnerabilities in this version that could allow an attacker to remotely disable it, or to be used as a DDoS agent against arbitrary hosts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

MS Blaster Worm (msblast.exe) Infection Detection

The remote host seems to be infected by the MS Blaster worm, or the Nachi worm, which may make this host attack random hosts on the internet. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11818; scriptversion"1.28"; scriptcvsdate"Date: 2018/11/15 20:50:28";...

MS03-021: Windows Media Player Library Access (819639)

An ActiveX control included with Windows Media Player 9 Series may allow a rogue website to gain information about the remote host. An attacker could exploit this flaw to execute arbitrary code on this host with the privileges of the user running Windows Media Player. To exploit this flaw, an...

RADIUS Server Detection

The remote host is running a RADIUS server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11738; scriptversion"1.26"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"RADIUS Server Detection"; scriptsetattributeattribute:"synopsis", value:"The remote host is...