Отчет Audit report RAPID7
0 likes2,909 views
The audit report summarizes a security audit performed on May 28, 2014. The audit found 2 vulnerabilities on 1 system, with no critical vulnerabilities. The most common vulnerabilities were related to TCP sequence number approximation and generic ICMP timestamp responses. To address these issues, patches need to be applied to disable ICMP timestamp responses and enable TCP MD5 signatures.
More Related Content
What's hot (20)
Similar to Отчет Audit report RAPID7 (20)
More from Sergey Yrievich (20)
Recently uploaded (20)
Отчет Audit report RAPID7
- 1. Audit Report Audit_report_pdf Audited on May 28, 2014 Reported on May 28, 2014
- 2. Page 1 Audit Report 1. Executive Summary This report represents a security audit performed by Nexpose from Rapid7 LLC. It contains confidential information about the state of your network. Access to this information by unauthorized personnel may allow them to compromise your network. Site Name Start Time End Time Total Time Status mikrotik-vpn ( 9 x x x x x x 2 ) May 28, 2014 01:29, PDT May 28, 2014 01:35, PDT 6 minutes Success There is not enough historical data to display risk trend. The audit was performed on one system which was found to be active and was scanned. There were 2 vulnerabilities found during this scan. No critical vulnerabilities were found. Critical vulnerabilities require immediate attention. They are relatively easy for attackers to exploit and may provide them with full control of the affected systems. One vulnerability was severe. Severe vulnerabilities are often harder to exploit and may not provide the same access to affected systems. There was one moderate vulnerability discovered. These often provide information to attackers that may assist them in mounting subsequent attacks on your network. These should also be fixed in a timely manner, but are not as urgent as the other vulnerabilities. There were 1 occurrences of the tcp-seq-num-approximation and generic-icmp-timestamp vulnerabilities, making them the most common vulnerabilities. There were 2 vulnerabilities in the Network category, making it the most common vulnerability category.
- 3. Page 2 Audit Report The tcp-seq-num-approximation vulnerability poses the highest risk to the organization with a risk score of 194. Risk scores are based on the types and numbers of vulnerabilities on affected assets. One operating system was identified during this scan. There were 6 services found to be running during this scan. The DNS, DNS-TCP, ISAKMP, PPTP, SSH and callbook services were found on 1 systems, making them the most common services.
- 4. • Page 3 Audit Report 2. Discovered Systems Node Operating System Risk Aliases 9 x x x x x x2 Linux 1.27 194 MikroTik
- 5. Page 4 Audit Report 3. Discovered and Potential Vulnerabilities 3.1. Critical Vulnerabilities No critical vulnerabilities were reported. 3.2. Severe Vulnerabilities 3.2.1. TCP Sequence Number Approximation Vulnerability (tcp-seq-num-approximation) Description: TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. Affected Nodes: Affected Nodes: Additional Information: 9 x x x x x x2 TCP reset with incorrect sequence number triggered this fault on 9 x x x x x x2:2x x0: An existing connection was forcibly closed by the remote host References: Source Reference BID 10183 CERT TA04-111A CERT-VN 415294 CVE CVE-2004-0230 MS MS05-019 MS MS06-064 NETBSD NetBSD-SA2004-006 OSVDB 4030 OVAL OVAL2689 OVAL OVAL270 OVAL OVAL3508 OVAL OVAL4791 OVAL OVAL5711
- 6. • • • • • • • • Page 5 Audit Report Source Reference SECUNIA 11440 SECUNIA 11458 SECUNIA 22341 SGI 20040403-01-A URL ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc URL http://tools.ietf.org/html/draft-ietf-tcpm-tcpsecure-12 URL http://www.uniras.gov.uk/vuls/2004/236929/index.htm XF 15886 Vulnerability Solution: Enable TCP MD5 Signatures Enable the TCP MD5 signature option as documented in RFC 2385. It was designed to reduce the danger from certain security attacks on BGP, such as TCP resets. Microsoft Windows 2000 SP4 OR SP3 (x86), Microsoft Windows 2000 Professional SP4 OR SP3 (x86), Microsoft Windows 2000 Server SP4 OR SP3 (x86), Microsoft Windows 2000 Advanced Server SP4 OR SP3 (x86), Microsoft Windows 2000 Datacenter Server SP4 OR SP3 (x86) MS05-019: Security Update for Windows 2000 (KB893066) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=36661 Microsoft Windows Server 2003 < SP1 (x86), Microsoft Windows Server 2003, Standard Edition < SP1 (x86), Microsoft Windows Server 2003, Enterprise Edition < SP1 (x86), Microsoft Windows Server 2003, Datacenter Edition < SP1 (x86), Microsoft Windows Server 2003, Web Edition < SP1 (x86), Microsoft Windows Small Business Server 2003 < SP1 (x86) MS05-019: Security Update for Windows Server 2003 (KB893066) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=36661 Microsoft Windows XP Professional SP2 OR SP1 (x86), Microsoft Windows XP Home SP2 OR SP1 (x86) MS05-019: Security Update for Windows XP (KB893066) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=36661 Microsoft Windows XP Professional SP1 OR SP2 (x86), Microsoft Windows XP Home SP1 OR SP2 (x86) MS06-064: Security Update for Windows XP (KB922819) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=73864 Microsoft Windows Server 2003 SP1 (x86_64), Microsoft Windows Server 2003, Standard Edition SP1 (x86_64), Microsoft Windows Server 2003, Enterprise Edition SP1 (x86_64), Microsoft Windows Server 2003, Datacenter Edition SP1 (x86_64), Microsoft Windows Server 2003, Web Edition SP1 (x86_64), Microsoft Windows Small Business Server 2003 SP1 (x86_64) MS06-064: Security Update for Windows Server 2003 x64 Edition (KB922819) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=73864 Microsoft Windows XP Professional SP1 (x86_64) MS06-064: Security Update for Windows XP x64 Edition (KB922819) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=73864 Microsoft Windows Server 2003 SP1 OR < SP1 (ia64), Microsoft Windows Server 2003, Standard Edition SP1 OR < SP1 (ia64), Microsoft Windows Server 2003, Enterprise Edition SP1 OR < SP1 (ia64), Microsoft Windows Server 2003, Datacenter Edition SP1
- 7. • • Page 6 Audit Report OR < SP1 (ia64), Microsoft Windows Server 2003, Web Edition SP1 OR < SP1 (ia64), Microsoft Windows Small Business Server 2003 SP1 OR < SP1 (ia64) MS06-064: Security Update for Windows Server 2003 for Itanium-based Systems (KB922819) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=73864 Microsoft Windows Server 2003 SP1 OR < SP1 (x86), Microsoft Windows Server 2003, Standard Edition SP1 OR < SP1 (x86), Microsoft Windows Server 2003, Enterprise Edition SP1 OR < SP1 (x86), Microsoft Windows Server 2003, Datacenter Edition SP1 OR < SP1 (x86), Microsoft Windows Server 2003, Web Edition SP1 OR < SP1 (x86), Microsoft Windows Small Business Server 2003 SP1 OR < SP1 (x86) MS06-064: Security Update for Windows Server 2003 (KB922819) Download and apply the patch from: http://go.microsoft.com/fwlink/?LinkId=73864 Locate and fix vulnerable traffic inspection devices along the route to the target In many situations, target systems are, by themselves, patched or otherwise unaffected by this vulnerability. In certain configurations, however, unaffected systems can be made vulnerable if the path between an attacker and the target system contains an affected and unpatched network device such as a firewall or router and that device is responsible for handling TCP connections for the target. In this case, locate and apply remediation steps for network devices along the route that are affected. 3.3. Moderate Vulnerabilities 3.3.1. ICMP timestamp response (generic-icmp-timestamp) Description: The remote host responded to an ICMP timestamp request. The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services. In addition, the versions of some operating systems can be accurately fingerprinted by analyzing their responses to invalid ICMP timestamp requests. Affected Nodes: Affected Nodes: Additional Information: 9 x x x x x x2 Remote system time: 01:35:38.205 PDT References: Source Reference CVE CVE-1999-0524 OSVDB 95 XF 306 XF 322
- 8. • • • • • Page 7 Audit Report Vulnerability Solution: HP-UX Disable ICMP timestamp responses on HP/UX Execute the following command: ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Cisco IOS Disable ICMP timestamp responses on Cisco IOS Use ACLs to block ICMP types 13 and 14. For example: deny icmp any any 13 deny icmp any any 14 Note that it is generally preferable to use ACLs that block everything by default and then selectively allow certain types of traffic in. For example, block everything and then only allow ICMP unreachable, ICMP echo reply, ICMP time exceeded, and ICMP source quench: permit icmp any any unreachable permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any source-quench The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). SGI Irix Disable ICMP timestamp responses on SGI Irix IRIX does not offer a way to disable ICMP timestamp responses. Therefore, you should block ICMP on the affected host using ipfilterd, and/or block it at any external firewalls. The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Linux Disable ICMP timestamp responses on Linux Linux offers neither a sysctl nor a /proc/sys/net/ipv4 interface to disable ICMP timestamp responses. Therefore, you should block ICMP on the affected host using iptables, and/or block it at the firewall. For example: ipchains -A input -p icmp --icmp-type timestamp-request -j DROP ipchains -A output -p icmp --icmp-type timestamp-reply -j DROP The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Microsoft Windows NT, Microsoft Windows NT Workstation, Microsoft Windows NT Server, Microsoft Windows NT Advanced Server, Microsoft Windows NT Server, Enterprise Edition, Microsoft Windows NT Server, Terminal Server Edition Disable ICMP timestamp responses on Windows NT 4
- 9. • • • • Page 8 Audit Report Windows NT 4 does not provide a way to block ICMP packets. Therefore, you should block them at the firewall. The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). OpenBSD Disable ICMP timestamp responses on OpenBSD Set the "net.inet.icmp.tstamprepl" sysctl variable to 0. sysctl -w net.inet.icmp.tstamprepl=0 The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Cisco PIX Disable ICMP timestamp responses on Cisco PIX A properly configured PIX firewall should never respond to ICMP packets on its external interface. In PIX Software versions 4.1(6) until 5.2.1, ICMP traffic to the PIX's internal interface is permitted; the PIX cannot be configured to NOT respond. Beginning in PIX Software version 5.2.1, ICMP is still permitted on the internal interface by default, but ICMP responses from its internal interfaces can be disabled with the icmp command, as follows, where <inside> is the name of the internal interface: icmp deny any 13 <inside> icmp deny any 14 <inside> Don't forget to save the configuration when you are finished. See Cisco's support document Handling ICMP Pings with the PIX Firewall for more information. The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Sun Solaris Disable ICMP timestamp responses on Solaris Execute the following commands: /usr/sbin/ndd -set /dev/ip ip_respond_to_timestamp 0 /usr/sbin/ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0 The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response). Microsoft Windows 2000, Microsoft Windows 2000 Professional, Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Datacenter Server Disable ICMP timestamp responses on Windows 2000 Use the IPSec filter feature to define and apply an IP filter list that blocks ICMP types 13 and 14. Note that the standard TCP/IP blocking capability under the "Networking and Dialup Connections" control panel is NOT capable of blocking ICMP (only TCP and UDP). The IPSec filter features, while they may seem strictly related to the IPSec standards, will allow you to selectively block these ICMP packets. See http://support.microsoft.com/kb/313190 for more information. The easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14 (timestamp response).
- 10. • 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. • 1. 2. 3. 4. 5. 6. • Page 9 Audit Report Microsoft Windows XP, Microsoft Windows XP Home, Microsoft Windows XP Professional, Microsoft Windows Server 2003, Microsoft Windows Server 2003, Standard Edition, Microsoft Windows Server 2003, Enterprise Edition, Microsoft Windows Server 2003, Datacenter Edition, Microsoft Windows Server 2003, Web Edition, Microsoft Windows Small Business Server 2003 Disable ICMP timestamp responses on Windows XP/2K3 ICMP timestamp responses can be disabled by deselecting the "allow incoming timestamp request" option in the ICMP configuration panel of Windows Firewall. Go to the Network Connections control panel. Right click on the network adapter and select "properties", or select the internet adapter and select File->Properties. Select the "Advanced" tab. In the Windows Firewall box, select "Settings". Select the "General" tab. Enable the firewall by selecting the "on (recommended)" option. Select the "Advanced" tab. In the ICMP box, select "Settings". Deselect (uncheck) the "Allow incoming timestamp request" option. Select "OK" to exit the ICMP Settings dialog and save the settings. Select "OK" to exit the Windows Firewall dialog and save the settings. Select "OK" to exit the internet adapter dialog. For more information, see: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en- us/hnw_understanding_firewall.mspx?mfr=true Microsoft Windows Vista, Microsoft Windows Vista Home, Basic Edition, Microsoft Windows Vista Home, Basic N Edition, Microsoft Windows Vista Home, Premium Edition, Microsoft Windows Vista Ultimate Edition, Microsoft Windows Vista Enterprise Edition, Microsoft Windows Vista Business Edition, Microsoft Windows Vista Business N Edition, Microsoft Windows Vista Starter Edition, Microsoft Windows Server 2008, Microsoft Windows Server 2008 Standard Edition, Microsoft Windows Server 2008 Enterprise Edition, Microsoft Windows Server 2008 Datacenter Edition, Microsoft Windows Server 2008 HPC Edition, Microsoft Windows Server 2008 Web Edition, Microsoft Windows Server 2008 Storage Edition, Microsoft Windows Small Business Server 2008, Microsoft Windows Essential Business Server 2008 Disable ICMP timestamp responses on Windows Vista/2008 ICMP timestamp responses can be disabled via the netsh command line utility. Go to the Windows Control Panel. Select "Windows Firewall". In the Windows Firewall box, select "Change Settings". Enable the firewall by selecting the "on (recommended)" option. Open a Command Prompt. Enter "netsh firewall set icmpsetting 13 disable" For more information, see: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en- us/hnw_understanding_firewall.mspx?mfr=true Disable ICMP timestamp responses Disable ICMP timestamp replies for the device. If the device does not support this level of configuration, the easiest and most effective solution is to configure your firewall to block incoming and outgoing ICMP packets with ICMP types 13 (timestamp request) and 14
- 11. Page 10 Audit Report (timestamp response).
- 12. • • • • Page 11 Audit Report 4. Discovered Services 4.1. DNS DNS, the Domain Name System, provides naming services on the Internet. DNS is primarily used to convert names, such as www.rapid7.com to their corresponding IP address for use by network programs, such as a browser. 4.1.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 udp 53 0 4.2. DNS-TCP DNS, the Domain Name System, provides naming services on the Internet. DNS is primarily used to convert names, such as www.rapid7.com to their corresponding IP address for use by network programs, such as a browser. This service is used primarily for zone transfers between DNS servers. It can, however, be used for standard DNS queries as well. 4.2.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 tcp 53 0 4.3. ISAKMP ISAKMP, the Internet Security Association and Key Management Protocol, is used to negotiate and manage security associations for protocols. IKE, the Internet Key Exchange protocol, combines the ISAKMP, Oakley and SKEME protocols to negotiate key exchanges. IPSec, the IP Security protocol uses IKE and ISAKMP to negotiate the encryption and authentication mechanisms to be used. 4.3.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 udp 500 0 4.4. PPTP The Point-to-Point Tunneling Protocol (PPTP) is an extension to PPP. It allows PPP packets to be wrapped in IP datagrams for transmission over a TCP/IP network. 4.4.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 tcp 1723 0 firmware-revision: 1 hostname: MikroTik vendor: MikroTik version: 1.0
- 13. Page 12 Audit Report 4.5. SSH SSH, or Secure SHell, is designed to be a replacement for the aging Telnet protocol. It primarily adds encryption and data integrity to Telnet, but can also provide superior authentication mechanisms such as public key authentication. 4.5.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 tcp 22 0 4.6. callbook 4.6.1. Discovered Instances of this Service Device Protocol Port Vulnerabilities Additional Information 9 x x x x x x2 tcp 2000 0
- 14. Page 13 Audit Report 5. Discovered Users and Groups No user or group information was discovered during the scan.
- 15. Page 14 Audit Report 6. Discovered Databases No database information was discovered during the scan.
- 16. Page 15 Audit Report 7. Discovered Files and Directories No file or directory information was discovered during the scan.
- 17. Page 16 Audit Report 8. Policy Evaluations No policy evaluations were performed.
- 18. Page 17 Audit Report 9. Spidered Web Sites No web sites were spidered during the scan.