On Mon, Jun 13, 2005 at 06:22:53PM -0400, kalin mintchev wrote: > i got a few false security holes so i was wondering why. > where is nessus getting its wrong information from?...
In general, plugins identify flaws in one of three ways: o A banner check o A check of installed software o Direct exploitation of a flaw There are pros and cons associated with each method, but in general I'd argue that banner checks are often the least reliable. For example, many Linux distros regularly patch a vulnerability without updating the banner. And sysadmins can tweak banners in an effort to mislead / play with attackers. So before you dismiss the scan results as false positives, I'd encourage you to investigate. Either study the plugin responsible for a questionable result or post sufficient detail that others can determine how the plugin works. And make sure you're looking at the same port that Nessus is. > for example i got a security hole warning for ssh on a > freebsd machine. it says that the machine is running > OpenSSH older then 3.7.1. it's not. here: # ssh -V > OpenSSH_3.9p1, OpenSSL 0.9.7d 17 Mar 2004 All that tells me is the version of ssh encountered first in the default path. Since OpenSSH displays a banner when a connection is established to a server, a better test would be to open a connection to the affected port and see what is reported; eg, [EMAIL PROTECTED]:~>nc localhost 22 SSH-2.0-OpenSSH_3.9p1 This is for OpenSSL 3.9p1 compiled from source. Keep in mind, though, that this by itself is just a banner check and without details on the actual report you received I have no idea whether that's what the plugin is doing. > and also i got a security hole for php 4.3 when the > machine is running 4.3.10 # php -v > PHP 4.3.10 (cli) (built: Feb 10 2005 14:16:46) Again, you're looking at the version reported by a commandline utility, and this differ from what's actually in use. > the nessus server information is: > # nessus -v > nessus (Nessus) 2.0.10 for FreeBSD Versions 2.0.x are no longer supported; please upgrade to 2.2.x (2.2.4 is the latest). George -- [EMAIL PROTECTED] _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
