Nessus returns inconsistent risk ratings when it is able to access a Windows share.
On a Windows 2003 server, the risk factor is 'None.' On an AIX server running Samba, the risk factor is 'High / CVSS Base Score : 7 (AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)' Both results are returned from Plugin 10396, and the text of the finding is the same (except that the share names and contents are different). Each server has both readable and readable/writable shares. The only difference is that the "service" is 'netbios-ssn (139/tcp)' on AIX and 'microsoft-ds (445/tcp)' on Windows. In both cases, Nessus is using credentials and the account it is using has access to the shares, so it is not a vulnerability. Is there a way to resolve this discrepancy? John Scherff Sr. IT Security Analyst 24 Hour Fitness
_______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
