#3 VM Image is easly hacked

[zknight777]

Please read the infromation below. This was done by our forensics division at University of Washington. You may have to put a warning on this image, letting the user know that, it needs to be secured before use on a network.

microsoft-ds (445/tcp):Synopsis : It is possible to enumerate remote network shares. Description : By connecting to the remote host using a NULL (or guest) session Nessus was able to enumerate the network share names. Risk factor : None Plugin output : Here is the list of the SMB shares of this host : print$ private public data IPC$ ADMIN$

http (80/tcp): Synopsis : The remote web server itself is prone to cross-site scripting attacks. Description : The remote host is running a web server that fails to adequately sanitize request strings of Javascript. By exploiting this flaw, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. Solution : Contact the vendor for a patch or upgrade. Risk factor : Medium / CVSS Base Score : 4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N) Plugin output : The request string used to detect this flaw was: <script>cross_site_scripting.nasl</script> CVE : CVE-2002-1060, CVE-2005-2453, CVE-2006-1681 BID : 5305, 7344, 7353, 8037, 14473, 17408 Other references : OSVDB:18525, OSVDB:24469

netbios-ns (137/udp): Synopsis : It is possible to obtain the network name of the remote host. Description : The remote host listens on udp port 137 and replies to NetBIOS nbtscan requests. By sending a wildcard request it is possible to obtain the name of the remote system and the name of its domain Risk factor : None Plugin output : The following 7 NetBIOS names have been gathered : PBA = Computer name PBA = Messenger Service PBA = File Server Service __MSBROWSE__ = Master Browser WORKGROUP = Workgroup / Domain name WORKGROUP = Master Browser WORKGROUP = Browser Service Elections This SMB server seems to be a SAMBA server (MAC address is NULL). CVE : CVE-1999-0621 Other references : OSVDB:13577

unknown (4025/tcp): Partimage is running on this port It does not require login

microsoft-ds (445/tcp): Synopsis : It is possible to obtain information about the remote operating system. Description : It is possible to get the remote operating system name and version (Windows and/or Samba) by sending an authentication request to port 139 or 445. Risk factor : None Plugin output : The remote Operating System is : Unix The remote native lan manager is : Samba 3.0.22 The remote SMB Domain Name is : PBA Synopsis : It is possible to log into the remote host. Description : The remote host is running one of the Microsoft Windows operating systems. It was possible to log into it using one of the following account : - NULL session - Guest account - Given Credentials See also : http://support.microsoft.com/support/kb/articles/Q143/4/74.ASP http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP Risk factor : none Plugin output : - NULL sessions are enabled on the remote host - Remote users are authenticated as 'Guest' CVE : CVE-1999-0504, CVE-1999-0505, CVE-1999-0506, CVE-2000-0222, CVE-2002-1117, CVE-2005-3595 BID : 494, 990, 11199

Hoping this will help.