I ran nessus against my packetfilter/firewall linux box.
It also serves as an emergency web server, to which all http traffic
is directed if the real webserver goes down.

On the emergency server, all http requests (all requested URLs) are 
mapped to a single page, which shows a 'server is temporarily down'
message.

nessus tests the http server for a serious of dangerous CGIs, and
due to the mapping on this server, nessus thinks that all kinds of
dangerous CGIs or 'dangerous' html pages are present on the server, when
in fact none of these is present.

Maybe nessus should not only check whether a requested URL gives a OK 200
result, but look at the actual content it receives. Then it would
notice that there are no security holes.

As it is nesses reports 23 security holes when there is none.

Alois

Reply via email to