On Thu, 18 Nov 2004, Sawall, Christopher L wrote:
> Our Exchange servers have the the HP OpenView ITO agent installed
> (version 7.25 I believe). If this service is running when I run a
> Nessus scan against it, it basically breaks the Exchange servers ability
> to communicate with the domain controllers or with the Global Catalog.
> If you stop the scan (or after the scan) you have to restart the System
> Attendant service to get things going again.
>
> If the HP OpenView ITO agent service is stopped and a Nessus scan is
> performed, there are no adverse affects.
>
> To me, this doesn't make sense how the ITO agent is affecting the System
> Attendant service.
>
> More information:
> When the ITO agent is running, TCP ports 381 and 383 are listening. If
> you try to browse to http://server:381/ (or 383) with FireFox, it thinks
> I'm opening a file. Thinks it is an "application/octetstream"? If I
> try with MS IE, it just gives me a 404.
>
> I am pretty sure that the pluggin causing the problem is MISC./Directory
> Scanner (DDI_Directory_Scanner.nasl -- script id 11032). This is the
> only pluggin running every time the problem occurs.
>
> I am not sure where to go from here and am open to anyone's suggestions.
Did you report the bug to HP (or who ever wrote that ITO agent)?
Can you reproduce the communication of the DDI_Directory_Scanner.nasl
script by hand and still kill it?
If you can reproduce the issue without nessus and HP is not willing to wok
the problem you may considere posting the bug on bugtraq. But for now I
recommend you try to get HP to wok on it first.
Hugo.
--
I hate duplicates. Just reply to the relevant mailinglist.
[EMAIL PROTECTED] http://hvdkooij.xs4all.nl/
Don't meddle in the affairs of magicians,
for they are subtle and quick to anger.
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
