Has anyone run into the probable false positives below? The only cgi folder existing on the server is in Apache2. It contains none of the indicated CGI's. Apache, Perl and Tomcat where not loaded at the time of the scan. What is keying Nessus to indicate these warnings?
NetWare 6.5 SP3, NetMail 3.10h Nessus scan found these and other cgi's: Vulnerability https (443/tcp) The 'plusmail' CGI is installed. Some versions of this CGI have a well known security flaw that lets an attacker read arbitrary file with the privileges of the http daemon (usually root or nobody). Solution : remove it from /cgi-bin. No patch yet Risk factor : High CVE : CAN-2000-0074 BID : 2653 Nessus ID : 10181 This is a false positive. is not installed on this server. A file search of the Netware volumes could not locate a cgi of this name. Vulnerability https (443/tcp) The 'webgais' CGI is installed. This CGI has a well known security flaw that lets an attacker execute arbitrary commands with the privileges of the http daemon (usually root or nobody). Solution : remove it from /cgi-bin Risk factor : High CVE : CVE-1999-0176 BID : 2058 Nessus ID : 10300 Vulnerability https (443/tcp) The 'websendmail' CGI is installed. This CGI has a well known security flaw that lets an attacker execute arbitrary commands with the privileges of the http daemon (usually root or nobody). Solution : Remove it from /cgi-bin. Risk factor : High CVE : CVE-1999-0196 BID : 2077 Nessus ID : 10301 Vulnerability https (443/tcp) The 'Perl' CGI is installed and can be launched as a CGI. This is equivalent to giving a free shell to an attacker, with the http server privileges (usually root or nobody). Solution : remove it from /cgi-bin Risk factor : High CVE : CAN-1999-0509 Nessus ID : 10173 _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
