Internal Vulnerability Scan Detail by Issue Report

1 CONFIDENTIALITY NOTE: The information contained in this Report document is for the exclusive use of the client specified above and may contain confidential, privileged and non-disclosable information. If the recipient of this Report is not the client or addressee, such recipient is strictly prohibited from reading, photocopying, distributing or otherwise using this Report or its contents in any way. Scan Date: 10/25/2016 Security Assessment Prepared for: Your Customer / Prospect Prepared by: Your Company Name 10/27/2016 Internal Vulnerability Scan Detail by Issue Report Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 2 of 69 Table of Contents 1 - Summary 2 - Details - PHP phar_fix_filepath Function Stack Buffer Overflow Vulnerability - Mar16 (Linux) - Trojan horses - VMSA-2015-0007.

2 VMware ESXi OpenSLP Remote Code Execution (remote check) - PHP End Of Life Detection (Linux) - NFS export - IPMI Cipher Zero Authentication Bypass Vulnerability - PHP Denial of Service And Unspecified Vulnerabilities - 01 - Jul16 (Linux) - PHP type confusion Denial of Service Vulnerability (Linux) - ProFTPD `mod_copy` Unauthenticated Copying Of Files Via SITE CPFR/CPTO - Microsoft Windows SMB Server NTLM Multiple Vulnerabilities (971468) - MS15-034 Remote Code Execution Vulnerability (remote check) - Samba TALLOC_FREE() Function Remote Code Execution Vulnerability - Discard port open - Microsoft Remote Desktop Protocol Remote Code Execution Vulnerabilities (2671387) - SSH Brute Force Logins with default Credentials - Microsoft SQL Server Multiple Vulnerabilities (3065718) - Remote - OpenSSH Multiple Vulnerabilities - OpenSSH auth_password Denial of Service Vulnerability (Linux) - PHP Arbitrary Code Execution Vulnerability - Aug16 (Linux) - PHP Multiple Vulnerabilities - 02 - Aug16 (Linux) - PHP Multiple Vulnerabilities - 01 - Aug16 (Linux) - PHP Multiple Vulnerabilities - 05 - Aug16 (Linux) - PHP Multiple Vulnerabilities - 03 - Aug16 (Linux) - PHP var_unserializer Denial of Service Vulnerability (Linux) - PHP libgd Denial of Service Vulnerability (Linux) - PHP Multiple Vulnerabilities - 02 - Sep16 (Linux) - PHP Multiple Vulnerabilities - 04 - Aug16 (Linux)

3 - PHP Multiple Vulnerabilities - 03 - Sep16 (Linux) - PHP Multiple Vulnerabilities - 05 - Jul16 (Linux) - PHP Multiple Vulnerabilities - 02 - Jan15 Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 3 of 69 - PHP Out of Bounds Read Multiple Vulnerabilities - Jan15 - PHP Multiple Double Free Vulnerabilities - Jan15 - Microsoft Windows SMB/NETBIOS NULL Session Authentication Bypass Vulnerability - PHP Remote Code Execution and Denial of Service Vulnerabilities - Dec13 - PHP Multiple Vulnerabilities - 01 - Mar16 (Linux) - PHP Multiple Vulnerabilities - 04 - Jul16 (Linux) - PHP Directory Traversal Vulnerability - Jul16 (Linux) - PHP Multiple Vulnerabilities - 03 - Jul16 (Linux) - PHP serialize_function_call Function Type Confusion Vulnerability - Mar16 (Linux) - PHP Multiple Vulnerabilities - 01 - Apr16 (Linux) - PHP Multiple Vulnerabilities - 01 - Jul16 (Linux) - Report default community names of the SNMP Agent - Lighttpd Multiple vulnerabilities - OpenSSH Remote Memory Corruption Vulnerability - APC redi Management Card Webinterface Default Credentials - APC redi Management Card Telnet Default Credentials - OpenSSH Privilege Escalation Vulnerability - May16 - PHP Denial of Service Vulnerability - 01 - Jul16 (Linux)

4 - OpenSSH X Connections Session Hijacking Vulnerability - PHP Multiple Denial of Service Vulnerabilities - 01 - Dec15 (Linux) - OpenSSL CCS Man in the Middle Security Bypass Vulnerability - Microsoft SQL Server Elevation of Privilege Vulnerability (2984340) - Remote - PHP Denial of Service And Unspecified Vulnerabilities - 02 - Jul16 (Linux) - VMSA-2016-0002: VMware product updates address a critical glibc security Vulnerability (remote check) - OpenSSL DSA_verify() Security Bypass Vulnerability in BIND - Samba libcli/ Man In The Middle (MIMA) Vulnerability - Samba Badlock Critical Vulnerability - PHP XML Entity Expansion And XML External Entity Vulnerabilities (Linux) - VMSA-2016-0001 VMware ESXi, Fusion, Player, and Workstation updates address important guest privilege escalation Vulnerability (remote check) - PHP Denial of Service Vulnerability - 02 - Aug16 (Linux) - PHP make_http_soap_request Information Disclosure Vulnerability (Linux) - PHP Out of Bounds Read Memory Corruption Vulnerability - 01 - Mar16 (Linux)

5 Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 4 of 69 - Microsoft Windows SMTP Server DNS spoofing Vulnerability - PHP Directory Traversal Vulnerability - OpenSSH child_set_env() Function Security Bypass Vulnerability - OpenSSH Certificate Validation Security Bypass Vulnerability - OpenSSH <= - Xauth Injection - Dropbear SSH CRLF Injection Vulnerability - PHP Man-in-the-Middle Attack Vulnerability - Jul16 (Linux) - IPMI MD2 Auth Type Support Enabled - LDAP allows null bases - TCP Sequence Number Approximation Reset Denial of Service Vulnerability - Missing httpOnly Cookie Attribute - OpenSSH Denial of Service Vulnerability - Use LDAP search request to retrieve information from NT Directory Services - OpenSSH Denial of Service Vulnerability - Jan16 - SNMP GETBULK Reflected DrDoS - Lighttpd Remote Code Execution Vulnerability - June15 (Linux) - DCE Services Enumeration - Check for SSL Weak Ciphers - PHP Fileinfo Component Denial of Service Vulnerability (Linux) - PHP Multiple Denial of Service Vulnerabilities (Linux)

6 - PHP CDF File Parsing Denial of Service Vulnerabilities - 01 - Jun14 - Quote of the day - Dropbear SSH Server Multiple Security Vulnerabilities - Chargen - PHP open_basedir Security Bypass Vulnerability - Microsoft IIS Default Welcome Page Information Disclosure Vulnerability - Microsoft Windows SMTP Server MX Record Denial of Service Vulnerability - SSL Certification Expired - Samba Denial of Service Vulnerability - OpenSSH Client Information Leak - PHP display_errors Cross Site Scripting Vulnerability - SSH Weak Encryption Algorithms Supported - OpenSSL RSA Temporary Key Handling EXPORT_RSA Downgrade Issue (FREAK) Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 5 of 69 - OpenSSL TLS DHE_EXPORT LogJam Man in the Middle Security Bypass Vulnerability - PHP Cross-Site Scripting Vulnerability - Aug16 (Linux)

7 - PHP LibGD Denial of Service Vulnerability - OpenSSH Security Bypass Vulnerability - POODLE SSLv3 Protocol CBC ciphers Information Disclosure Vulnerability - PHP SOAP Parser Multiple Information Disclosure Vulnerabilities - Deprecated SSLv2 and SSLv3 Protocol Detection - ISC BIND AXFR Response Denial of Service Vulnerability - SSL Certificate Signed Using A Weak Signature Algorithm - SSL Diffie-Hellman Key Exchange Insufficient DH Group Strength Vulnerability - Samba Overwrite ACLs Vulnerability - openssh-server Forced dbre Handling Information Disclosure Vulnerability - OpenSSH ssh_gssapi_parse_ename() Function Denial of Service Vulnerability - SSH Weak MAC Algorithms Supported - OpenSSH CBC Mode Information Disclosure Vulnerability - Relative IP Identification number change - TCP timestamps - PHP Information Disclosure Vulnerability - 01 - Sep14 - OpenSSH Local Information Disclosure Vulnerability Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 6 of 69 1 - Summary This Report gives details on hosts that were tested and issues that were found group by individual issues.

8 Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 7 of 69 Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 8 of 69 2 - Scan Details - PHP phar_fix_filepath Function Stack Buffer Overflow Vulnerability - Mar16 (Linux) High: (CVSS: 10) OID: 80/tcp (http) Summary This host is installed with PHP and is prone to stack buffer overflow Vulnerability . Affected Nodes (myco-bdr) Vulnerability Detection Result Installed version: Fixed version: Impact Successfully exploiting this Issue allow remote attackers to execute arbitrary code in the context of the PHP process. Failed exploit attempts will likely crash the webserver.

9 Impact Level: Application Solution Upgrade to PHP version , or , or or later. For updates refer to Vulnerability Insight Multiple flaws are due to - Inadequate boundary checks on acct-supplied input by 'phar_fix_filepath' function in 'ext/ ' script. - Improper validation of file pointer in the 'phar_convert_to_other' function in 'ext/ ' script. Vulnerability Detection Method Get the installed version with the help of detect NVT and check the version is vulnerable or not. Details: PHP 'phar_fix_filepath' Function Stack Buffer Overflow Vulnerability - (OID: ) Version used: $Revision: 4161 $ Product Detection Result Product: cpe:/a:php: Method: PHP Version Detection (OID: ) References , - Trojan horses High: (CVSS: 10) OID: 2002/tcp Summary Internal Vulnerability Scan Detail by Issue Report SECURITY ASSESSMENT PROPRIETARY & CONFIDENTIAL PAGE 9 of 69 An unknown service runs on this port.

10 It is sometimes opened by Trojan horses. Unless you know for sure what is behind it, you'd better check your system. Affected Nodes (Psolidad-WIN764), (Mwest-WIN864), (REMOTE) Vulnerability Detection Result An unknown service runs on this port. It is sometimes opened by this/these Trojan horse(s): Singu Slapper Unless you know for sure what is behind it, you'd better check your system ** Anyway, don't panic, OpenVAS only found an open port. It may ** have been dynamically allocated to some service ( ) Solution: if a trojan horse is running, run a good antivirus scanner Multiple results by host Solution if a trojan horse is running, run a good antivirus scanner Vulnerability Detection Method Details: Trojan horses (OID: ) Version used: $Revision: 4034 $ - VMSA-2015-0007: VMware ESXi OpenSLP Remote Code Execution (remote check) High: (CVSS: 10) OID: Summary VMware vCenter and ESXi updates address critical security issues.