qualys 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +3 -2
- data/.rubocop.yml +7 -0
- data/.rubocop_todo.yml +71 -0
- data/.travis.yml +13 -1
- data/Gemfile +3 -1
- data/Gemfile.lock +91 -0
- data/README.md +50 -10
- data/Rakefile +3 -4
- data/lib/qualys.rb +10 -11
- data/lib/qualys/api.rb +38 -47
- data/lib/qualys/auth.rb +11 -20
- data/lib/qualys/compliance.rb +3 -7
- data/lib/qualys/config.rb +3 -5
- data/lib/qualys/host.rb +17 -0
- data/lib/qualys/report.rb +90 -0
- data/lib/qualys/scans.rb +10 -22
- data/lib/qualys/version.rb +1 -1
- data/lib/qualys/vulnerability.rb +74 -0
- data/qualys.gemspec +18 -19
- data/spec/fixtures/vcr_cassettes/api_get.yml +52 -0
- data/spec/fixtures/vcr_cassettes/create_global_report.yml +68 -0
- data/spec/fixtures/vcr_cassettes/emptyscans.yml +35 -0
- data/spec/fixtures/vcr_cassettes/get.yml +107 -0
- data/spec/fixtures/vcr_cassettes/global_report.yml +17800 -0
- data/spec/fixtures/vcr_cassettes/load_global_report.yml +625 -0
- data/spec/fixtures/vcr_cassettes/login.yml +50 -0
- data/spec/fixtures/vcr_cassettes/logout.yml +50 -0
- data/spec/fixtures/vcr_cassettes/scan.yml +73 -0
- data/spec/fixtures/vcr_cassettes/scans.yml +89 -0
- data/spec/fixtures/vcr_cassettes/templates.yml +121 -0
- data/spec/fixtures/vcr_cassettes/try_load_not_existing_report.yml +63 -0
- data/spec/fixtures/vcr_cassettes/unlogged.yml +45 -0
- data/spec/fixtures/vcr_cassettes/wrong.yml +101 -0
- data/spec/qualys/api_spec.rb +27 -0
- data/spec/qualys/report_spec.rb +65 -0
- data/spec/qualys/scans_spec.rb +75 -0
- data/spec/qualys/version_spec.rb +11 -0
- data/spec/qualys/vulnerability_spec.rb +53 -0
- data/spec/qualys_spec.rb +20 -0
- data/spec/spec_helper.rb +37 -0
- metadata +61 -15
- data/.rock.yml +0 -17
- data/lib/qualys/reports.rb +0 -47
|
@@ -0,0 +1,625 @@
|
|
|
1
|
+
---
|
|
2
|
+
http_interactions:
|
|
3
|
+
- request:
|
|
4
|
+
method: get
|
|
5
|
+
uri: https://qualysapi.qualys.eu/api/2.0/fo/report/?action=fetch&id=4888430
|
|
6
|
+
body:
|
|
7
|
+
encoding: US-ASCII
|
|
8
|
+
string: ''
|
|
9
|
+
headers:
|
|
10
|
+
X-Requested-With:
|
|
11
|
+
- Qualys Ruby Client v0.1.3
|
|
12
|
+
response:
|
|
13
|
+
status:
|
|
14
|
+
code: 200
|
|
15
|
+
message: OK
|
|
16
|
+
headers:
|
|
17
|
+
Date:
|
|
18
|
+
- Tue, 12 Dec 2017 10:00:00 GMT
|
|
19
|
+
Server:
|
|
20
|
+
- Qualys
|
|
21
|
+
X-Xss-Protection:
|
|
22
|
+
- '1'
|
|
23
|
+
X-Content-Type-Options:
|
|
24
|
+
- nosniff
|
|
25
|
+
X-Frame-Options:
|
|
26
|
+
- SAMEORIGIN
|
|
27
|
+
Expires:
|
|
28
|
+
- Thu, 19 Nov 1981 08:52:00 GMT
|
|
29
|
+
Cache-Control:
|
|
30
|
+
- ''
|
|
31
|
+
Pragma:
|
|
32
|
+
- ''
|
|
33
|
+
X-Ratelimit-Limit:
|
|
34
|
+
- '300'
|
|
35
|
+
X-Ratelimit-Window-Sec:
|
|
36
|
+
- '3600'
|
|
37
|
+
X-Concurrency-Limit-Limit:
|
|
38
|
+
- '2'
|
|
39
|
+
X-Concurrency-Limit-Running:
|
|
40
|
+
- '0'
|
|
41
|
+
X-Ratelimit-Towait-Sec:
|
|
42
|
+
- '0'
|
|
43
|
+
X-Ratelimit-Remaining:
|
|
44
|
+
- '292'
|
|
45
|
+
Content-Length:
|
|
46
|
+
- '55643'
|
|
47
|
+
Content-Disposition:
|
|
48
|
+
- attachment; filename=Scan_Report_Generated_by_Ruby_Qualys_gem_Thomas_20171212.xml
|
|
49
|
+
Content-Type:
|
|
50
|
+
- application/xml
|
|
51
|
+
body:
|
|
52
|
+
encoding: UTF-8
|
|
53
|
+
string: "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n\n<!DOCTYPE ASSET_DATA_REPORT
|
|
54
|
+
SYSTEM \"https://qualysguard.qualys.eu/asset_data_report.dtd\">\n<ASSET_DATA_REPORT>\n
|
|
55
|
+
\ <HEADER>\n <COMPANY><![CDATA[ACME]]></COMPANY>\n <USERNAME>Thomas</USERNAME>\n
|
|
56
|
+
\ <GENERATION_DATETIME>2017-12-12T09:55:42Z</GENERATION_DATETIME>\n <TEMPLATE><![CDATA[Technical
|
|
57
|
+
Report]]></TEMPLATE>\n <TARGET>\n <USER_ASSET_GROUPS>\n <ASSET_GROUP_TITLE><![CDATA[All]]></ASSET_GROUP_TITLE>\n
|
|
58
|
+
\ </USER_ASSET_GROUPS>\n <COMBINED_IP_LIST>\n <RANGE>\n <START>47.69.112.62</START>\n
|
|
59
|
+
\ <END>47.69.112.62</END>\n </RANGE>\n <RANGE>\n <START>88.78.187.177</START>\n
|
|
60
|
+
\ <END>88.78.187.177</END>\n </RANGE>\n <RANGE>\n <START>192.168.1.100</START>\n
|
|
61
|
+
\ <END>192.168.1.100</END>\n </RANGE>\n </COMBINED_IP_LIST>\n
|
|
62
|
+
\ </TARGET>\n <RISK_SCORE_SUMMARY>\n <TOTAL_VULNERABILITIES>19</TOTAL_VULNERABILITIES>\n
|
|
63
|
+
\ <AVG_SECURITY_RISK>2.4</AVG_SECURITY_RISK>\n <BUSINESS_RISK>12/100</BUSINESS_RISK>\n
|
|
64
|
+
\ </RISK_SCORE_SUMMARY>\n </HEADER>\n <HOST_LIST>\n <HOST>\n <IP>47.69.112.62</IP>\n
|
|
65
|
+
\ <TRACKING_METHOD>IP</TRACKING_METHOD>\n <DNS><![CDATA[12.ip-34-56-789.ab]]></DNS>\n
|
|
66
|
+
\ <OPERATING_SYSTEM><![CDATA[Ubuntu / Tiny Core Linux / Linux 2.6.x]]></OPERATING_SYSTEM>\n
|
|
67
|
+
\ <VULN_INFO_LIST>\n <VULN_INFO>\n <QID id=\"qid_38173\">38173</QID>\n
|
|
68
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
69
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT><![CDATA[Certificate
|
|
70
|
+
#0 CN=localhost.localdomain self signed certificate]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
71
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
72
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
73
|
+
\ <QID id=\"qid_38685\">38685</QID>\n <TYPE>Vuln</TYPE>\n
|
|
74
|
+
\ <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
75
|
+
\ <SSL>true</SSL>\n <RESULT><![CDATA[Certificate #0 CN=localhost.localdomain
|
|
76
|
+
\ is valid for more than 39 months]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
77
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
78
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
79
|
+
\ <QID id=\"qid_38169\">38169</QID>\n <TYPE>Vuln</TYPE>\n
|
|
80
|
+
\ <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
81
|
+
\ <SSL>true</SSL>\n <RESULT><![CDATA[Certificate #0 CN=localhost.localdomain
|
|
82
|
+
\ is a self signed certificate.]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
83
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
84
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
85
|
+
\ <QID id=\"qid_38170\">38170</QID>\n <TYPE>Vuln</TYPE>\n
|
|
86
|
+
\ <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
87
|
+
\ <SSL>true</SSL>\n <RESULT><![CDATA[Certificate #0 CN=localhost.localdomain
|
|
88
|
+
(localhost.localdomain) doesn't resolve]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
89
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
90
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
91
|
+
\ <QID id=\"qid_38628\">38628</QID>\n <TYPE>Vuln</TYPE>\n
|
|
92
|
+
\ <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
93
|
+
\ <SSL>true</SSL>\n <RESULT><![CDATA[TLSv1.0 is supported]]></RESULT>\n
|
|
94
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
95
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
96
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38601\">38601</QID>\n
|
|
97
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
98
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT
|
|
99
|
+
format=\"table\"><![CDATA[CIPHER\tKEY-EXCHANGE\tAUTHENTICATION\tMAC\tENCRYPTION(KEY-STRENGTH)\tGRADE\nSSLv3
|
|
100
|
+
WITH RC4 CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nRC4-MD5\tRSA\tRSA\tMD5\tRC4(128)\tMEDIUM\nRC4-SHA\tRSA\tRSA\tSHA1\tRC4(128)\tMEDIUM\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nECDHE-RSA-RC4-SHA\tECDH\tRSA\tSHA1\tRC4(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nTLSv1
|
|
101
|
+
WITH RC4 CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nRC4-MD5\tRSA\tRSA\tMD5\tRC4(128)\tMEDIUM\nRC4-SHA\tRSA\tRSA\tSHA1\tRC4(128)\tMEDIUM\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nECDHE-RSA-RC4-SHA\tECDH\tRSA\tSHA1\tRC4(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nTLSv1.1
|
|
102
|
+
WITH RC4 CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nRC4-MD5\tRSA\tRSA\tMD5\tRC4(128)\tMEDIUM\nRC4-SHA\tRSA\tRSA\tSHA1\tRC4(128)\tMEDIUM\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nECDHE-RSA-RC4-SHA\tECDH\tRSA\tSHA1\tRC4(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nTLSv1.2
|
|
103
|
+
WITH RC4 CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nRC4-MD5\tRSA\tRSA\tMD5\tRC4(128)\tMEDIUM\nRC4-SHA\tRSA\tRSA\tSHA1\tRC4(128)\tMEDIUM\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nECDHE-RSA-RC4-SHA\tECDH\tRSA\tSHA1\tRC4(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM]]></RESULT>\n
|
|
104
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
105
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
106
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38140\">38140</QID>\n
|
|
107
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
108
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT
|
|
109
|
+
format=\"table\"><![CDATA[CIPHER\tKEY-EXCHANGE\tAUTHENTICATION\tMAC\tENCRYPTION(KEY-STRENGTH)\tGRADE\nSSLv3
|
|
110
|
+
WEAK CIPHERS\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nEXP-RC2-CBC-MD5\tRSA(512)\tRSA\tMD5\tRC2(40)\tLOW\nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nTLSv1
|
|
111
|
+
WEAK CIPHERS\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nEXP-RC2-CBC-MD5\tRSA(512)\tRSA\tMD5\tRC2(40)\tLOW\nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nTLSv1.1
|
|
112
|
+
WEAK CIPHERS\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nEXP-RC2-CBC-MD5\tRSA(512)\tRSA\tMD5\tRC2(40)\tLOW\nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nTLSv1.2
|
|
113
|
+
WEAK CIPHERS\t \t \t \t \t \nEXP-RC4-MD5\tRSA(512)\tRSA\tMD5\tRC4(40)\tLOW\nEXP-RC2-CBC-MD5\tRSA(512)\tRSA\tMD5\tRC2(40)\tLOW\nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW]]></RESULT>\n
|
|
114
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
115
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
116
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38142\">38142</QID>\n
|
|
117
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
118
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT
|
|
119
|
+
format=\"table\"><![CDATA[CIPHER\tKEY-EXCHANGE\tAUTHENTICATION\tMAC\tENCRYPTION(KEY-STRENGTH)\tGRADE\nSSLv3
|
|
120
|
+
SUPPORTS CIPHERS WITH NO AUTHENTICATION\t \t \t \t \t \nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nADH-AES128-SHA\tDH\tNone\tSHA1\tAES(128)\tMEDIUM\nADH-AES256-SHA\tDH\tNone\tSHA1\tAES(256)\tHIGH\nADH-CAMELLIA128-SHA\tDH\tNone\tSHA1\tCamellia(128)\tMEDIUM\nADH-CAMELLIA256-SHA\tDH\tNone\tSHA1\tCamellia(256)\tHIGH\nADH-SEED-SHA\tDH\tNone\tSHA1\tSEED(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nAECDH-AES128-SHA\tECDH\tNone\tSHA1\tAES(128)\tMEDIUM\nAECDH-AES256-SHA\tECDH\tNone\tSHA1\tAES(256)\tHIGH\nTLSv1
|
|
121
|
+
SUPPORTS CIPHERS WITH NO AUTHENTICATION\t \t \t \t \t \nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nADH-AES128-SHA\tDH\tNone\tSHA1\tAES(128)\tMEDIUM\nADH-AES256-SHA\tDH\tNone\tSHA1\tAES(256)\tHIGH\nADH-CAMELLIA128-SHA\tDH\tNone\tSHA1\tCamellia(128)\tMEDIUM\nADH-CAMELLIA256-SHA\tDH\tNone\tSHA1\tCamellia(256)\tHIGH\nADH-SEED-SHA\tDH\tNone\tSHA1\tSEED(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nAECDH-AES128-SHA\tECDH\tNone\tSHA1\tAES(128)\tMEDIUM\nAECDH-AES256-SHA\tECDH\tNone\tSHA1\tAES(256)\tHIGH\nTLSv1.1
|
|
122
|
+
SUPPORTS CIPHERS WITH NO AUTHENTICATION\t \t \t \t \t \nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nADH-AES128-SHA\tDH\tNone\tSHA1\tAES(128)\tMEDIUM\nADH-AES256-SHA\tDH\tNone\tSHA1\tAES(256)\tHIGH\nADH-CAMELLIA128-SHA\tDH\tNone\tSHA1\tCamellia(128)\tMEDIUM\nADH-CAMELLIA256-SHA\tDH\tNone\tSHA1\tCamellia(256)\tHIGH\nADH-SEED-SHA\tDH\tNone\tSHA1\tSEED(128)\tMEDIUM\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nAECDH-AES128-SHA\tECDH\tNone\tSHA1\tAES(128)\tMEDIUM\nAECDH-AES256-SHA\tECDH\tNone\tSHA1\tAES(256)\tHIGH\nTLSv1.2
|
|
123
|
+
SUPPORTS CIPHERS WITH NO AUTHENTICATION\t \t \t \t \t \nEXP-ADH-RC4-MD5\tDH(512)\tNone\tMD5\tRC4(40)\tLOW\nADH-RC4-MD5\tDH\tNone\tMD5\tRC4(128)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nADH-AES128-SHA\tDH\tNone\tSHA1\tAES(128)\tMEDIUM\nADH-AES256-SHA\tDH\tNone\tSHA1\tAES(256)\tHIGH\nADH-CAMELLIA128-SHA\tDH\tNone\tSHA1\tCamellia(128)\tMEDIUM\nADH-AES128-SHA256\tDH\tNone\tSHA256\tAES(128)\tMEDIUM\nADH-AES256-SHA256\tDH\tNone\tSHA256\tAES(256)\tHIGH\nADH-CAMELLIA256-SHA\tDH\tNone\tSHA1\tCamellia(256)\tHIGH\nADH-SEED-SHA\tDH\tNone\tSHA1\tSEED(128)\tMEDIUM\nADH-AES128-GCM-SHA256\tDH\tNone\tAEAD\tAESGCM(128)\tMEDIUM\nADH-AES256-GCM-SHA384\tDH\tNone\tAEAD\tAESGCM(256)\tHIGH\nAECDH-RC4-SHA\tECDH\tNone\tSHA1\tRC4(128)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nAECDH-AES128-SHA\tECDH\tNone\tSHA1\tAES(128)\tMEDIUM\nAECDH-AES256-SHA\tECDH\tNone\tSHA1\tAES(256)\tHIGH]]></RESULT>\n
|
|
124
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
125
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
126
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38657\">38657</QID>\n
|
|
127
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
128
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT
|
|
129
|
+
format=\"table\"><![CDATA[CIPHER\tKEY-EXCHANGE\tAUTHENTICATION\tMAC\tENCRYPTION(KEY-STRENGTH)\tGRADE\nSSLv3
|
|
130
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEDH-RSA-DES-CBC3-SHA\tDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nECDHE-RSA-DES-CBC3-SHA\tECDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nTLSv1
|
|
131
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEDH-RSA-DES-CBC3-SHA\tDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nECDHE-RSA-DES-CBC3-SHA\tECDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nTLSv1.1
|
|
132
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEDH-RSA-DES-CBC3-SHA\tDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nECDHE-RSA-DES-CBC3-SHA\tECDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nTLSv1.2
|
|
133
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nEXP-DES-CBC-SHA\tRSA(512)\tRSA\tSHA1\tDES(40)\tLOW\nDES-CBC-SHA\tRSA\tRSA\tSHA1\tDES(56)\tLOW\nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-EDH-RSA-DES-CBC-SHA\tDH(512)\tRSA\tSHA1\tDES(40)\tLOW\nEDH-RSA-DES-CBC-SHA\tDH\tRSA\tSHA1\tDES(56)\tLOW\nEDH-RSA-DES-CBC3-SHA\tDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nEXP-ADH-DES-CBC-SHA\tDH(512)\tNone\tSHA1\tDES(40)\tLOW\nADH-DES-CBC-SHA\tDH\tNone\tSHA1\tDES(56)\tLOW\nADH-DES-CBC3-SHA\tDH\tNone\tSHA1\t3DES(168)\tMEDIUM\nECDHE-RSA-DES-CBC3-SHA\tECDH\tRSA\tSHA1\t3DES(168)\tMEDIUM\nAECDH-DES-CBC3-SHA\tECDH\tNone\tSHA1\t3DES(168)\tMEDIUM]]></RESULT>\n
|
|
134
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
135
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
136
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38606\">38606</QID>\n
|
|
137
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n
|
|
138
|
+
\ <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n <RESULT><![CDATA[SSLv3
|
|
139
|
+
is supported]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
140
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
141
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
142
|
+
\ <QID id=\"qid_82003\">82003</QID>\n <TYPE>Vuln</TYPE>\n
|
|
143
|
+
\ <SSL>false</SSL>\n <RESULT><![CDATA[Timestamp of host (network
|
|
144
|
+
byte ordering): 08:05:40 GMT]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
145
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
146
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
147
|
+
\ <QID id=\"qid_38603\">38603</QID>\n <TYPE>Vuln</TYPE>\n
|
|
148
|
+
\ <PORT>25</PORT>\n <SERVICE>smtp</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
149
|
+
\ <SSL>false</SSL>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
150
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
151
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
152
|
+
\ <QID id=\"qid_11827\">11827</QID>\n <TYPE>Vuln</TYPE>\n
|
|
153
|
+
\ <PORT>443</PORT>\n <SERVICE>http over ssl</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
154
|
+
\ <SSL>false</SSL>\n <RESULT><![CDATA[X-Frame-Options or
|
|
155
|
+
Content-Security-Policy: frame-ancestors HTTP Headers missing on port 443.\nGET
|
|
156
|
+
/ HTTP/1.1\nHost: 12.ip-34-56-789.ab\nConnection: Keep-Alive\n\n\n\nX-XSS-Protection
|
|
157
|
+
HTTP Header missing on port 443.\nX-Content-Type-Options HTTP Header missing
|
|
158
|
+
on port 443.\nContent-Security-Policy HTTP Header missing on port 443.\nStrict-Transport-Security
|
|
159
|
+
HTTP Header missing on port 443.]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
160
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
161
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
162
|
+
\ <QID id=\"qid_11827\">11827</QID>\n <TYPE>Vuln</TYPE>\n
|
|
163
|
+
\ <PORT>80</PORT>\n <SERVICE>http</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
164
|
+
\ <SSL>false</SSL>\n <RESULT><![CDATA[X-Frame-Options or
|
|
165
|
+
Content-Security-Policy: frame-ancestors HTTP Headers missing on port 80.\nGET
|
|
166
|
+
/ HTTP/1.1\nHost: 12.ip-34-56-789.ab\nConnection: Keep-Alive\n\n\n\nX-XSS-Protection
|
|
167
|
+
HTTP Header missing on port 80.\nX-Content-Type-Options HTTP Header missing
|
|
168
|
+
on port 80.\nContent-Security-Policy HTTP Header missing on port 80.]]></RESULT>\n
|
|
169
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
170
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
171
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38628\">38628</QID>\n
|
|
172
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>443</PORT>\n <SERVICE>http
|
|
173
|
+
over ssl</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n
|
|
174
|
+
\ <RESULT><![CDATA[TLSv1.0 is supported]]></RESULT>\n <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n
|
|
175
|
+
\ <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
176
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n <VULN_INFO>\n
|
|
177
|
+
\ <QID id=\"qid_38657\">38657</QID>\n <TYPE>Vuln</TYPE>\n
|
|
178
|
+
\ <PORT>443</PORT>\n <SERVICE>http over ssl</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n
|
|
179
|
+
\ <SSL>true</SSL>\n <RESULT format=\"table\"><![CDATA[CIPHER\tKEY-EXCHANGE\tAUTHENTICATION\tMAC\tENCRYPTION(KEY-STRENGTH)\tGRADE\nTLSv1
|
|
180
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nTLSv1.1
|
|
181
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM\nTLSv1.2
|
|
182
|
+
WITH DES/3DES CIPHERs IS SUPPORTED\t \t \t \t \t \nDES-CBC3-SHA\tRSA\tRSA\tSHA1\t3DES(168)\tMEDIUM]]></RESULT>\n
|
|
183
|
+
\ <FIRST_FOUND>2017-12-07T08:12:19Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-07T08:12:19Z</LAST_FOUND>\n
|
|
184
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
185
|
+
\ </VULN_INFO>\n </VULN_INFO_LIST>\n </HOST>\n <HOST>\n <IP>88.78.187.177</IP>\n
|
|
186
|
+
\ <TRACKING_METHOD>IP</TRACKING_METHOD>\n <DNS><![CDATA[ip123.ip-45-67-891.eu]]></DNS>\n
|
|
187
|
+
\ <OPERATING_SYSTEM><![CDATA[Ubuntu / Fedora / Tiny Core Linux / Linux
|
|
188
|
+
3.x]]></OPERATING_SYSTEM>\n <VULN_INFO_LIST>\n <VULN_INFO>\n <QID
|
|
189
|
+
id=\"qid_11827\">11827</QID>\n <TYPE>Vuln</TYPE>\n <PORT>80</PORT>\n
|
|
190
|
+
\ <SERVICE>http</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n <SSL>false</SSL>\n
|
|
191
|
+
\ <RESULT><![CDATA[Content-Security-Policy HTTP Header missing on
|
|
192
|
+
port 80.\nGET / HTTP/1.1\nHost: ip123.ip-45-67-891.eu\nConnection: Keep-Alive]]></RESULT>\n
|
|
193
|
+
\ <FIRST_FOUND>2017-12-05T09:48:50Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-05T09:48:50Z</LAST_FOUND>\n
|
|
194
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
195
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_11827\">11827</QID>\n
|
|
196
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>443</PORT>\n <SERVICE>http
|
|
197
|
+
over ssl</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n <SSL>false</SSL>\n
|
|
198
|
+
\ <RESULT><![CDATA[Content-Security-Policy HTTP Header missing on
|
|
199
|
+
port 443.\nGET / HTTP/1.1\nHost: ip123.ip-45-67-891.eu\nConnection: Keep-Alive]]></RESULT>\n
|
|
200
|
+
\ <FIRST_FOUND>2017-12-05T09:48:50Z</FIRST_FOUND>\n <LAST_FOUND>2017-12-05T09:48:50Z</LAST_FOUND>\n
|
|
201
|
+
\ <TIMES_FOUND>1</TIMES_FOUND>\n <VULN_STATUS>New</VULN_STATUS>\n
|
|
202
|
+
\ </VULN_INFO>\n <VULN_INFO>\n <QID id=\"qid_38628\">38628</QID>\n
|
|
203
|
+
\ <TYPE>Vuln</TYPE>\n <PORT>443</PORT>\n <SERVICE>http
|
|
204
|
+
over ssl</SERVICE>\n <PROTOCOL>tcp</PROTOCOL>\n <SSL>true</SSL>\n
|
|
205
|
+
\ <RESULT><![CDATA[TLSv1.0 is supported]]></RESULT>\n <FIRST_FOUND>2017-12-05T09:48:50Z</FIRST_FOUND>\n
|
|
206
|
+
\ <LAST_FOUND>2017-12-05T09:48:50Z</LAST_FOUND>\n <TIMES_FOUND>1</TIMES_FOUND>\n
|
|
207
|
+
\ <VULN_STATUS>New</VULN_STATUS>\n </VULN_INFO>\n </VULN_INFO_LIST>\n
|
|
208
|
+
\ </HOST>\n </HOST_LIST>\n <GLOSSARY>\n <VULN_DETAILS_LIST>\n <VULN_DETAILS
|
|
209
|
+
id=\"qid_11827\">\n <QID id=\"qid_11827\">11827</QID>\n <TITLE><![CDATA[HTTP
|
|
210
|
+
Security Header Not Detected]]></TITLE>\n <SEVERITY>2</SEVERITY>\n
|
|
211
|
+
\ <CATEGORY>CGI</CATEGORY>\n <THREAT><![CDATA[This QID reports
|
|
212
|
+
the absence of the following <A HREF=\"https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Headers\"
|
|
213
|
+
TARGET=\"_blank\">HTTP headers</A> according to <A HREF=\"https://cwe.mitre.org/data/definitions/693.html\"
|
|
214
|
+
TARGET=\"_blank\">CWE-693: Protection Mechanism Failure</A>:<BR>\nX-Frame-Options:
|
|
215
|
+
This HTTP response header improves the protection of web applications against
|
|
216
|
+
clickjacking attacks. Clickjacking, also known as a "UI redress attack",
|
|
217
|
+
allows an attacker to use multiple transparent or opaque layers to trick a
|
|
218
|
+
targeted user into clicking on a button or link on another page when they
|
|
219
|
+
were intending to click on the the top level page. <BR>\nX-XSS-Protection:
|
|
220
|
+
This HTTP header enables the browser built-in Cross-Site Scripting (XSS) filter
|
|
221
|
+
to prevent cross-site scripting attacks. X-XSS-Protection: 0; disables this
|
|
222
|
+
functionality.<BR>\nX-Content-Type-Options: This HTTP header prevents attacks
|
|
223
|
+
based on MIME-type mismatch. The only possible value is nosniff. If your server
|
|
224
|
+
returns X-Content-Type-Options: nosniff in the response, the browser will
|
|
225
|
+
refuse to load the styles and scripts in case they have an incorrect MIME-type.
|
|
226
|
+
<BR>\nContent-Security-Policy: This HTTP header helps to detect and mitigate
|
|
227
|
+
certain types of attacks, including Cross Site Scripting (XSS), packet sniffing
|
|
228
|
+
attacks and data injection attacks.<BR>\nStrict-Transport-Security: The HTTP
|
|
229
|
+
Strict-Transport-Security response header (HSTS) is a security feature that
|
|
230
|
+
lets a web site tell browsers that it should only be communicated with using
|
|
231
|
+
HTTPS, instead of using HTTP.<P>\nQID Detection Logic:<BR>\nThis unauthenticated
|
|
232
|
+
QID looks for the presence of the following HTTP responses:<BR>\nValid directives
|
|
233
|
+
for X-Frame-Options are:<BR>\nX-Frame-Options: DENY - The page cannot be displayed
|
|
234
|
+
in a frame, regardless of the site attempting to do so.<BR>\nX-Frame-Options:
|
|
235
|
+
SAMEORIGIN - The page can only be displayed in a frame on the same origin
|
|
236
|
+
as the page itself.<BR>\nX-Frame-Options: ALLOW-FROM RESOURCE-URL - The page
|
|
237
|
+
can only be displayed in a frame on the specified origin.<P>\nContent-Security-Policy:
|
|
238
|
+
frame-ancestors - This directive specifies valid parents that may embed a
|
|
239
|
+
page using frame, iframe, object, embed, or applet\nValid directives for X-XSS-Protections
|
|
240
|
+
are:<BR>\nX-XSS-Protection: 1 - Enables XSS filtering (usually default in
|
|
241
|
+
browsers). If a cross-site scripting attack is detected, the browser will
|
|
242
|
+
sanitize the page (remove the unsafe parts).<BR>\nX-XSS-Protection: 1; mode=block
|
|
243
|
+
- Enables XSS filtering. Rather than sanitizing the page, the browser will
|
|
244
|
+
prevent rendering of the page if an attack is detected.<BR>\nX-XSS-Protection:
|
|
245
|
+
1; report=URI - Enables XSS filtering. If a cross-site scripting attack is
|
|
246
|
+
detected, the browser will sanitize the page and report the violation. This
|
|
247
|
+
uses the functionality of the CSP report-uri directive to send a report.<BR>\nX-XSS-Protection:
|
|
248
|
+
0 disables this directive and hence is also treated as not detected.<P>\nA
|
|
249
|
+
valid directive for X-Content-Type-Options: nosniff<P>\nA valid directive
|
|
250
|
+
for Content-Security-Policy: <policy-directive>; <policy-directive><P>\nA
|
|
251
|
+
valid HSTS directive Strict-Transport-Security: max-age=<expire-time>;
|
|
252
|
+
[; includeSubDomains][; preload]<P>\n<B>NOTE:</B> All report-only directives
|
|
253
|
+
(where applicable) are considered invalid.]]></THREAT>\n <IMPACT><![CDATA[Depending
|
|
254
|
+
on the vulnerability being exploited, an unauthenticated remote attacker could
|
|
255
|
+
conduct cross-site scripting, clickjacking or MIME-type sniffing attacks.]]></IMPACT>\n
|
|
256
|
+
\ <SOLUTION><![CDATA[CWE-693: Protection Mechanism Failure mentions
|
|
257
|
+
the following - The product does not use or incorrectly uses a protection
|
|
258
|
+
mechanism that provides sufficient defense against directed attacks against
|
|
259
|
+
the product. A "missing" protection mechanism occurs when the application
|
|
260
|
+
does not define any mechanism against a certain class of attack. An "insufficient"
|
|
261
|
+
protection mechanism might provide some defenses - for example, against the
|
|
262
|
+
most common attacks - but it does not protect against everything that is intended.
|
|
263
|
+
Finally, an "ignored" mechanism occurs when a mechanism is available
|
|
264
|
+
and in active use within the product, but the developer has not applied it
|
|
265
|
+
in some code path.<P>\nCustomers are advised to set proper <A HREF=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options\"
|
|
266
|
+
TARGET=\"_blank\">X-Frame-Options</A>, <A HREF=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection\"
|
|
267
|
+
TARGET=\"_blank\">X-XSS-Protection</A>, <A HREF=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\"
|
|
268
|
+
TARGET=\"_blank\">Content Security Policy</A>, <A HREF=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options\"
|
|
269
|
+
TARGET=\"_blank\">X-Content-Type-Options</A> and <A HREF=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security\"
|
|
270
|
+
TARGET=\"_blank\">Strict-Transport-Security</A> HTTP response headers.<P>\nDepending
|
|
271
|
+
on their server software, customers can set directives in their site configuration
|
|
272
|
+
or Web.config files. Few examples are:<P>\nX-Frame-Options:<BR>\nApache: Header
|
|
273
|
+
always append X-Frame-Options SAMEORIGIN<BR>\nnginx: add_header X-Frame-Options
|
|
274
|
+
SAMEORIGIN;<BR>\nHAProxy: rspadd X-Frame-Options:\\ SAMEORIGIN<BR>\nIIS: <HTTPPROTOCOL><CUSTOMHEADERS><ADD
|
|
275
|
+
NAME="X-Frame-Options" VALUE="SAMEORIGIN"></ADD></CUSTOMHEADERS></HTTPPROTOCOL><P>\nX-XSS-Protection:<BR>\nApache:
|
|
276
|
+
Header always set X-XSS-Protection "1; mode=block" <BR>\nPHP: header("X-XSS-Protection:
|
|
277
|
+
1; mode=block");<P>\nX-Content-Type-Options:<BR>\nApache: Header always
|
|
278
|
+
set X-Content-Type-Options: nosniff<P>\nContent-Security-Policy: (Please note
|
|
279
|
+
that these values may differ from website to website. The values below are
|
|
280
|
+
for informational purposes only. The scanner simply looks for the presence
|
|
281
|
+
of the security header.)<BR>\nApache: Header set Content-Security-Policy "script-src
|
|
282
|
+
'self'; object-src 'self'"<BR>\nIIS: <SYSTEM.WEBSERVER><HTTPPROTOCOL><CUSTOMHEADERS><ADD
|
|
283
|
+
NAME="Content-Security-Policy" VALUE="default-src 'self';"></ADD></CUSTOMHEADERS></HTTPPROTOCOL></SYSTEM.WEBSERVER><BR>\nnginx:
|
|
284
|
+
add_header Content-Security-Policy "default-src 'self'; script-src 'self';<P>\nHTTP
|
|
285
|
+
Strict-Transport-Security:<BR>\nApache: Header always set Strict-Transport-Security
|
|
286
|
+
"max-age=31536000; includeSubDomains"<BR>\nNginx: add_header Strict-Transport-Security
|
|
287
|
+
max-age=31536000;]]></SOLUTION>\n <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2017-11-09T00:47:11Z</LAST_UPDATE>\n
|
|
288
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38140\">\n <QID
|
|
289
|
+
id=\"qid_38140\">38140</QID>\n <TITLE><![CDATA[SSL Server Supports
|
|
290
|
+
Weak Encryption Vulnerability]]></TITLE>\n <SEVERITY>3</SEVERITY>\n
|
|
291
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[The
|
|
292
|
+
Secure Socket Layer (SSL) protocol allows for secure communication between
|
|
293
|
+
a client and a server.\n<P>\nSSL encryption ciphers are classified based on
|
|
294
|
+
encryption key length as follows:<BR>\n<UL>\n<LI>HIGH - key length larger
|
|
295
|
+
than 128 bits\n<LI>MEDIUM - key length equal to 128 bits\n<LI>LOW - key length
|
|
296
|
+
smaller than 128 bits\n</UL>\n<P>\nMessages encrypted with LOW encryption
|
|
297
|
+
ciphers are easy to decrypt. Commercial SSL servers should only support MEDIUM
|
|
298
|
+
or HIGH strength ciphers to guarantee transaction security.\n<P>\nThe following
|
|
299
|
+
link provides more information about this vulnerability:\n<UL>\n<LI><A HREF=\"http://www.schneier.com/paper-ssl-revised.pdf\"
|
|
300
|
+
TARGET=\"_blank\">Analysis of the SSL 3.0 protocol</A>\n</UL>\n<P>\nPlease
|
|
301
|
+
note that this detection only checks for weak cipher support at the SSL layer.
|
|
302
|
+
Some servers may implement additional protection at the data layer. For example,
|
|
303
|
+
some SSL servers and SSL proxies (such as SSL accelerators) allow cipher negotiation
|
|
304
|
+
to complete but send back an error message and abort further communication
|
|
305
|
+
on the secure channel. This vulnerability may not be exploitable for such
|
|
306
|
+
configurations.]]></THREAT>\n <IMPACT><![CDATA[An attacker can exploit
|
|
307
|
+
this vulnerability to decrypt secure communications without authorization.]]></IMPACT>\n
|
|
308
|
+
\ <SOLUTION><![CDATA[Disable support for LOW encryption ciphers.<P>\n<B>Apache</B>\n<BR>
|
|
309
|
+
If TLSv1.1 or TLSv1.2 are available, then those protocols should be used.\n<BR>SSLProtocol
|
|
310
|
+
TLSv1.1 TLSv1.2<BR>\nIf TLSv1.1 and TLSv1.2 are not available then only TLS1.0
|
|
311
|
+
should be used:\n<BR>SSLProtocol TLSv1\n<BR>Typically, for Apache/mod_ssl,
|
|
312
|
+
httpd.conf or ssl.conf should have the following lines:<BR>\nSSLCipherSuite
|
|
313
|
+
ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM<BR><BR>\nFor Apache/apache_ssl
|
|
314
|
+
include the following line in the configuration file (httpsd.conf):<BR>\nSSLRequireCipher
|
|
315
|
+
ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM<BR><P>\n\n<B>Tomcat</B>\n<BR>\nsslProtocol="SSLv3"
|
|
316
|
+
\ \n<BR>ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_W\n<BR>ITH_3DES_EDE_CBC_SHA"\n<BR><P>\n<B>IIS</B>\n<BR>\n<A
|
|
317
|
+
HREF=\"http://support.microsoft.com/default.aspx?scid=kb;EN-US;245030\" TARGET=\"_blank\">How
|
|
318
|
+
to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll</A>
|
|
319
|
+
(Windows restart required)\n<BR><A HREF=\"http://support.microsoft.com/default.aspx?scid=kb;en-us;187498\"
|
|
320
|
+
TARGET=\"_blank\">How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in
|
|
321
|
+
Internet Information Services</A> (Windows restart required)\n<BR><A HREF=\"http://www.microsoft.com/technet/security/prodtech/IIS.mspx\"
|
|
322
|
+
TARGET=\"_blank\">Security Guidance for IIS</A>\n<P>For Novell Netware 6.5
|
|
323
|
+
please refer to the following document \n<A HREF=\"http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm\"
|
|
324
|
+
TARGET=\"_blank\">SSL Allows the use of Weak Ciphers. -TID10100633 </A>]]></SOLUTION>\n
|
|
325
|
+
\ <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2015-01-20T19:50:33Z</LAST_UPDATE>\n
|
|
326
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38142\">\n <QID
|
|
327
|
+
id=\"qid_38142\">38142</QID>\n <TITLE><![CDATA[SSL Server Allows Anonymous
|
|
328
|
+
Authentication Vulnerability]]></TITLE>\n <SEVERITY>4</SEVERITY>\n
|
|
329
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[The
|
|
330
|
+
Secure Socket Layer (SSL) protocol allows for secure communication between
|
|
331
|
+
a client and a server. The client usually authenticates the server using an
|
|
332
|
+
algorithm like RSA or DSS. Some SSL ciphers allow SSL communication without
|
|
333
|
+
authentication. Most common Web browsers like Microsoft Internet Explorer,
|
|
334
|
+
Netscape and Mozilla do not use anonymous authentication ciphers by default.\n\n<P>A
|
|
335
|
+
vulnerability exists in SSL communications when clients are allowed to connect\nusing
|
|
336
|
+
no authentication algorithm. SSL client-server communication may use several
|
|
337
|
+
different types of\nauthentication: RSA, Diffie-Hellman, DSS or none. When
|
|
338
|
+
'none' is used, the\ncommunications are vulnerable to a man-in-the-middle
|
|
339
|
+
attack."]]></THREAT>\n <IMPACT><![CDATA[An attacker can exploit
|
|
340
|
+
this vulnerability to impersonate your server to clients.]]></IMPACT>\n <SOLUTION><![CDATA[Disable
|
|
341
|
+
support for anonymous authentication.<P>\n<B>1) How to disable for Apache:</B>\n<BR>Typically,
|
|
342
|
+
for Apache/mod_ssl, httpd.conf or ssl.conf should have the following lines:<BR>\nSSLProtocol
|
|
343
|
+
-ALL +SSLv3 +TLSv1<BR>\nSSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM<BR><BR>\nFor
|
|
344
|
+
Apache/apache_ssl include the following line in the configuration file (httpsd.conf):<BR>\nSSLRequireCipher
|
|
345
|
+
ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM<BR>\n<P><B>2) IIS:</B>\n<BR>For
|
|
346
|
+
IIS please see: <A HREF=\"http://support.microsoft.com/kb/187498/en-us\" TARGET=\"_blank\">How
|
|
347
|
+
to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services</A>,
|
|
348
|
+
<A HREF=\"http://support.microsoft.com/kb/245030/en-us\" TARGET=\"_blank\">How
|
|
349
|
+
to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll</A>,
|
|
350
|
+
<A HREF=\"http://support.microsoft.com/kb/299520/en-us\" TARGET=\"_blank\">How
|
|
351
|
+
to Determine the Cipher Suite for the Server and Client</A>, , and <A HREF=\"http://support.microsoft.com/kb/241447\"
|
|
352
|
+
TARGET=\"_blank\">How to restrict the use of certain ciphers in Internet Information
|
|
353
|
+
Services 5.0</A>\n<P>\n<B>3) Wu-FTP:</B>\nFor Wu-FTP which supports TLS, the
|
|
354
|
+
ciphers parameter in TLS configuration file should be set to -ALL +SSLv3 +TLSv1<BR>
|
|
355
|
+
For more details please consult the docs/HOWTO/ssl_and_tls_ftpd.HOWTO file
|
|
356
|
+
provided by wu-ftpd distribution.\n<P>\n<B>4) Lighttpd:</B>\nFor lighttpd:
|
|
357
|
+
Locate the lighttpd config file and modify the following ssl.ciper-list line
|
|
358
|
+
to include !aNULL. A restart of the lightttpd application is necessary.<BR>\nExample:
|
|
359
|
+
ssl.cipher-list = "TLSv1+HIGH !SSLv2 RC4+MEDIUM !aNULL !eNULL !3DES @STRENGTH"\n\n<P>\n<B>It
|
|
360
|
+
is recommended that you follow SSL best security practices:</B>\n<BR><A HREF=\"https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices\"
|
|
361
|
+
TARGET=\"_blank\">SSL and TLS Deployment Best Practices</A>\n<BR><A HREF=\"http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_1-1/ssl.html\"
|
|
362
|
+
TARGET=\"_blank\">http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_1-1/ssl.html</A>\n<BR><A
|
|
363
|
+
HREF=\"http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite\"
|
|
364
|
+
TARGET=\"_blank\">http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite</A>\n<BR><A
|
|
365
|
+
HREF=\"http://www.megasecurity.org/Info/ssl_servers.html\" TARGET=\"_blank\">http://www.megasecurity.org/Info/ssl_servers.html</A><P>]]></SOLUTION>\n
|
|
366
|
+
\ <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2017-03-17T00:12:11Z</LAST_UPDATE>\n
|
|
367
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38169\">\n <QID
|
|
368
|
+
id=\"qid_38169\">38169</QID>\n <TITLE><![CDATA[SSL Certificate - Self-Signed
|
|
369
|
+
Certificate]]></TITLE>\n <SEVERITY>2</SEVERITY>\n <CATEGORY>General
|
|
370
|
+
remote services</CATEGORY>\n <THREAT><![CDATA[An SSL Certificate associates
|
|
371
|
+
an entity (person, organization, host, etc.) with a Public Key. In an SSL
|
|
372
|
+
connection, the client authenticates the remote server using the server's
|
|
373
|
+
Certificate and extracts the Public Key in the Certificate to establish the
|
|
374
|
+
secure connection.\n<P>\nThe client can trust that the Server Certificate
|
|
375
|
+
belongs the server only if it is signed by a mutually trusted third-party
|
|
376
|
+
Certificate Authority (CA). Self-signed certificates are created generally
|
|
377
|
+
for testing purposes or to avoid paying third-party CAs. These should not
|
|
378
|
+
be used on any production or critical servers.\n<P>\nBy exploiting this vulnerability,
|
|
379
|
+
an attacker can impersonate the server by presenting a fake self-signed certificate.
|
|
380
|
+
If the client knows that the server does not have a trusted certificate, it
|
|
381
|
+
will accept this spoofed certificate and communicate with the remote server.]]></THREAT>\n
|
|
382
|
+
\ <IMPACT><![CDATA[By exploiting this vulnerability, an attacker can
|
|
383
|
+
launch a man-in-the-middle attack.]]></IMPACT>\n <SOLUTION><![CDATA[Please
|
|
384
|
+
install a server certificate signed by a trusted third-party Certificate Authority.]]></SOLUTION>\n
|
|
385
|
+
\ <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2009-05-25T03:59:26Z</LAST_UPDATE>\n
|
|
386
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38170\">\n <QID
|
|
387
|
+
id=\"qid_38170\">38170</QID>\n <TITLE><![CDATA[SSL Certificate - Subject
|
|
388
|
+
Common Name Does Not Match Server FQDN]]></TITLE>\n <SEVERITY>2</SEVERITY>\n
|
|
389
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[An
|
|
390
|
+
SSL Certificate associates an entity (person, organization, host, etc.) with
|
|
391
|
+
a Public Key. In an SSL connection, the client authenticates the remote server
|
|
392
|
+
using the server's Certificate and extracts the Public Key in the Certificate
|
|
393
|
+
to establish the secure connection.\n<P>\nA certificate whose Subject commonName
|
|
394
|
+
or subjectAltName does not match the server FQDN offers only encryption without
|
|
395
|
+
authentication.\n<P>\nPlease note that a false positive reporting of this
|
|
396
|
+
vulnerability is possible in the following case:\n<UL>If the common name of
|
|
397
|
+
the certificate uses a wildcard such as *.somedomainname.com and the reverse
|
|
398
|
+
DNS resolution of the target IP is not configured. In this case there is no
|
|
399
|
+
way for Qualys to associate the wildcard common name to the IP. Adding a reverse
|
|
400
|
+
DNS lookup entry to the target IP will solve this problem.\n</UL>]]></THREAT>\n
|
|
401
|
+
\ <IMPACT><![CDATA[A man-in-the-middle attacker can exploit this vulnerability
|
|
402
|
+
in tandem with a DNS cache poisoning attack to lure the client to another
|
|
403
|
+
server, and then steal all the encryption communication.]]></IMPACT>\n <SOLUTION><![CDATA[Please
|
|
404
|
+
install a server certificate whose Subject commonName or subjectAltName matches
|
|
405
|
+
the server FQDN.]]></SOLUTION>\n <PCI_FLAG>0</PCI_FLAG>\n <LAST_UPDATE>2015-08-12T17:39:01Z</LAST_UPDATE>\n
|
|
406
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38173\">\n <QID
|
|
407
|
+
id=\"qid_38173\">38173</QID>\n <TITLE><![CDATA[SSL Certificate - Signature
|
|
408
|
+
Verification Failed Vulnerability]]></TITLE>\n <SEVERITY>2</SEVERITY>\n
|
|
409
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[An
|
|
410
|
+
SSL Certificate associates an entity (person, organization, host, etc.) with
|
|
411
|
+
a Public Key. In an SSL connection, the client authenticates the remote server
|
|
412
|
+
using the server's Certificate and extracts the Public Key in the Certificate
|
|
413
|
+
to establish the secure connection. The authentication is done by verifying
|
|
414
|
+
that the public key in the certificate is signed by a trusted third-party
|
|
415
|
+
Certificate Authority.\n<P>\nIf a client is unable to verify the certificate,
|
|
416
|
+
it can abort communication or prompt the user to continue the communication
|
|
417
|
+
without authentication.]]></THREAT>\n <IMPACT><![CDATA[By exploiting
|
|
418
|
+
this vulnerability, man-in-the-middle attacks in tandem with DNS cache poisoning
|
|
419
|
+
can occur.\n<P>\nException:<BR>\nIf the server communicates only with a restricted
|
|
420
|
+
set of clients who have the server certificate or the trusted CA certificate,
|
|
421
|
+
then the server or CA certificate may not be available publicly, and the scan
|
|
422
|
+
will be unable to verify the signature.]]></IMPACT>\n <SOLUTION><![CDATA[Please
|
|
423
|
+
install a server certificate signed by a trusted third-party Certificate Authority.]]></SOLUTION>\n
|
|
424
|
+
\ <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2009-05-23T00:02:29Z</LAST_UPDATE>\n
|
|
425
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_38601\">\n <QID
|
|
426
|
+
id=\"qid_38601\">38601</QID>\n <TITLE><![CDATA[SSL/TLS use of weak
|
|
427
|
+
RC4 cipher]]></TITLE>\n <SEVERITY>3</SEVERITY>\n <CATEGORY>General
|
|
428
|
+
remote services</CATEGORY>\n <THREAT><![CDATA[Secure Sockets Layer
|
|
429
|
+
(SSL v2/v3) and Transport Layer Security (TLS ) protocols provide integrity,
|
|
430
|
+
confidentiality and authenticity services to other protocols that lack these
|
|
431
|
+
features.\n<P>\nSSL/TLS protocols use ciphers such as AES,DES, 3DES and RC4
|
|
432
|
+
to encrypt the content of the higher layer protocols and thus provide the
|
|
433
|
+
confidentiality service. Normally the output of an encryption process is a
|
|
434
|
+
sequence of random looking bytes. It was known that RC4 output has some bias
|
|
435
|
+
in the output. Recently a group of researchers has discovered that the there
|
|
436
|
+
is a stronger bias in RC4, which make statistical analysis of ciphertext more
|
|
437
|
+
practical.\n<P>\nThe described attack is to inject a malicious javascript
|
|
438
|
+
into the victim's browser that would ensure that there are multiple connections
|
|
439
|
+
being established with a target website and the same HTTP cookie is sent multiple
|
|
440
|
+
times to the website in encrypted form. This provides the attacker a large
|
|
441
|
+
set of ciphertext samples, that can be used for statistical analysis.\n\n<P>NOTE:
|
|
442
|
+
On 3/12/15 NVD changed the CVSS v2 access complicity from high to medium.
|
|
443
|
+
As a result Qualys revised the CVSS score to 4.3 immediately. On 5/4/15 Qualys
|
|
444
|
+
is also revising the severity to level 3.]]></THREAT>\n <IMPACT><![CDATA[If
|
|
445
|
+
this attack is carried out and an HTTP cookie is recovered, then the attacker
|
|
446
|
+
can use the cookie to impersonate the user whose cookie was recovered.\n<P>\nThis
|
|
447
|
+
attack is not very practical as it requires the attacker to have access to
|
|
448
|
+
millions of samples of ciphertext, but there are certain assumptions that
|
|
449
|
+
an attacker can make to improve the chances of recovering the cleartext from
|
|
450
|
+
cihpertext. For examples HTTP cookies are either base64 encoded or hex digits.
|
|
451
|
+
This information can help the attacker in their efforts to recover the cookie.]]></IMPACT>\n
|
|
452
|
+
\ <SOLUTION><![CDATA[RC4 should not be used where possible. One reason
|
|
453
|
+
that RC4 was still being used was BEAST and Lucky13 attacks against CBC mode
|
|
454
|
+
ciphers in SSL and TLS. However, TLSv 1.2 or later address these issues.]]></SOLUTION>\n
|
|
455
|
+
\ <PCI_FLAG>0</PCI_FLAG>\n <LAST_UPDATE>2016-01-29T19:32:26Z</LAST_UPDATE>\n
|
|
456
|
+
\ <CVE_ID_LIST>\n <CVE_ID>\n <ID><![CDATA[CVE-2013-2566]]></ID>\n
|
|
457
|
+
\ <URL><![CDATA[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566]]></URL>\n
|
|
458
|
+
\ </CVE_ID>\n <CVE_ID>\n <ID><![CDATA[CVE-2015-2808]]></ID>\n
|
|
459
|
+
\ <URL><![CDATA[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808]]></URL>\n
|
|
460
|
+
\ </CVE_ID>\n </CVE_ID_LIST>\n <BUGTRAQ_ID_LIST>\n <BUGTRAQ_ID>\n
|
|
461
|
+
\ <ID><![CDATA[91787]]></ID>\n <URL><![CDATA[http://www.securityfocus.com/bid/91787]]></URL>\n
|
|
462
|
+
\ </BUGTRAQ_ID>\n <BUGTRAQ_ID>\n <ID><![CDATA[58796]]></ID>\n
|
|
463
|
+
\ <URL><![CDATA[http://www.securityfocus.com/bid/58796]]></URL>\n
|
|
464
|
+
\ </BUGTRAQ_ID>\n <BUGTRAQ_ID>\n <ID><![CDATA[73684]]></ID>\n
|
|
465
|
+
\ <URL><![CDATA[http://www.securityfocus.com/bid/73684]]></URL>\n
|
|
466
|
+
\ </BUGTRAQ_ID>\n </BUGTRAQ_ID_LIST>\n </VULN_DETAILS>\n
|
|
467
|
+
\ <VULN_DETAILS id=\"qid_38603\">\n <QID id=\"qid_38603\">38603</QID>\n
|
|
468
|
+
\ <TITLE><![CDATA[SSLv3 Padding Oracle Attack Information Disclosure
|
|
469
|
+
Vulnerability (POODLE)]]></TITLE>\n <SEVERITY>3</SEVERITY>\n <CATEGORY>General
|
|
470
|
+
remote services</CATEGORY>\n <THREAT><![CDATA[The SSL protocol 3.0
|
|
471
|
+
design error, uses nondeterministic CBC padding, which makes it easier for
|
|
472
|
+
man-in-the-middle attacks. \n<P>\nThe target supports SSLv3, which makes it
|
|
473
|
+
vulnerable to POODLE (Padding Oracle On Downgraded Legacy Encryption), even
|
|
474
|
+
if it also supports more recent versions of TLS. It's subject to a downgrade
|
|
475
|
+
attack, in which the attacker tricks the browser into connecting with SSLv3.]]></THREAT>\n
|
|
476
|
+
\ <IMPACT><![CDATA[An attacker who can take a man-in-the-middle (MitM)
|
|
477
|
+
position can exploit this vulnerability and gain access to encrypted communication
|
|
478
|
+
between a client and server.]]></IMPACT>\n <SOLUTION><![CDATA[Disable
|
|
479
|
+
SSLv3 support to avoid this vulnerability.<P>\nExamples to disable SSLv3.<BR>\nnginx:
|
|
480
|
+
list specific allowed protocols in the "ssl_protocols" line. Make
|
|
481
|
+
sure SSLv2 and SSLv3 is not listed. For example: ssl_protocols TLSv2 TLSv1.1
|
|
482
|
+
TLSv1.2;<BR>\nApache: Add -SSLv3 to the "SSLProtocol" line. <BR>\n<A
|
|
483
|
+
HREF=\"https://support.microsoft.com/kb/187498/en-us\" TARGET=\"_blank\">How
|
|
484
|
+
to disable SSL 3.0 on Microsoft IIS</A>.\n<P>For PCI, please refer to the
|
|
485
|
+
Qualys <A HREF=\"https://community.qualys.com/thread/15280\" TARGET=\"_blank\">community
|
|
486
|
+
article</A>.]]></SOLUTION>\n <CORRELATION>\n <EXPLOITABILITY>\n
|
|
487
|
+
\ <EXPLT_SRC>\n <SRC_NAME><![CDATA[Metasploit]]></SRC_NAME>\n
|
|
488
|
+
\ <EXPLT_LIST>\n <EXPLT>\n <REF><![CDATA[CVE-2014-3566]]></REF>\n
|
|
489
|
+
\ <DESC><![CDATA[HTTP SSL/TLS Version Detection (POODLE scanner)
|
|
490
|
+
- Metasploit Ref : /modules/auxiliary/scanner/http/ssl_version]]></DESC>\n
|
|
491
|
+
\ <LINK><![CDATA[https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ssl_version.rb]]></LINK>\n
|
|
492
|
+
\ </EXPLT>\n </EXPLT_LIST>\n </EXPLT_SRC>\n
|
|
493
|
+
\ </EXPLOITABILITY>\n </CORRELATION>\n <PCI_FLAG>1</PCI_FLAG>\n
|
|
494
|
+
\ <LAST_UPDATE>2016-01-06T21:57:28Z</LAST_UPDATE>\n <VENDOR_REFERENCE_LIST>\n
|
|
495
|
+
\ <VENDOR_REFERENCE>\n <ID><![CDATA[POODLE]]></ID>\n <URL><![CDATA[https://www.openssl.org/~bodo/ssl-poodle.pdf]]></URL>\n
|
|
496
|
+
\ </VENDOR_REFERENCE>\n </VENDOR_REFERENCE_LIST>\n <CVE_ID_LIST>\n
|
|
497
|
+
\ <CVE_ID>\n <ID><![CDATA[CVE-2014-3566]]></ID>\n <URL><![CDATA[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566]]></URL>\n
|
|
498
|
+
\ </CVE_ID>\n </CVE_ID_LIST>\n <BUGTRAQ_ID_LIST>\n <BUGTRAQ_ID>\n
|
|
499
|
+
\ <ID><![CDATA[70574]]></ID>\n <URL><![CDATA[http://www.securityfocus.com/bid/70574]]></URL>\n
|
|
500
|
+
\ </BUGTRAQ_ID>\n </BUGTRAQ_ID_LIST>\n </VULN_DETAILS>\n
|
|
501
|
+
\ <VULN_DETAILS id=\"qid_38606\">\n <QID id=\"qid_38606\">38606</QID>\n
|
|
502
|
+
\ <TITLE><![CDATA[SSL Server Has SSLv3 Enabled Vulnerability]]></TITLE>\n
|
|
503
|
+
\ <SEVERITY>3</SEVERITY>\n <CATEGORY>General remote services</CATEGORY>\n
|
|
504
|
+
\ <THREAT><![CDATA[SSL 3.0 is an obsolete and insecure protocol.<BR>\nEncryption
|
|
505
|
+
in SSL 3.0 uses either the RC4 stream cipher, or a block cipher in CBC mode.<BR>\nRC4
|
|
506
|
+
is known to have biases, and the block cipher in CBC mode is vulnerable to
|
|
507
|
+
the POODLE attack.<P>\n\nThe SSLv3 protocol is insecure due to the POODLE
|
|
508
|
+
attack and the weakness of RC4 cipher.<P>\nNote: In April 2016, PCI released
|
|
509
|
+
<A HREF=\"https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf\"
|
|
510
|
+
TARGET=\"_blank\">PCI DSS v3.2</A> announcing that NIST no longer considers
|
|
511
|
+
Secure Socket Layers (SSL) v3.0 protocol as acceptable for protecting data
|
|
512
|
+
and that all versions of SSL versions do not meet the PCI definition of "strong
|
|
513
|
+
cryptography."<P>]]></THREAT>\n <IMPACT><![CDATA[An attacker can
|
|
514
|
+
exploit this vulnerability to read secure communications or maliciously modify
|
|
515
|
+
messages.]]></IMPACT>\n <SOLUTION><![CDATA[Disable the SSL 3.0 protocol
|
|
516
|
+
in the client and in the server, refer to \nHow to disable SSLv3 : <A HREF=\"http://disablessl3.com/\"
|
|
517
|
+
TARGET=\"_blank\">Disable SSLv3</A>]]></SOLUTION>\n <PCI_FLAG>1</PCI_FLAG>\n
|
|
518
|
+
\ <LAST_UPDATE>2017-07-10T18:08:39Z</LAST_UPDATE>\n </VULN_DETAILS>\n
|
|
519
|
+
\ <VULN_DETAILS id=\"qid_38628\">\n <QID id=\"qid_38628\">38628</QID>\n
|
|
520
|
+
\ <TITLE><![CDATA[SSL/TLS Server supports TLSv1.0]]></TITLE>\n <SEVERITY>3</SEVERITY>\n
|
|
521
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[TLS
|
|
522
|
+
is capable of using a multitude of ciphers (algorithms) to create the public
|
|
523
|
+
and private key pairs.<BR>\nFor example if TLSv1.0 uses either the RC4 stream
|
|
524
|
+
cipher, or a block cipher in CBC mode.<BR>\nRC4 is known to have biases and
|
|
525
|
+
the block cipher in CBC mode is vulnerable to the POODLE attack.<P>\n\nTLSv1.0,
|
|
526
|
+
if configured to use the same cipher suites as SSLv3, includes a means by
|
|
527
|
+
which a TLS implementation can downgrade the connection to SSL v3.0, thus
|
|
528
|
+
weakening security.<P>\n\n<A HREF=\"https://blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls\"
|
|
529
|
+
TARGET=\"_blank\">A POODLE-type</A> attack could also be launched directly
|
|
530
|
+
at TLS without negotiating a downgrade.<P>\n\n<B> This QID will be marked
|
|
531
|
+
as a Fail for PCI as of May 1st, 2017 in accordance with the new standards.
|
|
532
|
+
\ For existing implementations, Merchants will be able to submit a PCI False
|
|
533
|
+
Positive / Exception Request and provide proof of their Risk Mitigation and
|
|
534
|
+
Migration Plan, which will result in a pass for PCI up until June 30th, 2018.\n<P>\n
|
|
535
|
+
Further details can be found at: <A HREF=\"https://community.qualys.com/message/34120\"
|
|
536
|
+
TARGET=\"_blank\">NEW PCI DSS v3.2 and Migrating from SSL and Early TLS v1.1</A>\n</B>\n<P>]]></THREAT>\n
|
|
537
|
+
\ <IMPACT><![CDATA[An attacker can exploit cryptographic flaws to conduct
|
|
538
|
+
man-in-the-middle type attacks or to decryption communications.<P>\nFor example:
|
|
539
|
+
An attacker could force a downgrade from the TLS protocol to the older SSLv3.0
|
|
540
|
+
protocol and exploit the POODLE vulnerability, read secure communications
|
|
541
|
+
or maliciously modify messages.<P>\n<A HREF=\"https://blog.qualys.com/ssllabs/2014/12/08/poodle-bites-tls\"
|
|
542
|
+
TARGET=\"_blank\">A POODLE-type</A> attack could also be launched directly
|
|
543
|
+
at TLS without negotiating a downgrade.<P>]]></IMPACT>\n <SOLUTION><![CDATA[Disable
|
|
544
|
+
the use of TLSv1.0 protocol in favor of a cryptographically stronger protocol
|
|
545
|
+
such as TLSv1.2.\nThe following openssl commands can be used to do a manual
|
|
546
|
+
test:\nopenssl s_client -connect ip:port -tls1\n\nIf the test is successful,
|
|
547
|
+
then the target support TLSv1]]></SOLUTION>\n <PCI_FLAG>1</PCI_FLAG>\n
|
|
548
|
+
\ <LAST_UPDATE>2017-06-09T18:16:07Z</LAST_UPDATE>\n </VULN_DETAILS>\n
|
|
549
|
+
\ <VULN_DETAILS id=\"qid_38657\">\n <QID id=\"qid_38657\">38657</QID>\n
|
|
550
|
+
\ <TITLE><![CDATA[Birthday attacks against TLS ciphers with 64bit block
|
|
551
|
+
size vulnerability (Sweet32)]]></TITLE>\n <SEVERITY>3</SEVERITY>\n
|
|
552
|
+
\ <CATEGORY>General remote services</CATEGORY>\n <THREAT><![CDATA[Legacy
|
|
553
|
+
block ciphers having block size of 64 bits are vulnerable to a practical collision
|
|
554
|
+
attack when used in CBC mode. \nAll versions of SSL/TLS protocol support cipher
|
|
555
|
+
suites which use DES or 3DES as the symmetric encryption cipher are affected.]]></THREAT>\n
|
|
556
|
+
\ <IMPACT><![CDATA[Remote attackers can obtain cleartext data via a
|
|
557
|
+
birthday attack against a long-duration encrypted session.]]></IMPACT>\n <SOLUTION><![CDATA[Disable
|
|
558
|
+
and stop using DES and 3DES ciphers.\nThe following openssl commands can be
|
|
559
|
+
used to do a manual test:\nopenssl s_client -connect ip:port -cipher "DES:3DES"
|
|
560
|
+
-ssl2\nopenssl s_client -connect ip:port -cipher "DES:3DES" -ssl3\nopenssl
|
|
561
|
+
s_client -connect ip:port -cipher "DES:3DES" -tls1\nopenssl s_client
|
|
562
|
+
-connect ip:port -cipher "DES:3DES" -tls1_1\nopenssl s_client -connect
|
|
563
|
+
ip:port -cipher "DES:3DES" -tls1_2\n\nIf any of these tests is successful,
|
|
564
|
+
then the target is vulnerable to Sweet32.]]></SOLUTION>\n <PCI_FLAG>0</PCI_FLAG>\n
|
|
565
|
+
\ <LAST_UPDATE>2017-06-27T06:14:43Z</LAST_UPDATE>\n <CVE_ID_LIST>\n
|
|
566
|
+
\ <CVE_ID>\n <ID><![CDATA[CVE-2016-2183]]></ID>\n <URL><![CDATA[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183]]></URL>\n
|
|
567
|
+
\ </CVE_ID>\n </CVE_ID_LIST>\n <BUGTRAQ_ID_LIST>\n <BUGTRAQ_ID>\n
|
|
568
|
+
\ <ID><![CDATA[92630]]></ID>\n <URL><![CDATA[http://www.securityfocus.com/bid/92630]]></URL>\n
|
|
569
|
+
\ </BUGTRAQ_ID>\n <BUGTRAQ_ID>\n <ID><![CDATA[95568]]></ID>\n
|
|
570
|
+
\ <URL><![CDATA[http://www.securityfocus.com/bid/95568]]></URL>\n
|
|
571
|
+
\ </BUGTRAQ_ID>\n </BUGTRAQ_ID_LIST>\n </VULN_DETAILS>\n
|
|
572
|
+
\ <VULN_DETAILS id=\"qid_38685\">\n <QID id=\"qid_38685\">38685</QID>\n
|
|
573
|
+
\ <TITLE><![CDATA[SSL Certificate - Invalid Maximum Validity Date Detected]]></TITLE>\n
|
|
574
|
+
\ <SEVERITY>2</SEVERITY>\n <CATEGORY>General remote services</CATEGORY>\n
|
|
575
|
+
\ <THREAT><![CDATA[Starting 1 April 2015, Certification Authorities
|
|
576
|
+
(CAs) are not permitted to issue SSL certificates (issued from a public root)
|
|
577
|
+
with a validity period greater than 39 months. \n<BR>\nSSL/TLS certificate
|
|
578
|
+
maximum validity is three years (39 months) for Domain Validated (DV) and
|
|
579
|
+
Organization Validated (OV) Certificates.<BR>\nSSL certificates have limited
|
|
580
|
+
validity periods so that the certificate's holder identity information is
|
|
581
|
+
re-authenticated more frequently. \n<P>\nIt is detected that maximum validity
|
|
582
|
+
of certificate on the system is more than what is recommended.]]></THREAT>\n
|
|
583
|
+
\ <IMPACT><![CDATA[By exploiting this vulnerability, an attacker can
|
|
584
|
+
launch a man-in-the-middle attack.]]></IMPACT>\n <SOLUTION><![CDATA[Please
|
|
585
|
+
install a server certificate with recommended maximum validity.]]></SOLUTION>\n
|
|
586
|
+
\ <PCI_FLAG>1</PCI_FLAG>\n <LAST_UPDATE>2017-10-02T22:32:24Z</LAST_UPDATE>\n
|
|
587
|
+
\ </VULN_DETAILS>\n <VULN_DETAILS id=\"qid_82003\">\n <QID
|
|
588
|
+
id=\"qid_82003\">82003</QID>\n <TITLE><![CDATA[ICMP Timestamp Request]]></TITLE>\n
|
|
589
|
+
\ <SEVERITY>1</SEVERITY>\n <CATEGORY>TCP/IP</CATEGORY>\n <THREAT><![CDATA[ICMP
|
|
590
|
+
(Internet Control and Error Message Protocol) is a protocol encapsulated in
|
|
591
|
+
IP packets. It's principal purpose is to provide a protocol layer able to
|
|
592
|
+
inform gateways of the inter-connectivity and accessibility of other gateways
|
|
593
|
+
or hosts. "ping" is a well-known program for determining if a host
|
|
594
|
+
is up or down. It uses ICMP echo packets. ICMP timestamp packets are used
|
|
595
|
+
to synchronize clocks between hosts.]]></THREAT>\n <IMPACT><![CDATA[Unauthorized
|
|
596
|
+
users can obtain information about your network by sending ICMP timestamp
|
|
597
|
+
packets. For example, the internal systems clock should not be disclosed since
|
|
598
|
+
some internal daemons use this value to calculate ID or sequence numbers (i.e.,
|
|
599
|
+
on SunOS servers).]]></IMPACT>\n <SOLUTION><![CDATA[You can filter
|
|
600
|
+
ICMP messages of type "Timestamp" and "Timestamp Reply"
|
|
601
|
+
at the firewall level. Some system administrators choose to filter most types
|
|
602
|
+
of ICMP messages for various reasons. For example, they may want to protect
|
|
603
|
+
their internal hosts from ICMP-based Denial Of Service attacks, such as the
|
|
604
|
+
<I>Ping of Death</I> or <I>Smurf</I> attacks. \n<P>\nHowever, you should never
|
|
605
|
+
filter <B>ALL</B> ICMP messages, as some of them ("Don't Fragment",
|
|
606
|
+
"Destination Unreachable", "Source Quench", etc) are necessary
|
|
607
|
+
for proper behavior of Operating System TCP/IP stacks.\n<P>\nIt may be wiser
|
|
608
|
+
to contact your network consultants for advice, since this issue impacts your
|
|
609
|
+
overall network reliability and security.]]></SOLUTION>\n <PCI_FLAG>0</PCI_FLAG>\n
|
|
610
|
+
\ <LAST_UPDATE>2009-04-29T03:59:17Z</LAST_UPDATE>\n <CVE_ID_LIST>\n
|
|
611
|
+
\ <CVE_ID>\n <ID><![CDATA[CVE-1999-0524]]></ID>\n <URL><![CDATA[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0524]]></URL>\n
|
|
612
|
+
\ </CVE_ID>\n </CVE_ID_LIST>\n </VULN_DETAILS>\n </VULN_DETAILS_LIST>\n
|
|
613
|
+
\ </GLOSSARY>\n <APPENDICES>\n <NO_VULNS>\n <IP_LIST>\n <RANGE>\n
|
|
614
|
+
\ <START>192.168.1.100</START>\n <END>192.168.1.100</END>\n
|
|
615
|
+
\ </RANGE>\n </IP_LIST>\n </NO_VULNS>\n <TEMPLATE_DETAILS>\n
|
|
616
|
+
\ <FILTER_SUMMARY>\n Status:New, Active, Re-Opened, Fixed\n Vulnerabilities:\n
|
|
617
|
+
\ State:Active\n Included Operating Systems:\n All Operating
|
|
618
|
+
Systems\n </FILTER_SUMMARY>\n </TEMPLATE_DETAILS>\n </APPENDICES>\n</ASSET_DATA_REPORT>\n<!--
|
|
619
|
+
CONFIDENTIAL AND PROPRIETARY INFORMATION. Qualys provides the QualysGuard
|
|
620
|
+
Service \"As Is,\" without any warranty of any kind. Qualys makes no warranty
|
|
621
|
+
that the information contained in this report is complete or error-free. Copyright
|
|
622
|
+
2017, Qualys, Inc. //--> \n"
|
|
623
|
+
http_version:
|
|
624
|
+
recorded_at: Tue, 12 Dec 2017 10:00:00 GMT
|
|
625
|
+
recorded_with: VCR 4.0.0
|