List of PlugIn IDs

Plugin ID: 10900

Microsoft Windows - Users Information : Passwords never expires

Synopsis
At least one user has a password that never expires.

List of Hosts

192.168.1.180

Plugin Output

The following users have passwords that never expire :

- Guest
- WIN-8BPIQBRO0CX$
- EXCHANGE$


Note that, in addition to the Administrator, Guest, and Kerberos
accounts, Nessus has enumerated only those domain users with UIDs
between 1000 and 1200. To use a different range, edit the scan policy
and change the 'Start UID' and/or 'End UID' preferences for this
plugin, then re-run the scan.

Description
Using the supplied credentials, it is possible to list users whose
passwords never expire.

Solution
Allow / require users to change their passwords regularly.

Risk Factor
None

Plugin ID: 10395

Microsoft Windows SMB Shares Enumeration

Synopsis
It is possible to enumerate remote network shares.

List of Hosts

192.168.1.180

Plugin Output

Here are the SMB shares available on the remote host when logged as administrator:

- ADMIN$
- C$
- IPC$
- NETLOGON
- SYSVOL

Description
By connecting to the remote host, Nessus was able to enumerate
the network share names.

Solution
N/A

Risk Factor
None

Plugin ID: 52977

MS KB2524375: Fraudulent Digital Certificates Could Allow Spoofing

Synopsis
The remote Windows host has an out-of-date SSL certificate blacklist.

List of Hosts

192.168.1.180

Plugin Output

Nessus was unable to open the following registry key :

SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616

This indicates the update has not been applied.

Description
The remote host is missing KB2524375, which updates the system's SSL
certificate blacklist.

A certificate authority (CA) has revoked a number of fraudulent SSL
certificates for several prominent public websites. Without this
update, browsers will be unable to learn that the certificates have
been revoked if either Online Certificate Status Protocol (OCSP) is
disabled, or OCSP is enabled and fails.

If an attacker can trick someone into using the affected browser and
visiting a malicious site using one of the fraudulent certificates, he
may be able to fool that user into believing the site is a legitimate
one. In turn, the user could send credentials to the malicious site
or download and install applications.

Solution
Apply the relevant update provided by Microsoft.

See also
http://www.nessus.org/u?b8fdcaa8
http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
http://www.microsoft.com/technet/security/advisory/2524375.mspx
http://support.microsoft.com/kb/2524375

Risk Factor
Medium/ CVSS Base Score: 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)

Plugin ID: 35634

MS KB960715: Cumulative Security Update of ActiveX Kill Bits

Synopsis
The remote Windows host is missing a security update containing ActiveX kill bits.

List of Hosts

192.168.1.180

Plugin Output

The kill-bit has not been set for the following control :

{FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1}

Note that Nessus did not check whether there were other kill-bits
that have not been set because 'Thorough Tests' was not enabled
when this scan was run.

Description
The remote host is missing a list of kill bits for ActiveX controls
that are known to contain vulnerabilities.

If these ActiveX controls are ever installed on the remote host,
either now or in the future, they would expose it to various security
issues.

Solution
Microsoft has released an advisory about this :

http://www.microsoft.com/technet/security/advisory/960715.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-0305

Bugtraq ID
33663

Other references
OSVDB:51833
CWE:119

Plugin ID: 10897

Microsoft Windows - Users Information : disabled accounts

Synopsis
At least one user account has been disabled.

List of Hosts

192.168.1.180

Plugin Output

The following user accounts have been disabled :

- Guest
- krbtgt
- 249E6E5E-02B7-46F0-B


Note that, in addition to the Administrator, Guest, and Kerberos
accounts, Nessus has enumerated only those domain users with UIDs
between 1000 and 1200. To use a different range, edit the scan policy
and change the 'Start UID' and/or 'End UID' preferences for
'SMB use domain SID to enumerate users' setting, and then re-run the scan.

Description
Using the supplied credentials, it is possible to list user accounts
that have been disabled.

Solution
Delete accounts that are no longer needed.

Risk Factor
None

Plugin ID: 10785

Microsoft Windows SMB NativeLanManager Remote System Information Disclosure

Synopsis
It is possible to obtain information about the remote operating system.

List of Hosts

192.168.1.180

Plugin Output
The remote Operating System is : Windows Server (R) 2008 Standard 6001 Service Pack 1
The remote native lan manager is : Windows Server (R) 2008 Standard 6.0
The remote SMB Domain Name is : TX

Description
It is possible to get the remote operating system name and
version (Windows and/or Samba) by sending an authentication
request to port 139 or 445.

Solution
n/a

Risk Factor
None

Plugin ID: 40557

MS09-038: Vulnerabilities in Windows Media File Processing Could Allow Remote Code Execution (971557)

Synopsis
Arbitrary code can be executed on the remote host through Windows Media file processing.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\Avifil32.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18270

Description
The remote Windows host is affected by two vulnerabilities involving
the way in which AVI headers are processed and AVI data is validated
that could be abused to execute arbitrary code remotely.

If an attacker can trick a user on the affected system into opening
a specially crafted AVI file, he may be able to leverage these issues
to execute arbitrary code subject to the user's privileges.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-038.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2009-1545
CVE-2009-1546

Bugtraq ID
35967
35970

Other references
OSVDB:56908
OSVDB:56909
CWE:189
MSFT:MS09-038

Plugin ID: 48405

MS10-054: Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214) (remote check)

Synopsis
It is possible to execute arbitrary code on the remote Windows host due to flaws in its SMB implementation.

List of Hosts

192.168.1.180

Description
The remote host is affected by several vulnerabilities in the SMB
server that may allow an attacker to execute arbitrary code or perform
a denial of service against the remote host. These vulnerabilities
depend on access to a shared drive, but do not necessarily require
credentials.

Solution
Microsoft has released a set of patches for Windows XP, Vista, 2008,
7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-054.mspx

Risk Factor
Critical/ CVSS Base Score: 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.8(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2010-2550
CVE-2010-2551
CVE-2010-2552

Bugtraq ID
42224
42263
42267

Other references
OSVDB:66974
OSVDB:66975
OSVDB:66976
EDB-ID:14607
MSFT:MS10-054

Plugin ID: 39622

MS09-032: Cumulative Security Update of ActiveX Kill Bits (973346)

Synopsis
The remote Windows host is missing a security update containing ActiveX kill bits.

List of Hosts

192.168.1.180

Plugin Output

The kill-bit has not been set for the following control :

{011B3619-FE63-4814-8A84-15A194CE9CE3}

Note that Nessus did not check whether there were other kill-bits
that have not been set because 'Thorough Tests' was not enabled
when this scan was run.

Description
The remote host is missing a list of kill bits for ActiveX controls
that are known to contain vulnerabilities.

If these ActiveX controls are ever installed on the remote host,
either now or in the future, they would expose it to various security
issues.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-032.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-0015

Bugtraq ID
35558

Other references
CWE:119
OSVDB:55651
MSFT:MS09-032

Plugin ID: 36151

MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)

Synopsis
The remote host contains an API that is affected by multiple vulnerabilities.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Winhttp.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18178

Description
The version of Windows HTTP Services installed on the remote host is
affected by several vulnerabilities :

- An integer underflow triggered by a specially crafted
response from a malicious web server (for example,
during device discovery of UPnP devices on a network)
may allow for arbitrary code execution. (CVE-2009-0086)

- Incomplete validation of the distinguished name in a
digital certificate may, in combination with other
attacks, allow an attacker to successfully spoof the
digital certificate of a third-party web site.
(CVE-2009-0089)

- A flaw in the way that Windows HTTP Services handles
NTLM credentials may allow an attacker to reflect back
a user's credentials and thereby gain access as that
user. (CVE-2009-0550)

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-013.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-0086
CVE-2009-0089
CVE-2009-0550

Bugtraq ID
34435
34437
34439

Other references
OSVDB:53619
OSVDB:53620
OSVDB:53621
CWE:20
MSFT:MS09-013

Plugin ID: 10899

Microsoft Windows - Users Information : User has never logged in

Synopsis
At least one user has never logged in to his / her account.

List of Hosts

192.168.1.180

Plugin Output

The following users have never logged in :

- Guest
- krbtgt
- 249E6E5E-02B7-46F0-B
- pcurrie
- dtouart
- sgieber
- fcrumb
- cvukelj
- aballs
- idepierre
- mmcleroy
- kmalavet
- tjank
- fdraxler
- cpaskell
- mcosgrave
- deichert
- lmicha
- kbarroso
- vroutte
- rschummer
- lfollett
- pcoladonato
- gdelreal
- lthroneberry
- lmccarn
- mlutjen
- vkonkel
- asponsler
- metzkorn
- tmcquirter
- fconcannon
- lyouker
- mamini
- lrosko
- dcolligan
- fprok
- vnickleberry
- afeurtado
- rgerczak
- hvanhekken
- cdoudna
- sbessent
- wlorimor
- hkarmazyn
- sdechambeau
- lsotelo
- aterris
- mkanta
- atopacio
- gkamphoefner
- abergmeier
- ksorrentino
- lgiacchino
- mmajorga
- fcosby
- lsimcic
- ltabor
- lschweickert
- dbrueckman
- scalverley
- tstansfield
- fpassarelli
- tkreinhagen
- dkoenigsberg
- asteltenpohl
- agoonen
- smockler
- npacheco
- ycambell
- schesher
- mwinegardner
- spoissant
- jlicerio
- murman
- cvrazel
- czoelle
- apaulshock
- gbartus
- edorrough
- jdifiora
- jteno
- tmichel
- bbegan
- aconelli
- ceuton
- sadelmann
- slook
- jhoffpavir
- nholsing
- mscouller
- jbroadwater
- ebrentlinger
- ablaske
- iguzon
- smceldowney


Note that, in addition to the Administrator, Guest, and Kerberos
accounts, Nessus has enumerated only those domain users with UIDs
between 1000 and 1200. To use a different range, edit the scan policy
and change the 'Start UID' and/or 'End UID' preferences for
'SMB use domain SID to enumerate users' setting, and then re-run the scan.

Description
Using the supplied credentials, it is possible to list users who have
never logged into their accounts.

Solution
Delete accounts that are not needed.

Risk Factor
None

Plugin ID: 10913

Microsoft Windows - Local Users Information : Disabled accounts

Synopsis
At least one local user account has been disabled.

List of Hosts

192.168.1.180

Plugin Output

The following local user accounts have been disabled :

- Guest
- 249E6E5E-02B7-46F0-B


Note that, in addition to the Administrator and Guest accounts, Nessus
has only checked for local users with UIDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for 'SMB use host SID to enumerate
local users' setting, and then re-run the scan.

Description
Using the supplied credentials, it is possible to list local user
accounts that have been disabled.

Solution
Delete accounts that are no longer needed.

Risk Factor
None

Other references
OSVDB:752

Plugin ID: 33134

MS08-032: Cumulative Security Update of ActiveX Kill Bits (950760)

Synopsis
The remote Windows host has an ActiveX control that is affected by multiple memory corruption vulnerabilities.

List of Hosts

192.168.1.180

Plugin Output

The kill-bit has not been set for the following control :

{40F23EB7-B397-4285-8F3C-AACE4FA40309}

Note that Nessus did not check whether there were other kill-bits
that have not been set because 'Thorough Tests' was not enabled
when this scan was run.

Description
The remote host contains the sapi.dll ActiveX control.

The version of this control installed on the remote host reportedly
contains multiple memory corruption flaws. If an attacker can trick a
user on the affected host into visiting a specially-crafted web page,
he may be able to leverage this issue to execute arbitrary code on the
host subject to the user's privileges.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/bulletin/ms08-032.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2007-0675
CVE-2008-0956

Bugtraq ID
29558

Other references
OSVDB:33627
OSVDB:46062
OSVDB:46076
OSVDB:46087
CWE:119
MSFT:MS08-032

Plugin ID: 49960

MS10-083: Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution (2405882)

Synopsis
The remote windows host is affected by a remote code execution vulnerability.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Ole32.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18498

Description
The remote windows host contains a version of the Windows Shell or
the WordPad text editor that contains a vulnerability in the way it
handles shortcut files.

An attacker, exploiting this flaw, can execute arbitrary commands on
the remote host subject to the privileges of the user opening the
file.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-083.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-1263

Bugtraq ID
40574

Other references
OSVDB:65219
MSFT:MS10-083

Plugin ID: 36150

MS09-012: Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)

Synopsis
A local user can elevate his privileges on the remote host.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\Ntoskrnl.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18226

Description
The version of Windows running on the remote host is affected by
potentially four vulnerabilities involving its MSDTC transaction
facility and/or Windows Service Isolation that may allow a local user
to escalate his privileges and take complete control of the affected
system.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-012.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 5.6(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2008-1436
CVE-2009-0078
CVE-2009-0079
CVE-2009-0080

Bugtraq ID
28833
34442
34443
34444

Other references
OSVDB:44580
OSVDB:53666
OSVDB:53667
OSVDB:53668
CWE:264
MSFT:MS09-012

Plugin ID: 51907

MS11-007: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2485376)

Synopsis
The remote Windows host contains a font driver that is affected by a privilege escalation vulnerability.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Atmfd.dll has not been patched
Remote version : 5.1.2.226
Should be : 5.1.2.231

Description
The remote Windows host contains a version of the OpenType Compact
Font Format (CFF) Font Driver that fails to properly validate certain
data passed from user mode to kernel mode.

A remote attacker could exploit this by tricking a user into viewing
content rendered in a specially crafted CFF font (via vectors such as
web, instant message, or email), resulting in arbitrary code execution
in kernel mode.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2:

http://www.microsoft.com/technet/security/Bulletin/MS11-007.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2011-0033

Bugtraq ID
46106

Other references
OSVDB:70821
MSFT:MS11-007

Plugin ID: 10413

Microsoft Windows SMB Registry : Remote PDC/BDC Detection

Synopsis
The remote system is a Domain Controller.

List of Hosts

192.168.1.180

Description
The remote host seems to be a Primary Domain Controller or a Backup
Domain Controller.

This can be verified by the value of the registry key 'ProductType'
under 'HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions'.

Solution
n/a

Risk Factor
None

Plugin ID: 42107

MS09-051: Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution (975682)

Synopsis
Arbitrary code can be executed on the remote host through opening a Windows Media Format file.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\wmspdmod.dll has not been patched
Remote version : 11.0.6001.7000
Should be : 11.0.6001.7005

Description
The remote Windows host contains a version of the Windows Media
Runtime that is affected by multiple vulnerabilities :

- The ASF parser incorrectly parses files which make use
of the Window Media Speech codec. A remote attacker can
exploit this by tricking a user into opening a specially
crafted ASF file, which can lead to arbitrary code
execution. (CVE-2009-0555)

- The Audio Compression Manager does not properly initialize
certain functions in compressed audio files. A remote
attacker can exploit this by tricking a user into opening
a specially crafted media file, which can lead to
arbitrary code execution. (CVE-2009-2525)

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/bulletin/MS09-051.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2009-0555
CVE-2009-2525

Bugtraq ID
36602
36614

Other references
OSVDB:58844
OSVDB:58845
CWE:94
MSFT:MS09-051

Plugin ID: 49958

MS10-081: Vulnerability in Windows Common Control Library Could Allow Remote Code Execution (2296011)

Synopsis
A library on the remote Windows host has a buffer overflow vulnerability.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Comctl32.dll has not been patched
Remote version : 5.82.6001.18000
Should be : 5.82.6001.18523

Description
The remote host has a heap buffer overflow vulnerability in the
Windows common control library. This vulnerability can be exploited
when a user visits a specially crafted web page while using a third-
party scalable vector graphics (SVG) viewer.

A remote attacker could exploit this by tricking a user into visiting
a maliciously crafted web page.

Solution
Microsoft has released a set of patches for Windows 2003, XP, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/MS10-081.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.2(CVSS2#E:U/RL:OF/RC:UC)

CVE
CVE-2010-2746

Bugtraq ID
43717

Other references
OSVDB:68549
EDB-ID:15963
MSFT:MS10-081

Plugin ID: 39350

MS KB969898: Cumulative Security Update of ActiveX Kill Bits

Synopsis
The remote Windows host is missing a security update containing ActiveX kill bits.

List of Hosts

192.168.1.180

Plugin Output

The kill-bit has not been set for the following control :

{648A5600-2C6E-101B-82B6-000000000014}

Note that Nessus did not check whether there were other kill-bits
that have not been set because 'Thorough Tests' was not enabled
when this scan was run.

Description
The remote host is missing a list of kill bits for ActiveX controls
that are known to contain vulnerabilities.

If these ActiveX controls are ever installed on the remote host,
either now or in the future, they would expose it to various security
issues.

Solution
Microsoft has released an advisory about this :

http://www.microsoft.com/technet/security/advisory/969898.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-0024
CVE-2008-2475
CVE-2009-0208

Bugtraq ID
33918
35218
35247
35248

Other references
OSVDB:52830
OSVDB:54968
CWE:94

Plugin ID: 35823

MS09-007: Vulnerability in SChannel Could Allow Spoofing (960225)

Synopsis
It may be possible to spoof user identities.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Schannel.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18175

Description
The Secure Channel (SChannel) authentication component included in the
remote version of Windows does not sufficiently validate certain
Transport Layer Security (TLS) handshake messages to ensure that a
client does in fact have access to the private key linked to a
certificate used for authentication. An attacker who has access to
the public key component of a user's certificate may be able to
leverage this issue to authenticate as that user against services such
as web servers that use certificate-based authentication or to
impersonate that user.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-007.mspx

Risk Factor
Medium/ CVSS Base Score: 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS Temporal Score: 5.0(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2009-0085

Bugtraq ID
34015

Other references
OSVDB:52521
CWE:287
MSFT:MS09-007

Plugin ID: 33877

MS08-048: Security Update for Outlook Express and Windows Mail (951066)

Synopsis
An information disclosure vulnerability is present on the remote host due to an issue in Outlook Express / Microsoft Mail

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Inetcomm.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18049

Description
The remote host is running a version of Microsoft Outlook Express
which contains a flaw which might be used to cause an information
disclosure.

To exploit this flaw, an attacker would need to send a malformed email
to a victim on the remote host and have him open it.

Solution
Microsoft has released a set of patches for Outlook Express and
Windows Mail :

http://www.microsoft.com/technet/security/bulletin/ms08-048.mspx

Risk Factor
Medium/ CVSS Base Score: 5.4
(CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N)
CVSS Temporal Score: 4.5(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-1448

Bugtraq ID
30585

Other references
OSVDB:47413
CWE:264
MSFT:MS08-048

Plugin ID: 11457

Microsoft Windows SMB Registry : Winlogon Cached Password Weakness

Synopsis
User credentials are stored in memory.

List of Hosts

192.168.1.180

Description
The registry key
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount
is non-null. It means that the remote host locally caches the passwords
of the users when they log in, in order to continue to allow the users
to log in in the case of the failure of the PDC.

Solution
use regedt32 and set the value of this key to 0

Risk Factor
Low/ CVSS Base Score: 2.6
(CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N)

Plugin ID: 44423

MS10-013: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935)

Synopsis
It is possible to execute arbitrary code on the remote Windows host using DirectShow.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\Quartz.dll has not been patched
Remote version : 6.6.6001.18000
Should be : 6.6.6001.18389

Description
The version of Microsoft DirectShow installed on the remote host is
affected by a heap buffer overflow that can be triggered when parsing
AVI media files.

If an attacker can trick a user on the affected host into opening a
specially crafted AVI file, he may be able to leverage this issue to
execute arbitrary code subject to the user's privileges.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-013.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-0250

Bugtraq ID
38112

Other references
OSVDB:62257
MSFT:MS10-013
CWE:119

Plugin ID: 48288

MS10-051: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2079403)

Synopsis
Arbitrary code can be executed on the remote host through its Microsoft XML Core Services component.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Msxml3.dll has not been patched
Remote version : 8.100.1043.0
Should be : 8.100.4002.0

Description
The version of Microsoft XML Core Services (MSXML) 3.0 on the remote
Windows host is affected by a memory corruption vulnerability that can
be triggered when processing certain HTTP responses.

If an attacker can trick a user on the affected system into visiting a
malicious web site using Internet Explorer, he may be able to leverage
this issue to execute arbitrary code subject to the user's
privileges.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-051.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2010-2561

Bugtraq ID
42300

Other references
OSVDB:66973
MSFT:MS10-051

Plugin ID: 52585

MS11-017: Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution (2508062)

Synopsis
It is possible to execute arbitrary code on the remote host through the Remote Desktop client.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mstscax.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18564

Description
The remote host contains a version of the Remote Desktop client that
incorrectly restricts the path used for loading external libraries.

If an attacker can trick a user on the affected system into opening a
specially crafted .rdp file located in the same network directory as
a specially crafted dynamic link library (DLL) file, he may be able
to leverage this issue to execute arbitrary code subject to the user's
privileges.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
7, 2008, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms11-017.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2011-0029

Bugtraq ID
46678

Other references
OSVDB:71014
MSFT:MS11-017

Plugin ID: 44424

MS10-014: Vulnerability in Kerberos Could Allow Denial of Service (977290)

Synopsis
It is possible to crash the remote service.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Kdcsvc.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18374

Description
The remote host contains a version of the Kerberos server that
contains a security flaw that may allow an attacker to crash the
remote service via a NULL pointer dereference.

An attacker would need valid credentials to exploit this
vulnerability.

Solution
Microsoft has released a set of patches for Windows 2000, 2003 and
2008:

http://www.microsoft.com/technet/security/bulletin/ms10-014.mspx

Risk Factor
Medium/ CVSS Base Score: 4.0
(CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS Temporal Score: 3.0(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-0035

Bugtraq ID
38110

Other references
OSVDB:62258
MSFT:MS10-014

Plugin ID: 10916

Microsoft Windows - Local Users Information : Passwords never expire

Synopsis
At least one local user has a password that never expires.

List of Hosts

192.168.1.180

Plugin Output

The following local users have passwords that never expire :

- Guest
- WIN-8BPIQBRO0CX$
- EXCHANGE$


Note that, in addition to the Administrator and Guest accounts, Nessus
has only checked for local users with UIDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for this plugin, then re-run the
scan.

Description
Using the supplied credentials, it is possible to list local users
whose passwords never expire.

Solution
Allow / require users to change their passwords regularly.

Risk Factor
None

Other references
OSVDB:755

Plugin ID: 44871

WMI Server Feature Enumeration

Synopsis
It is possible to enumerate Windows server features using WMI.

List of Hosts

192.168.1.180

Plugin Output

Nessus enumerated the following server features :

- Active Directory Domain Controller
- Active Directory Domain Controller Tools
- Active Directory Domain Services
- Active Directory Domain Services Tools
- DNS Server
- DNS Server Tools
- Group Policy Management
- Remote Server Administration Tools
- Role Administration Tools

Description
Nessus was able to enumerate the server features of the remote host by
querying the 'Win32_ServerFeature' class of the '\Root\cimv2' WMI
namespace.

Solution
n/a

See also
http://msdn.microsoft.com/en-us/library/cc280268(VS.85).aspx

Risk Factor
None

Plugin ID: 31794

MS08-021: Vulnerabilities in GDI Could Allow Remote Code Execution (948590)

Synopsis
Arbitrary code can be executed on the remote host by sending a malformed file to a victim.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\gdi32.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18023

Description
The remote host contains a version of Microsoft Windows is missing a critical
security update which fixes several vulnerabilities in the Graphic Rendering
Engine, and in the way Windows handles Metafiles.

An attacker may exploit these flaws to execute arbitrary code on the remote
host. To exploit this flaw, an attacker would need to send a specially
crafted image to a user on the remote host, or lure him into visiting a rogue
website containing such a file.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003 and Vista :

http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-1083
CVE-2008-1087

Bugtraq ID
28570
28571

Other references
OSVDB:44213
OSVDB:44214
OSVDB:44215
CWE:119
MSFT:MS08-021

Plugin ID: 42115

MS09-059: Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (975467)

Synopsis
The remote Windows host is prone to a denial of service attack.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Msv1_0.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18330

Description
The version of LSASS running on the remote host has an integer overflow
vulnerability. A remote attacker could exploit this to cause a denial of
service.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 and 7 :

http://www.microsoft.com/technet/security/Bulletin/MS09-059.mspx

Risk Factor
High/ CVSS Base Score: 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score: 6.4(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-2524

Bugtraq ID
36593

Other references
OSVDB:58862
CWE:189
MSFT:MS09-059

Plugin ID: 48296

MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799)

Synopsis
The remote Windows host has multiple privilege escalation vulnerabilities.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Rtutils.dll has not been patched
Remote version : 6.0.6000.16386
Should be : 6.0.6001.18495

Description
The version of Tracing Feature for Services on the remote host has the
following vulnerabilities :

- Windows places incorrect ACLs on registry keys, which
code allow an attacker to execute code with elevated
privileges. (CVE-2010-2554)

- Memory is allocated in an unspecified, unsafe manner
when processing specially crafted long strings. An
attacker could exploit this to execute code with elevated
privileges. (CVE-2010-2555)

Solution
Microsoft has released a set of patches for Windows Vista, 2008, 7,
and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-059.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.0(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2010-2554
CVE-2010-2555

Bugtraq ID
42259
42269

Other references
OSVDB:66977
OSVDB:66978
MSFT:MS10-059

Plugin ID: 34476

MS08-067: Microsoft Windows Server Service Crafted RPC Request Handling Unspecified Remote Code Execution (958644)

Synopsis
Arbitrary code can be executed on the remote host due to a flaw in the 'server' service.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Netapi32.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18157

Description
The remote host is vulnerable to a buffer overrun in the 'Server' service
which may allow an attacker to execute arbitrary code on the remote host
with the 'System' privileges.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003, Vista and 2008 :

http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx

Risk Factor
Critical/ CVSS Base Score: 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 8.7(CVSS2#E:H/RL:OF/RC:C)

CVE
CVE-2008-4250

Bugtraq ID
31874

Other references
OSVDB:49243
CWE:94
MSFT:MS08-067

Plugin ID: 44401

Microsoft Windows SMB Service Config Enumeration

Synopsis
It is possible to enumerate configuration parameters of remote services.

List of Hosts

192.168.1.180

Plugin Output

The following services are set to start automatically :

AeLookupSvc startup parameters :
Display name : Application Experience
Service name : AeLookupSvc
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs

BFE startup parameters :
Display name : Base Filtering Engine
Service name : BFE
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Dependencies : RpcSs/

BITS startup parameters :
Display name : Background Intelligent Transfer Service
Service name : BITS
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/EventSystem/

CryptSvc startup parameters :
Display name : Cryptographic Services
Service name : CryptSvc
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : RpcSs/

DFSR startup parameters :
Display name : DFS Replication
Service name : DFSR
Log on as : LocalSystem
Executable path : C:\Windows\system32\DFSRs.exe
Dependencies : RpcSs/EventSystem/

DNS startup parameters :
Display name : DNS Server
Service name : DNS
Log on as : LocalSystem
Executable path : C:\Windows\system32\dns.exe
Dependencies : Tcpip/Afd/RpcSs/NTDS/

Dfs startup parameters :
Display name : DFS Namespace
Service name : Dfs
Log on as : LocalSystem
Executable path : C:\Windows\system32\dfssvc.exe
Dependencies : LanmanWorkstation/LanmanServer/DfsDriver/Mup/SamSS/RemoteRegistry/

Dhcp startup parameters :
Display name : DHCP Client
Service name : Dhcp
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : NSI/Tdx/Afd/

Dnscache startup parameters :
Display name : DNS Client
Service name : Dnscache
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : Tdx/

EventLog startup parameters :
Display name : Windows Event Log
Service name : EventLog
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

EventSystem startup parameters :
Display name : COM+ Event System
Service name : EventSystem
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : rpcss/

IKEEXT startup parameters :
Display name : IKE and AuthIP IPsec Keying Modules
Service name : IKEEXT
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : BFE/

IsmServ startup parameters :
Display name : Intersite Messaging
Service name : IsmServ
Log on as : LocalSystem
Executable path : C:\Windows\System32\ismserv.exe
Dependencies : SamSS/NTDS/

KtmRm startup parameters :
Display name : KtmRm for Distributed Transaction Coordinator
Service name : KtmRm
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/SamSS/

LanmanServer startup parameters :
Display name : Server
Service name : LanmanServer
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : SamSS/Srv/

LanmanWorkstation startup parameters :
Display name : Workstation
Service name : LanmanWorkstation
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : Bowser/MRxSmb10/MRxSmb20/NSI/

MpsSvc startup parameters :
Display name : Windows Firewall
Service name : MpsSvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Dependencies : mpsdrv/bfe/

NTDS startup parameters :
Display name : Active Directory Domain Services
Service name : NTDS
Log on as : LocalSystem
Executable path : C:\Windows\System32\lsass.exe

Netlogon startup parameters :
Display name : Netlogon
Service name : Netlogon
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : LanmanWorkstation/LanmanServer/

NlaSvc startup parameters :
Display name : Network Location Awareness
Service name : NlaSvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : NSI/RpcSs/TcpIp/

NtFrs startup parameters :
Display name : File Replication Service
Service name : NtFrs
Log on as : LocalSystem
Executable path : C:\Windows\system32\ntfrs.exe
Dependencies : RpcSs/EventSystem/NTDS/

PlugPlay startup parameters :
Display name : Plug and Play
Service name : PlugPlay
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k DcomLaunch

PolicyAgent startup parameters :
Display name : IPsec Policy Agent
Service name : PolicyAgent
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
Dependencies : Tcpip/bfe/

ProfSvc startup parameters :
Display name : User Profile Service
Service name : ProfSvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RpcSs/

RemoteRegistry startup parameters :
Display name : Remote Registry
Service name : RemoteRegistry
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k regsvc
Dependencies : RPCSS/

SENS startup parameters :
Display name : System Event Notification Service
Service name : SENS
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : EventSystem/

SamSs startup parameters :
Display name : Security Accounts Manager
Service name : SamSs
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RPCSS/

ShellHWDetection startup parameters :
Display name : Shell Hardware Detection
Service name : ShellHWDetection
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/

Splunkd startup parameters :
Display name : Splunkd
Service name : Splunkd
Log on as : LocalSystem
Executable path : C:\Program Files\Splunk\bin\splunkd.exe service

Splunkweb startup parameters :
Display name : Splunkweb
Service name : Splunkweb
Log on as : LocalSystem
Executable path : C:\Program Files\Splunk\bin\PythonService.exe

Spooler startup parameters :
Display name : Print Spooler
Service name : Spooler
Log on as : LocalSystem
Executable path : C:\Windows\System32\spoolsv.exe
Dependencies : RPCSS/http/

TBS startup parameters :
Display name : TPM Base Services
Service name : TBS
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService

TermService startup parameters :
Display name : Terminal Services
Service name : TermService
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/TermDD/

UxSms startup parameters :
Display name : Desktop Window Manager Session Manager
Service name : UxSms
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

W32Time startup parameters :
Display name : Windows Time
Service name : W32Time
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService

WerSvc startup parameters :
Display name : Windows Error Reporting Service
Service name : WerSvc
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k WerSvcGroup

WinRM startup parameters :
Display name : Windows Remote Management (WS-Management)
Service name : WinRM
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/HTTP/

Winmgmt startup parameters :
Display name : Windows Management Instrumentation
Service name : Winmgmt
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RPCSS/

iphlpsvc startup parameters :
Display name : IP Helper
Service name : iphlpsvc
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k NetSvcs
Dependencies : RpcSS/Tdx/winmgmt/tcpip/nsi/

kdc startup parameters :
Display name : Kerberos Key Distribution Center
Service name : kdc
Log on as : LocalSystem
Executable path : C:\Windows\System32\lsass.exe
Dependencies : RpcSs/Afd/NTDS/

lmhosts startup parameters :
Display name : TCP/IP NetBIOS Helper
Service name : lmhosts
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : NetBT/Afd/

netprofm startup parameters :
Display name : Network List Service
Service name : netprofm
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : RpcSs/nlasvc/

nsi startup parameters :
Display name : Network Store Interface Service
Service name : nsi
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : nsiproxy/

seclogon startup parameters :
Display name : Secondary Logon
Service name : seclogon
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs

slsvc startup parameters :
Display name : Software Licensing
Service name : slsvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\SLsvc.exe
Dependencies : RpcSs/

wuauserv startup parameters :
Display name : Windows Update
Service name : wuauserv
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : rpcss/

The following services must be started manually :

ALG startup parameters :
Display name : Application Layer Gateway Service
Service name : ALG
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\alg.exe

AppMgmt startup parameters :
Display name : Application Management
Service name : AppMgmt
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs

Appinfo startup parameters :
Display name : Application Information
Service name : Appinfo
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RpcSs/ProfSvc/

AudioEndpointBuilder startup parameters :
Display name : Windows Audio Endpoint Builder
Service name : AudioEndpointBuilder
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : PlugPlay/

Audiosrv startup parameters :
Display name : Windows Audio
Service name : Audiosrv
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : AudioEndpointBuilder/RpcSs/MMCSS/

COMSysApp startup parameters :
Display name : COM+ System Application
Service name : COMSysApp
Log on as : LocalSystem
Executable path : C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Dependencies : RpcSs/EventSystem/SENS/

EapHost startup parameters :
Display name : Extensible Authentication Protocol
Service name : EapHost
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RPCSS/KeyIso/

FCRegSvc startup parameters :
Display name : Microsoft Fibre Channel Platform Registration Service
Service name : FCRegSvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

FDResPub startup parameters :
Display name : Function Discovery Resource Publication
Service name : FDResPub
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : RpcSs/http/

KeyIso startup parameters :
Display name : CNG Key Isolation
Service name : KeyIso
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RpcSs/

MMCSS startup parameters :
Display name : Multimedia Class Scheduler
Service name : MMCSS
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs

MSiSCSI startup parameters :
Display name : Microsoft iSCSI Initiator Service
Service name : MSiSCSI
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs

Netman startup parameters :
Display name : Network Connections
Service name : Netman
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/nsi/

ProtectedStorage startup parameters :
Display name : Protected Storage
Service name : ProtectedStorage
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RpcSs/

RSoPProv startup parameters :
Display name : Resultant Set of Policy Provider
Service name : RSoPProv
Log on as : LocalSystem
Executable path : C:\Windows\system32\RSoPProv.exe
Dependencies : RPCSS/

RasAuto startup parameters :
Display name : Remote Access Auto Connection Manager
Service name : RasAuto
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RasMan/TapiSrv/

RasMan startup parameters :
Display name : Remote Access Connection Manager
Service name : RasMan
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : Tapisrv/SstpSvc/

RpcLocator startup parameters :
Display name : Remote Procedure Call (RPC) Locator
Service name : RpcLocator
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\locator.exe

SLUINotify startup parameters :
Display name : SL UI Notification Service
Service name : SLUINotify
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : SLSvc/netprofm/EventSystem/

SNMPTRAP startup parameters :
Display name : SNMP Trap
Service name : SNMPTRAP
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\snmptrap.exe

SessionEnv startup parameters :
Display name : Terminal Services Configuration
Service name : SessionEnv
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RPCSS/LanmanWorkstation/

SstpSvc startup parameters :
Display name : Secure Socket Tunneling Protocol Service
Service name : SstpSvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService

THREADORDER startup parameters :
Display name : Thread Ordering Server
Service name : THREADORDER
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService

TapiSrv startup parameters :
Display name : Telephony
Service name : TapiSrv
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k tapisrv
Dependencies : PlugPlay/RpcSs/

TrkWks startup parameters :
Display name : Distributed Link Tracking Client
Service name : TrkWks
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/

UI0Detect startup parameters :
Display name : Interactive Services Detection
Service name : UI0Detect
Log on as : LocalSystem
Executable path : C:\Windows\system32\UI0Detect.exe

UmRdpService startup parameters :
Display name : Terminal Services UserMode Port Redirector
Service name : UmRdpService
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : TermService/

VSS startup parameters :
Display name : Volume Shadow Copy
Service name : VSS
Log on as : LocalSystem
Executable path : C:\Windows\system32\vssvc.exe
Dependencies : RPCSS/

WPDBusEnum startup parameters :
Display name : Portable Device Enumerator Service
Service name : WPDBusEnum
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/

WcsPlugInService startup parameters :
Display name : Windows Color System
Service name : WcsPlugInService
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k wcssvc
Dependencies : RpcSs/

Wecsvc startup parameters :
Display name : Windows Event Collector
Service name : Wecsvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : HTTP/Eventlog/mpssvc/

WinHttpAutoProxySvc startup parameters :
Display name : WinHTTP Web Proxy Auto-Discovery Service
Service name : WinHttpAutoProxySvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : Dhcp/

clr_optimization_v2.0.50727_32 startup parameters :
Display name : Microsoft .NET Framework NGEN v2.0.50727_X86
Service name : clr_optimization_v2.0.50727_32
Log on as : LocalSystem
Executable path : C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

dot3svc startup parameters :
Display name : Wired AutoConfig
Service name : dot3svc
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/Ndisuio/Eaphost/

fdPHost startup parameters :
Display name : Function Discovery Provider Host
Service name : fdPHost
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : RpcSs/http/

hidserv startup parameters :
Display name : Human Interface Device Access
Service name : hidserv
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

hkmsvc startup parameters :
Display name : Health Key and Certificate Management
Service name : hkmsvc
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/

lltdsvc startup parameters :
Display name : Link-Layer Topology Discovery Mapper
Service name : lltdsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : rpcss/lltdio/

msiserver startup parameters :
Display name : Windows Installer
Service name : msiserver
Log on as : LocalSystem
Executable path : C:\Windows\system32\msiexec /V
Dependencies : rpcss/

napagent startup parameters :
Display name : Network Access Protection Agent
Service name : napagent
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RpcSs/

pla startup parameters :
Display name : Performance Logs & Alerts
Service name : pla
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Dependencies : RPCSS/

sacsvr startup parameters :
Display name : Special Administration Console Helper
Service name : sacsvr
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs

swprv startup parameters :
Display name : Microsoft Software Shadow Copy Provider
Service name : swprv
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k swprv
Dependencies : RPCSS/

vds startup parameters :
Display name : Virtual Disk
Service name : vds
Log on as : LocalSystem
Executable path : C:\Windows\System32\vds.exe
Dependencies : RpcSs/PlugPlay/

wercplsupport startup parameters :
Display name : Problem Reports and Solutions Control Panel Support
Service name : wercplsupport
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs

wmiApSrv startup parameters :
Display name : WMI Performance Adapter
Service name : wmiApSrv
Log on as : localSystem
Executable path : C:\Windows\system32\wbem\WmiApSrv.exe

wudfsvc startup parameters :
Display name : Windows Driver Foundation - User-mode Driver Framework
Service name : wudfsvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : PlugPlay/

The following services are disabled :

Browser startup parameters :
Display name : Computer Browser
Service name : Browser
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : LanmanWorkstation/LanmanServer/

CscService startup parameters :
Display name : Offline Files
Service name : CscService
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/

IPBusEnum startup parameters :
Display name : PnP-X IP Bus Enumerator
Service name : IPBusEnum
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/fdPHost/

RemoteAccess startup parameters :
Display name : Routing and Remote Access
Service name : RemoteAccess
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSS/Bfe/RasMan/Http/+NetBIOSGroup/

SSDPSRV startup parameters :
Display name : SSDP Discovery
Service name : SSDPSRV
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : HTTP/

SharedAccess startup parameters :
Display name : Internet Connection Sharing (ICS)
Service name : SharedAccess
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : Netman/WinMgmt/RasMan/BFE/

SysMain startup parameters :
Display name : Superfetch
Service name : SysMain
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : rpcss/fileinfo/

Themes startup parameters :
Display name : Themes
Service name : Themes
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs

upnphost startup parameters :
Display name : UPnP Device Host
Service name : upnphost
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : SSDPSRV/HTTP/

Description
This plugin implements the QueryServiceConfig() calls to obtain,
using the SMB protocol, the launch parameters of each active service
on the remote host (executable path, log on type, etc).

Solution
Ensure that each service is configured properly.

Risk Factor
None

Plugin ID: 45506

MS10-019: Vulnerabilities in Windows Could Allow Remote Code Execution (981210)

Synopsis
The remote Windows host has multiple code execution vulnerabilities.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Wintrust.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18387

Description
The version of Windows running on the remote host has vulnerabilities
in the Windows Authenticode Signature mechanism. Modifying an
existing signed executable or cabinet file can result in arbitrary
code execution.

A remote attacker could exploit this by tricking a user into executing
or opening a maliciously crafted file, resulting in arbitrary code
execution.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-019.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-0486
CVE-2010-0487

Bugtraq ID
39328
39332

Other references
OSVDB:63745
OSVDB:63746
MSFT:MS10-019

Plugin ID: 46841

MS10-034: Cumulative Security Update of ActiveX Kill Bits (980195)

Synopsis
The remote Windows host is missing an update that disables selected ActiveX controls.

List of Hosts

192.168.1.180

Plugin Output

The kill bit has not been set for the following control :

{14FD1463-1F3F-4357-9C03-2080B442F503}

Note that Nessus did not check whether there were other kill bits
that have not been set because "Thorough Tests" was not enabled
when this scan was run.

Description
The Microsoft Data Analyzer ActiveX control has a remote code
execution vulnerability. The system may also have one or more
vulnerable third-party ActiveX controls installed.

A remote attacker could exploit these issues by tricking a user into
requesting a maliciously crafted web page, resulting in arbitrary
code execution.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-034.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-0252
CVE-2010-0811
CVE-2010-2193

Bugtraq ID
38045
40490
40494
40496
40535

Other references
OSVDB:62246
OSVDB:65218
OSVDB:65382
OSVDB:65468
OSVDB:65480
OSVDB:65481
CWE:94
MSFT:MS10-034

Plugin ID: 48337

Windows ComputerSystemProduct Enumeration (WMI)

Synopsis
It is possible to obtain product information from the remote host using WMI.

List of Hosts

192.168.1.180

Plugin Output

+ Computer System Product
- IdentifyingNumber : VMware-56 4d b0 ad 12 c6 9b f3-49 9a 05 61 c8 9d a1 c6
- Description : Computer System Product
- Vendor : VMware, Inc.
- Name : VMware Virtual Platform
- UUID : ADB04D56-C612-F39B-499A-0561C89DA1C6
- Version : None

Description
By querying the WMI class 'Win32_ComputerSystemProduct', it is
possible to extract product information about the computer system such
as UUID, IdentifyingNumber, vendor, etc.

Solution
n/a

See also
http://msdn.microsoft.com/en-us/library/aa394105%28VS.85%29.aspx

Risk Factor
None

Plugin ID: 40407

MS09-034: Cumulative Security Update for Internet Explorer (972260)

Synopsis
Arbitrary code can be executed on the remote host through a web browser.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mshtml.dll has not been patched
Remote version : 7.0.6001.18000
Should be : 7.0.6001.18294

Description
The remote host is missing IE Security Update 972260.

The remote version of IE is affected by several vulnerabilities that
may allow an attacker to execute arbitrary code on the remote host.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-034.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2009-1917
CVE-2009-1918
CVE-2009-1919

Bugtraq ID
35826
35827
35831

Other references
OSVDB:56693
OSVDB:56694
OSVDB:56695
CWE:94
MSFT:MS09-034

Plugin ID: 46842

MS10-035: Cumulative Security Update for Internet Explorer (982381)

Synopsis
Arbitrary code can be executed on the remote host through a web browser.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mshtml.dll has not been patched
Remote version : 7.0.6001.18000
Should be : 7.0.6001.18470

Description
The remote host is missing IE Security Update 982381.

The remote version of IE is affected by several vulnerabilities that
may allow an attacker to execute arbitrary code on the remote host.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-035.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2010-0255
CVE-2010-1257
CVE-2010-1259
CVE-2010-1260
CVE-2010-1261
CVE-2010-1262

Bugtraq ID
38055
38056
40410
40414
40416
40417

Other references
OSVDB:62156
OSVDB:65211
OSVDB:65212
OSVDB:65213
OSVDB:65214
OSVDB:65215
CWE:264
MSFT:MS10-035

Plugin ID: 10398

Microsoft Windows SMB LsaQueryInformationPolicy Function NULL Session Domain SID Enumeration

Synopsis
It is possible to obtain the domain SID.

List of Hosts

192.168.1.180

Plugin Output
The remote domain SID value is :
1-5-21-3840563293-1772093868-3818923108

Description
By emulating the call to LsaQueryInformationPolicy() it was
possible to obtain the domain SID (Security Identifier).

The domain SID can then be used to get the list of users
of the domain

Solution
n/a

Risk Factor
None

CVE
CVE-2000-1200

Bugtraq ID
959

Other references
OSVDB:715

Plugin ID: 10400

Microsoft Windows SMB Registry Remotely Accessible

Synopsis
Access the remote Windows Registry.

List of Hosts

192.168.1.180

Description
It was possible to access the remote Windows Registry using the login
/ password combination used for the Windows local checks (SMB tests).

Solution
n/a

Risk Factor
None

Plugin ID: 48761

MS KB982316: Elevation of Privilege Using Windows Service Isolation Bypass

Synopsis
The remote Windows host has a privilege escalation vulnerability.

List of Hosts

192.168.1.180

Plugin Output

The Network Service group has Full Control rights to :

HKLM\Software\Microsoft\Windows\CurrentVersion\Telephony

Description
Windows Service Isolation can be bypassed on the remote host,
resulting in the elevation of privileges.

A local attacker could exploit this by leveraging the TAPI service to
execute code as SYSTEM.

A similar problem affects other Windows services that run as the
NetworkService user (e.g. IIS, SQL Server), though Nessus has
not checked for those issues.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/advisory/2264072.mspx

Although these patches mitigate this vulnerability, users should
be aware this is considered a non-security update by Microsoft.
Refer to the Microsoft advisory for more information.

See also
http://argeniss.com/research/TokenKidnappingRevengePaper.pdf
http://www.microsoft.com/technet/security/advisory/2264072.mspx

Risk Factor
Medium/ CVSS Base Score: 6.8
(CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS Temporal Score: 5.6(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2010-1886

Bugtraq ID
42278

Other references
OSVDB:67083

Plugin ID: 33441

MS08-037: Vulnerabilities in DNS Could Allow Spoofing (953230)

Synopsis
The remote host is vulnerable to DNS spoofing attacks.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\dns.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18081

Description
Flaws in the remote DNS library may let an attacker send malicious DNS
responses to DNS requests made by the remote host, thereby spoofing or
redirecting internet traffic from legitimate locations.

Solution
Microsoft has released patches for Windows 2000, XP, and 2003 Server :

http://www.microsoft.com/technet/security/Bulletin/MS08-037.mspx

Risk Factor
Medium/ CVSS Base Score: 5.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS Temporal Score: 4.8(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-1447
CVE-2008-1454

Bugtraq ID
30131
30132

Other references
OSVDB:46777
OSVDB:46778
MSFT:MS08-037

Plugin ID: 46844

MS10-037: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Elevation of Privilege (980218)

Synopsis
The remote Windows host contains a font driver that is affected by a privilege escalation vulnerability.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\Atmfd.dll has not been patched
Remote version : 5.1.2.226
Should be : 5.1.2.228

Description
The remote Windows host contains a version of the OpenType Compact
Font Format (CFF) Font Driver that fails to properly validate certain
data passed from user mode to kernel mode.

By viewing content rendered in a specially crafted CFF font, a local
attacker may be able to exploit this vulnerability to execute
arbitrary code in kernel mode and take complete control of the
affected system.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-037.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-0819

Bugtraq ID
40572

Other references
OSVDB:65217
MSFT:MS10-037

Plugin ID: 38153

Microsoft Windows Summary of Missing Patches

Synopsis
The remote host is missing several Microsoft Security Patches

List of Hosts

192.168.1.180

Plugin Output
The patches for the following bulletins are missing on the remote host :

- MS08-021 ( http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx )
- MS08-024 ( http://www.microsoft.com/technet/security/bulletin/ms08-024.mspx )
- MS08-025 ( http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx )
- MS08-031 ( http://www.microsoft.com/technet/security/bulletin/ms08-031.mspx )
- MS08-032 ( http://www.microsoft.com/technet/security/bulletin/ms08-032.mspx )
- MS08-033 ( http://www.microsoft.com/technet/security/bulletin/ms08-033.mspx )
- MS08-035 ( http://www.microsoft.com/technet/security/bulletin/ms08-035.mspx )
- MS08-037 ( http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx )
- MS08-038 ( http://www.microsoft.com/technet/security/bulletin/ms08-038.mspx )
- MS08-045 ( http://www.microsoft.com/technet/security/bulletin/ms08-045.mspx )
- MS08-047 ( http://www.microsoft.com/technet/security/bulletin/ms08-047.mspx )
- MS08-048 ( http://www.microsoft.com/technet/security/bulletin/ms08-048.mspx )
- MS08-049 ( http://www.microsoft.com/technet/security/bulletin/ms08-049.mspx )
- MS08-058 ( http://www.microsoft.com/technet/security/bulletin/ms08-058.mspx )
- MS08-061 ( http://www.microsoft.com/technet/security/bulletin/ms08-061.mspx )
- MS08-063 ( http://www.microsoft.com/technet/security/bulletin/ms08-063.mspx )
- MS08-064 ( http://www.microsoft.com/technet/security/bulletin/ms08-064.mspx )
- MS08-067 ( http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx )
- MS08-068 ( http://www.microsoft.com/technet/security/bulletin/ms08-068.mspx )
- MS08-069 ( http://www.microsoft.com/technet/security/bulletin/ms08-069.mspx )
- MS08-071 ( http://www.microsoft.com/technet/security/bulletin/ms08-071.mspx )
- MS08-073 ( http://www.microsoft.com/technet/security/bulletin/ms08-073.mspx )
- MS08-075 ( http://www.microsoft.com/technet/security/bulletin/ms08-075.mspx )
- MS08-078 ( http://www.microsoft.com/technet/security/bulletin/ms08-078.mspx )
- MS09-002 ( http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx )
- MS09-006 ( http://www.microsoft.com/technet/security/bulletin/ms09-006.mspx )
- MS09-007 ( http://www.microsoft.com/technet/security/bulletin/ms09-007.mspx )
- MS09-008 ( http://www.microsoft.com/technet/security/bulletin/ms09-008.mspx )
- MS09-012 ( http://www.microsoft.com/technet/security/bulletin/ms09-012.mspx )
- MS09-013 ( http://www.microsoft.com/technet/security/bulletin/ms09-013.mspx )
- MS09-014 ( http://www.microsoft.com/technet/security/bulletin/ms09-014.mspx )
- MS09-015 ( http://www.microsoft.com/technet/security/bulletin/ms09-015.mspx )
- MS09-019 ( http://www.microsoft.com/technet/security/bulletin/ms09-019.mspx )
- MS09-022 ( http://www.microsoft.com/technet/security/bulletin/ms09-022.mspx )
- MS09-025 ( http://www.microsoft.com/technet/security/bulletin/ms09-025.mspx )
- MS09-026 ( http://www.microsoft.com/technet/security/bulletin/ms09-026.mspx )
- MS09-029 ( http://www.microsoft.com/technet/security/bulletin/ms09-029.mspx )
- MS09-032 ( http://www.microsoft.com/technet/security/bulletin/ms09-032.mspx )
- MS09-034 ( http://www.microsoft.com/technet/security/bulletin/ms09-034.mspx )
- MS09-037 ( http://www.microsoft.com/technet/security/bulletin/ms09-037.mspx )
- MS09-038 ( http://www.microsoft.com/technet/security/bulletin/ms09-038.mspx )
- MS09-041 ( http://www.microsoft.com/technet/security/bulletin/ms09-041.mspx )
- MS09-044 ( http://www.microsoft.com/technet/security/bulletin/ms09-044.mspx )
- MS09-045 ( http://www.microsoft.com/technet/security/bulletin/ms09-045.mspx )
- MS09-048 ( http://www.microsoft.com/technet/security/bulletin/ms09-048.mspx )
- MS09-050 ( http://www.microsoft.com/technet/security/bulletin/ms09-050.mspx )
- MS09-051 ( http://www.microsoft.com/technet/security/bulletin/ms09-051.mspx )
- MS09-054 ( http://www.microsoft.com/technet/security/bulletin/ms09-054.mspx )
- MS09-055 ( http://www.microsoft.com/technet/security/bulletin/ms09-055.mspx )
- MS09-056 ( http://www.microsoft.com/technet/security/bulletin/ms09-056.mspx )
- MS09-058 ( http://www.microsoft.com/technet/security/bulletin/ms09-058.mspx )
- MS09-059 ( http://www.microsoft.com/technet/security/bulletin/ms09-059.mspx )
- MS09-062 ( http://www.microsoft.com/technet/security/bulletin/ms09-062.mspx )
- MS09-063 ( http://www.microsoft.com/technet/security/bulletin/ms09-063.mspx )
- MS09-065 ( http://www.microsoft.com/technet/security/bulletin/ms09-065.mspx )
- MS09-066 ( http://www.microsoft.com/technet/security/bulletin/ms09-066.mspx )
- MS09-071 ( http://www.microsoft.com/technet/security/bulletin/ms09-071.mspx )
- MS09-072 ( http://www.microsoft.com/technet/security/bulletin/ms09-072.mspx )
- MS10-001 ( http://www.microsoft.com/technet/security/bulletin/ms10-001.mspx )
- MS10-002 ( http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx )
- MS10-006 ( http://www.microsoft.com/technet/security/bulletin/ms10-006.mspx )
- MS10-008 ( http://www.microsoft.com/technet/security/bulletin/ms10-008.mspx )
- MS10-009 ( http://www.microsoft.com/technet/security/bulletin/ms10-009.mspx )
- MS10-012 ( http://www.microsoft.com/technet/security/bulletin/ms10-012.mspx )
- MS10-013 ( http://www.microsoft.com/technet/security/bulletin/ms10-013.mspx )
- MS10-014 ( http://www.microsoft.com/technet/security/bulletin/ms10-014.mspx )
- MS10-015 ( http://www.microsoft.com/technet/security/bulletin/ms10-015.mspx )
- MS10-018 ( http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx )
- MS10-019 ( http://www.microsoft.com/technet/security/bulletin/ms10-019.mspx )
- MS10-020 ( http://www.microsoft.com/technet/security/bulletin/ms10-020.mspx )
- MS10-021 ( http://www.microsoft.com/technet/security/bulletin/ms10-021.mspx )
- MS10-022 ( http://www.microsoft.com/technet/security/bulletin/ms10-022.mspx )
- MS10-029 ( http://www.microsoft.com/technet/security/bulletin/ms10-029.mspx )
- MS10-030 ( http://www.microsoft.com/technet/security/bulletin/ms10-030.mspx )
- MS10-032 ( http://www.microsoft.com/technet/security/bulletin/ms10-032.mspx )
- MS10-033 ( http://www.microsoft.com/technet/security/bulletin/ms10-033.mspx )
- MS10-034 ( http://www.microsoft.com/technet/security/bulletin/ms10-034.mspx )
- MS10-035 ( http://www.microsoft.com/technet/security/bulletin/ms10-035.mspx )
- MS10-037 ( http://www.microsoft.com/technet/security/bulletin/ms10-037.mspx )
- MS10-046 ( http://www.microsoft.com/technet/security/bulletin/ms10-046.mspx )
- MS10-047 ( http://www.microsoft.com/technet/security/bulletin/ms10-047.mspx )
- MS10-048 ( http://www.microsoft.com/technet/security/bulletin/ms10-048.mspx )
- MS10-049 ( http://www.microsoft.com/technet/security/bulletin/ms10-049.mspx )
- MS10-051 ( http://www.microsoft.com/technet/security/bulletin/ms10-051.mspx )
- MS10-053 ( http://www.microsoft.com/technet/security/bulletin/ms10-053.mspx )
- MS10-054 ( http://www.microsoft.com/technet/security/bulletin/ms10-054.mspx )
- MS10-058 ( http://www.microsoft.com/technet/security/bulletin/ms10-058.mspx )
- MS10-059 ( http://www.microsoft.com/technet/security/bulletin/ms10-059.mspx )
- MS10-061 ( http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx )
- MS10-063 ( http://www.microsoft.com/technet/security/bulletin/ms10-063.mspx )
- MS10-068 ( http://www.microsoft.com/technet/security/bulletin/ms10-068.mspx )
- MS10-070 ( http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx )
- MS10-071 ( http://www.microsoft.com/technet/security/bulletin/ms10-071.mspx )
- MS10-073 ( http://www.microsoft.com/technet/security/bulletin/ms10-073.mspx )
- MS10-074 ( http://www.microsoft.com/technet/security/bulletin/ms10-074.mspx )
- MS10-076 ( http://www.microsoft.com/technet/security/bulletin/ms10-076.mspx )
- MS10-081 ( http://www.microsoft.com/technet/security/bulletin/ms10-081.mspx )
- MS10-083 ( http://www.microsoft.com/technet/security/bulletin/ms10-083.mspx )
- MS10-085 ( http://www.microsoft.com/technet/security/bulletin/ms10-085.mspx )
- MS10-090 ( http://www.microsoft.com/technet/security/bulletin/ms10-090.mspx )
- MS10-091 ( http://www.microsoft.com/technet/security/bulletin/ms10-091.mspx )
- MS10-092 ( http://www.microsoft.com/technet/security/bulletin/ms10-092.mspx )
- MS10-096 ( http://www.microsoft.com/technet/security/bulletin/ms10-096.mspx )
- MS10-098 ( http://www.microsoft.com/technet/security/bulletin/ms10-098.mspx )
- MS10-100 ( http://www.microsoft.com/technet/security/bulletin/ms10-100.mspx )
- MS10-101 ( http://www.microsoft.com/technet/security/bulletin/ms10-101.mspx )
- MS11-002 ( http://www.microsoft.com/technet/security/bulletin/ms11-002.mspx )
- MS11-003 ( http://www.microsoft.com/technet/security/bulletin/ms11-003.mspx )
- MS11-006 ( http://www.microsoft.com/technet/security/bulletin/ms11-006.mspx )
- MS11-007 ( http://www.microsoft.com/technet/security/bulletin/ms11-007.mspx )
- MS11-011 ( http://www.microsoft.com/technet/security/bulletin/ms11-011.mspx )
- MS11-012 ( http://www.microsoft.com/technet/security/bulletin/ms11-012.mspx )
- MS11-017 ( http://www.microsoft.com/technet/security/bulletin/ms11-017.mspx )

Description
This plugin summarizes the list of Microsoft Security Patches which
have not been installed on the remote host.

You should review and apply them to be up-to-date.

Solution
Run Windows Update on the remote host, or use a patch management solution

Risk Factor
None

Plugin ID: 33138

MS08-035: Vulnerability in Active Directory Could Allow Denial of Service (953235)

Synopsis
It is possible to crash Active Directory on the remote host.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\ntdsai.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18072

Description
The remote version of Active Directory contains a denial of service
vulnerability when processing LDAP requests. An attacker may exploit
this flaw to crash the remote Active Directory server.

Solution
Microsoft has released a set of patches for Windows 2000, Windows XP,
Windows 2003 and 2008 :

http://www.microsoft.com/technet/security/bulletin/ms08-035.mspx

Risk Factor
Medium/ CVSS Base Score: 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score: 4.1(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-1445

Bugtraq ID
29584

Other references
OSVDB:46066
CWE:20
MSFT:MS08-035

Plugin ID: 48942

Microsoft Windows SMB Registry : OS Version and Processor Architecture

Synopsis
It is possible to determine the processor architecture and Windows OS version installed on the remote system.

List of Hosts

192.168.1.180

Plugin Output

Operating System Version = 6.0.6001
Architecture = x86

Description
By using the supplied credentials, it is possible to connect to the
remote registry and determine the processor architecture and the
Windows OS version installed on the remote system.

Solution
n/a

Risk Factor
None

Plugin ID: 46840

MS10-033: Vulnerabilities in Media Decompression Could Allow Remote Code Execution (979902)

Synopsis
Opening a specially crafted media file can result in arbitrary code execution.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Asycfilt.dll has not been patched
Remote version : 6.0.6000.16386
Should be : 6.0.6001.18454
- C:\Windows\System32\Quartz.dll has not been patched
Remote version : 6.6.6001.18000
Should be : 6.6.6001.18461

Description
The remote Windows host has multiple unspecified code execution
vulnerabilities related to media decompression. A remote attacker
could exploit this by tricking a user into opening a specially crafted
media file, resulting in arbitrary code execution.

Solution
Microsoft has released a set of patches for DirectX 9, Windows Media
Format Runtime, Windows Media Encoder, and Asycfilt.dll (COM
component) :

http://www.microsoft.com/technet/security/bulletin/MS10-033.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2010-1879
CVE-2010-1880

Bugtraq ID
40432
40464

Other references
OSVDB:65221
OSVDB:65222
MSFT:MS10-033

Plugin ID: 10908

Microsoft Windows 'Domain Administrators' Group User List

Synopsis
There is at least one user in the 'Domain Administrators' group.

List of Hosts

192.168.1.180

Plugin Output

The following user is a member of the 'Domain Administrators' group :

- Administrator

Description
Using the supplied credentials, it is possible to extract the member
list of the 'Domain Administrators' group. Members of this group have
complete access to the Windows Domain.

Solution
Verify that each member of the group should have this type of access.

Risk Factor
None

Plugin ID: 35824

MS09-008: Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238)

Synopsis
The remote host is vulnerable to DNS and/or WINS spoofing attacks.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Dns.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18214

Description
The remote host has a Windows DNS server and/or a Windows WINS server
installed.

Multiple vulnerabilities in the way that Windows DNS servers cache and
validate queries as well as the way that Windows DNS servers and
Windows WINS servers handle WPAD and ISATAP registration may allow
remote attackers to redirect network traffic intended for systems on
the Internet to the attacker's own systems.

Solution
Microsoft has released a set of patches for Windows 2000, 2003 and
2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-008.mspx

Risk Factor
Medium/ CVSS Base Score: 5.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS Temporal Score: 4.3(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2009-0093
CVE-2009-0094
CVE-2009-0233
CVE-2009-0234

Bugtraq ID
33982
33988
33989
34013

Other references
OSVDB:52517
OSVDB:52518
OSVDB:52519
OSVDB:52520
CWE:20
MSFT:MS09-008

Plugin ID: 24269

Windows Management Instrumentation (WMI) Available

Synopsis
WMI queries can be made against the remote host.

List of Hosts

192.168.1.180

Description
The supplied credentials can be used to make WMI (Windows Management
Instrumentation) requests against the remote host over DCOM.

These requests can be used to gather information about the remote host
such as its current state, network interface configuration, etc.

Solution
n/a

See also
http://www.microsoft.com/whdc/system/pnppwr/wmi/default.mspx

Risk Factor
None

Plugin ID: 33874

MS08-045: Cumulative Security Update for Internet Explorer (953838)

Synopsis
Arbitrary code can be executed on the remote host through the web client.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mshtml.dll has not been patched
Remote version : 7.0.6001.18000
Should be : 7.0.6001.18099

Description
The remote host is missing the IE cumulative security update 953838.

The remote version of IE is vulnerable to several flaws which may
allow an attacker to execute arbitrary code on the remote host.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008:

http://www.microsoft.com/technet/security/Bulletin/MS08-045.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2008-2254
CVE-2008-2255
CVE-2008-2256
CVE-2008-2257
CVE-2008-2258
CVE-2008-2259

Bugtraq ID
28295
30610
30611
30612
30613
30614

Other references
OSVDB:47414
OSVDB:47415
OSVDB:47416
OSVDB:47417
OSVDB:47418
OSVDB:47419
CWE:399
MSFT:MS08-045

Plugin ID: 45378

MS10-018: Cumulative Security Update for Internet Explorer (980182)

Synopsis
Arbitrary code can be executed on the remote host through a web browser.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mshtml.dll has not been patched
Remote version : 7.0.6001.18000
Should be : 7.0.6001.18444

Description
The remote host is missing IE Security Update 980182.

The remote version of IE is affected by several vulnerabilities that
may allow an attacker to execute arbitrary code on the remote host.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, and Windows 7 :

http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2010-0267
CVE-2010-0488
CVE-2010-0489
CVE-2010-0490
CVE-2010-0491
CVE-2010-0492
CVE-2010-0494
CVE-2010-0805
CVE-2010-0806
CVE-2010-0807

Bugtraq ID
38615
39023
39024
39025
39026
39027
39028
39030
39031
39047

Other references
OSVDB:62810
OSVDB:63327
OSVDB:63328
OSVDB:63329
OSVDB:63330
OSVDB:63331
OSVDB:63332
OSVDB:63333
OSVDB:63334
OSVDB:63335
MSFT:MS10-018

Plugin ID: 42112

MS09-056: Vulnerabilities in Windows CryptoAPI Could Allow Spoofing (974571)

Synopsis
Certain identity validation methods may be bypassed allowing impersonation.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\msasn1.dll has not been patched
Remote version : 6.0.6000.16386
Should be : 6.0.6001.18326

Description
The remote Windows host contains a version of the Microsoft Windows CryptoAPI
that is affected by multiple vulnerabilities :

- A spoofing vulnerability exists in the Microsoft Windows
CryptoAPI component when parsing ASN.1 information from
X.509 certificates. An attacker who successfully
exploited this vulnerability could impersonate another
user or system. (CVE-2009-2510)

- A spoofing vulnerability exists in the Microsoft Windows
CryptoAPI component when parsing ASN.1 object
identifiers from X.509 certificates. An attacker who
successfully exploited this vulnerability could
impersonate another user or system. (CVE-2009-2511)

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008 and Windows 7 :

http://www.microsoft.com/technet/security/bulletin/MS09-056.mspx

Risk Factor
Medium/ CVSS Base Score: 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS Temporal Score: 4.1(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-2510
CVE-2009-2511

Bugtraq ID
36475
36577

Other references
OSVDB:58855
OSVDB:58856
CWE:189
MSFT:MS09-056

Plugin ID: 42440

MS09-066: Vulnerability in Active Directory Could Allow Denial of Service (973309)

Synopsis
The installed version of Active Directory is prone to a denial of service attack.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Ntdsai.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18281

Description
The installed version of Microsoft Active Directory / Active
Directory Application Mode / Active Directory Lightweight Directory
Service has a buffer overflow vulnerability. By sending specially
crafted LDAP or LDAPS requests, a remote attacker may be able to
exhaust stack space and cause the affected host to stop responding
until it is restarted.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-066.mspx

Risk Factor
High/ CVSS Base Score: 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score: 6.4(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-1928

Bugtraq ID
36918

Other references
OSVDB:59856
CWE:399
MSFT:MS09-066

Plugin ID: 17651

Microsoft Windows SMB : Obtains the Password Policy

Synopsis
It is possible to retrieve the remote host's password policy using the supplied credentials.

List of Hosts

192.168.1.180

Plugin Output
The following password policy is defined on the remote host:

Minimum password len: 7
Password history len: 24
Maximum password age (d): 42
Password must meet complexity requirements: Enabled
Minimum password age (d): 1
Forced logoff time (s): Not set
Locked account time (s): 1800
Time between failed logon (s): 1800
Number of invalid logon before locked out (s): 0

Description
Using the supplied credentials it was possible to extract the
password policy for the remote Windows host. The password policy must
conform to the Informational System Policy.

Solution
n/a

Risk Factor
None

Plugin ID: 51912

MS11-012: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2479628)

Synopsis
The remote Windows kernel is affected by multiple vulnerabilities.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Win32k.sys has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18573

Description
The remote host is running a version of the Windows kernel that is
affected by one or more of the following vulnerabilities :

- The Win32k.sys kernel-mode driver improperly validates
data supplied from user mode to kernel mode.
(CVE-2011-0086)

- The Win32k.sys kernel-mode driver insufficiently
validates data supplied from user mode to kernel mode.
(CVE-2011-0087)

- The Win32k.sys kernel-mode driver does not properly
validate data supplied from user mode to kernel mode,
resulting in a 'Window Class Pointer Confusion'
vulnerability. (CVE-2011-0088)

- The Win32k.sys kernel-mode driver does not properly
validate data supplied from user mode to kernel mode,
resulting in a 'Window Class Improper Pointer
Validation' vulnerability. (CVE-2011-0089)

- The Win32k.sys kernel-mode driver does not properly
validate data supplied from user mode to kernel mode,
resulting in a memory corruption vulnerability.
(CVE-2011-0090)

An attacker with local access to the affected system can exploit these
issues to execute arbitrary code in kernel mode and take complete
control of the affected system.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS11-012.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVE
CVE-2011-0086
CVE-2011-0087
CVE-2011-0088
CVE-2011-0089
CVE-2011-0090

Bugtraq ID
46141
46147
46148
46149
46150

Other references
OSVDB:70814
OSVDB:70816
OSVDB:70817
OSVDB:70818
OSVDB:70819
MSFT:MS11-012

Plugin ID: 47750

MS KB2286198: Windows Shell Shortcut Icon Parsing Arbitrary Code Execution

Synopsis
It may be possible to execute arbitrary code on the remote Windows host using a malicious shortcut file.

List of Hosts

192.168.1.180

Plugin Output

According to the following registry entries, displaying shortcut
icons has not been disabled :

Key : HKEY_CLASS_ROOT\lnkfile\shellex\IconHandler
Value : {00021401-0000-0000-C000-000000000046}

Key : HKEY_CLASS_ROOT\piffile\shellex\IconHandler
Value : {00021401-0000-0000-C000-000000000046}

Description
Windows Shell does not properly validate the parameters of a shortcut
file when loading its icon. Attempting to parse the icon of a
specially crafted shortcut file can result in arbitrary code
execution.

A remote attacker could exploit this by tricking a user into viewing a
malicious shortcut file via Windows Explorer, or any other application
that parses the shortcut's icon. This can also be exploited by an
attacker who tricks a user into inserting removable media containing
a malicious shortcut (e.g. CD, USB drive), and AutoPlay is enabled.

Solution
Either apply MS10-046 or disable the displaying of shortcut icons
(refer to the Microsoft advisory).

See also
http://www.microsoft.com/technet/security/advisory/2286198.mspx
http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2010-2568

Bugtraq ID
41732

Other references
OSVDB:66387
CERT:940193
EDB-ID:14403
Secunia:40647
MSFT:MS10-046

Plugin ID: 24272

Network Interfaces Enumeration (WMI)

Synopsis
It is possible to obtain the list of network interfaces on the remote host.

List of Hosts

192.168.1.180

Plugin Output
+ Network Interface Information :

- Network Interface = [00000006] Intel(R) PRO/1000 MT Network Connection
- MAC Address = 00:0C:29:9D:A1:C6
- IPAddress/IPSubnet = 192.168.1.180/255.255.255.0
- IPAddress/IPSubnet = fe80::70ba:cd7a:a6bc:7237/64


+ Routing Information :

Destination Netmask Gateway
----------- ------- -------
127.0.0.0 255.0.0.0 0.0.0.0
127.0.0.1 255.255.255.255 0.0.0.0
127.255.255.255 255.255.255.255 0.0.0.0
192.168.1.0 255.255.255.0 0.0.0.0
192.168.1.180 255.255.255.255 0.0.0.0
192.168.1.255 255.255.255.255 0.0.0.0
224.0.0.0 240.0.0.0 0.0.0.0
224.0.0.0 240.0.0.0 0.0.0.0
255.255.255.255 255.255.255.255 0.0.0.0
255.255.255.255 255.255.255.255 0.0.0.0

Description
It is possible to use WMI queries to extract the list of network
interfaces on the remote host and the IP attached to them.

Solution
n/a

Risk Factor
None

Plugin ID: 34414

MS KB956391: Cumulative Security Update of ActiveX Kill Bits

Synopsis
The remote Windows host is missing a security update containing ActiveX kill bits

List of Hosts

192.168.1.180

Plugin Output

The kill-bit has not been set for the following control :

{AED98630-0251-4E83-917D-43A23D66D507}

Note that Nessus did not check whether there were other kill-bits
that have not been set because 'Thorough Tests' was not enabled
when this scan was run.

Description
The remote host is missing a list of kill bits for ActiveX controls
that are known to contain vulnerabilities.

If these ActiveX controls are ever installed on the remote host,
either now or in the future, they would expose it to various security
issues.

Solution
Microsoft has released an advisory about this :

http://www.microsoft.com/technet/security/advisory/956391.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Plugin ID: 51164

MS10-092: Vulnerability in Task Scheduler Could Allow Elevation of Privilege (2305420)

Synopsis
A privilege escalation vulnerability exists in Windows Task Scheduler.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Schedsvc.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18551

Description
The remote host is running a version of Windows that contains a flaw
in the task scheduler that may lead to a privilege escalation by
running a specially crafted application.

To exploit this vulnerability, an attacker must have valid logon
credentials and be able to log on locally.

Solution
Microsoft has releaseed a set of patches for Vista, 2008, 7, and 2008
R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-092.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVE
CVE-2010-3338

Bugtraq ID
44357

Other references
OSVDB:68518
MSFT:MS10-092

Plugin ID: 40888

MS09-045: Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961)

Synopsis
Arbitrary code can be executed on the remote host through the web or email client.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\Jscript.dll has not been patched
Remote version : 5.7.0.18000
Should be : 5.7.0.18266

Description
The remote host is running a version of Windows that contains a flaw
in its JScript scripting engine.

An attacker may be able to execute arbitrary code on the remote host
by constructing a malicious JScript and enticing a victim to visit a
web site or view a specially crafted email message.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/Bulletin/MS09-045.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.7(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2009-1920

Bugtraq ID
36224

Other references
OSVDB:57804
CWE:94
MSFT:MS09-045

Plugin ID: 48291

MS10-054: Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214)

Synopsis
It is possible to execute arbitrary code on the remote Windows host due to flaws in its SMB implementation.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\drivers\Srv.sys has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18495

Description
The remote host is affected by several vulnerabilities in the SMB
server that may allow an attacker to execute arbitrary code or perform
a denial of service against the remote host.

Solution
Microsoft has released a set of patches for Windows XP, Vista, 2008,
7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-054.mspx

Risk Factor
Critical/ CVSS Base Score: 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.8(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2010-2550
CVE-2010-2551
CVE-2010-2552

Bugtraq ID
42224
42263
42267

Other references
OSVDB:66974
OSVDB:66975
OSVDB:66976
EDB-ID:14607
MSFT:MS10-054

Plugin ID: 45507

MS10-020: Vulnerabilities in SMB Client Could Allow Remote Code Execution (980232)

Synopsis
Arbitrary code can be executed on the remote host through the installed SMB client.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\System32\drivers\Mrxsmb.sys has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18431

Description
The version of the SMB client software installed on the remote
Windows host may be affected by one or more vulnerabilities,
including some that could allow arbitrary code execution :

- Incorrect handling of incomplete SMB responses could
be abused to cause the system to stop responding.
(CVE-2009-3676)

- A vulnerability in the way the SMB client allocates
memory when parsing specially crafted SMB responses
could be abused by an unauthenticated remote attacker
to execute arbitrary code with system-level privileges.
(CVE-2010-0269)

- Improper validation of fields in SMB responses could
lead to a memory corruption issue and in turn to
arbitrary code execution with system-level privileges.
(CVE-2010-0270)

- Improper parsing of SMB transaction responses could
lead to a memory corruption issue resulting in code
execution with system-level privileges. (CVE-2010-0476)

- Improper handling of SMB responses could cause the SMB
client to consume the entire response and indicate an
invalid value to the Winsock kernel, which in turn
could allow remote code execution and result in the
compromise of the affected system. (CVE-2010-0477)

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista, 2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms10-020.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)

CVE
CVE-2009-3676
CVE-2010-0269
CVE-2010-0270
CVE-2010-0476
CVE-2010-0477

Bugtraq ID
36989
39312
39336
39339
39340

Other references
OSVDB:59957
OSVDB:64925
OSVDB:64926
OSVDB:64927
OSVDB:64928
MSFT:MS10-020

Plugin ID: 49219

MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290)

Synopsis
Arbitrary code can be executed on the remote host due to a flaw in the Spooler service.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Spoolsv.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18511

Description
The version of the Print Spooler service on the remote Windows host
is affected by the following vulnerability :

- A service impersonation vulnerability could allow a
remote, unauthenticated attacker to execute arbitrary
code on a Windows XP system to escalate privileges on
all other supported Windows systems. (CVE-2010-2729)

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2:

http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2010-2729

Bugtraq ID
43073

Other references
OSVDB:67988
MSFT:MS10-061

Plugin ID: 51903

MS11-003: Cumulative Security Update for Internet Explorer (2482017)

Synopsis
Arbitrary code can be executed on the remote host through a web browser.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Mshtml.dll has not been patched
Remote version : 7.0.6001.18000
Should be : 7.0.6001.18565

Description
The remote host is missing Internet Explorer (IE) Security Update
2482017.

The remote version of IE is affected by several vulnerabilities that
may allow an attacker to execute arbitrary code on the remote host.

Solution
Microsoft has released a set of patches for XP, 2003, Vista, 2008, 7,
and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/ms11-003.mspx

See also
http://seclists.org/fulldisclosure/2010/Dec/110
http://www.breakingpointsystems.com/community/blog/ie-vulnerability/

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVE
CVE-2010-3971
CVE-2011-0035
CVE-2011-0036
CVE-2011-0038

Bugtraq ID
45246
46157
46158
46159

Other references
OSVDB:69796
OSVDB:70831
OSVDB:70832
OSVDB:70833
CERT:634956
EDB-ID:15708
EDB-ID:15746
MSFT:MS11-003
Secunia:42510

Plugin ID: 20811

Microsoft Windows Installed Software Enumeration (credentialed check)

Synopsis
It is possible to enumerate installed software.

List of Hosts

192.168.1.180

Plugin Output

The following software are installed on the remote host :

Splunk [version 107.2.25896]

Description
This plugin lists software potentially installed on the remote host by
crawling the registry entries in :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Note that these entries do not necessarily mean the applications are
actually installed on the remote host - they may have been left behind
by uninstallers, or the associated files may have been manually
removed.

Solution
Remove any applications that are not compliant with your organization's
acceptable use and security policies.

Risk Factor
None

Plugin ID: 31798

MS08-025: Vulnerability in Windows Kernel Could Allow Elevation of Privilege (941693)

Synopsis
A local user can elevate his privileges on the remote host.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Win32k.sys has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18027

Description
The remote host contains a version of the Windows kernel which is vulnerable
to a security flaw which may allow a local user to elevate his privileges
or to crash it (therefore causing a denial of service).

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003, Vista, 2008:

http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.0(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2008-1084

Bugtraq ID
28554

Other references
OSVDB:44206
CWE:94
MSFT:MS08-025

Plugin ID: 34406

MS08-061: Microsoft Windows Kernel Multiple Privilege Elevation (954211)

Synopsis
A local user can elevate his privileges on the remote host.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Win32k.sys has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18141

Description
The remote host contains a version of the Windows kernel which is vulnerable
to a security flaw which may allow a local user to elevate his privileges
or to crash it (therefore causing a denial of service).

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003, Vista, 2008:

http://www.microsoft.com/technet/security/bulletin/ms08-061.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 5.3(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2008-2250
CVE-2008-2251
CVE-2008-2252

Bugtraq ID
31651
31652
31653

Other references
OSVDB:49054
OSVDB:49055
OSVDB:49056
CWE:264
MSFT:MS08-061

Plugin ID: 48284

MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852)

Synopsis
The Windows kernel is affected by several vulnerabilities that could allow escalation of privileges.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Ntoskrnl.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18488

Description
The remote Windows host is running a version of the Windows kernel
that is affected by one or more of the following vulnerabilities :

- A race condition when creating certain types of kernel
threads may allow a local attacker to execute arbitrary
code in kernel mode and take complete control of the
affected system. (CVE-2010-1888)

- A double free vulnerability when the kernel initializes
objects while handling certain errors may allow a local
attacker to execute arbitrary code in kernel mode and
take complete control of the affected system.
(CVE-2010-1889)

- A failure to properly validate access control lists on
kernel objects may allow a local attacker to cause the
system to become unresponsive and automatically
restart. (CVE-2010-1890)

Solution
Microsoft has released a set of patches for Windows XP, Vista, 2008,
7, and 2008 R2 :

http://www.microsoft.com/technet/security/bulletin/MS10-047.mspx

Risk Factor
High/ CVSS Base Score: 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.0(CVSS2#E:F/RL:OF/RC:C)

CVE
CVE-2010-1888
CVE-2010-1889
CVE-2010-1890

Bugtraq ID
42211
42213
42221

Other references
OSVDB:66988
OSVDB:66989
OSVDB:66990
MSFT:MS10-047

Plugin ID: 35070

MS08-071: Vulnerabilities in GDI+ Could Allow Remote Code Execution (956802)

Synopsis
Arbitrary code can be executed on the remote host through the Microsoft GDI rendering engine.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Gdi32.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18159

Description
The remote host is running a version of Windows that is affected by
multiple buffer oveflow vulnerabilities when viewing WMF files, which
may allow an attacker to execute arbitrary code on the remote host.

To exploit this flaw, an attacker would need to send a malformed WMF
file to a user on the remote host and wait for him to open it using an
affected Microsoft application.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008 :

http://www.microsoft.com/technet/security/bulletin/ms08-071.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 6.9(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2008-2249
CVE-2008-3465

Bugtraq ID
32634
32637

Other references
OSVDB:50561
OSVDB:50562
CWE:119
MSFT:MS08-071

Plugin ID: 35074

MS08-075: Vulnerabilities in Windows Search Could Allow Remote Code Execution (959349)

Synopsis
Vulnerabilities in the Windows Shell may allow an attacker to execute privileged commands on the remote host.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\Explorer.exe has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18164

Description
The remote version of Windows contains a version of the Windows Shell
which contains a vulnerability in the way it handles saved seaches..

An attacker might use this flaw to trick an administrator to execute a saved
search and therefore execute arbitrary commands on his behalf.

Solution
Microsoft has released a set of patches for Windows Vista and 2008 :

http://www.microsoft.com/technet/security/bulletin/ms08-075.mspx

Risk Factor
Medium/ CVSS Base Score: 6.2
(CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 4.6(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2008-4268
CVE-2008-4269

Bugtraq ID
32651
32652

Other references
OSVDB:50565
OSVDB:50566
CWE:399
MSFT:MS08-075

Plugin ID: 49962

MS10-085: Vulnerability in SChannel Could Allow Denial of Service (2207566)

Synopsis
The remote Windows host has a denial of service vulnerability.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Schannel.dll has not been patched
Remote version : 6.0.6001.18000
Should be : 6.0.6001.18507

Description
The remote Windows host is running a version of the Secure Channel
(SChannel) security package that is affected by a denial of service
vulnerability. This flaw exists in the way that SChannel processes
client certificates.

A remote attacker could send a specially crafted network packet to the
host that would cause the LSASS service to stop responding and the
system to restart.

Solution
Microsoft has released a set of patches for Windows XP, 2003, Vista,
2008, 7, and 2008 R2 :

http://www.microsoft.com/technet/security/Bulletin/MS10-085.mspx

Risk Factor
High/ CVSS Base Score: 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score: 5.8(CVSS2#E:U/RL:OF/RC:C)

CVE
CVE-2010-3229

Bugtraq ID
43780

Other references
OSVDB:68560
MSFT:MS10-085

Plugin ID: 34744

MS08-069: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (955218)

Synopsis
Arbitrary code can be executed on the remote host through the web or email client.

List of Hosts

192.168.1.180

Plugin Output

- C:\Windows\system32\Msxml3.dll has not been patched
Remote version : 8.100.1043.0
Should be : 8.100.1048.0

Description
The remote host is running a version of Windows which contains a flaw
in the Windows XML Core Services..

An attacker may be able to execute arbitrary code on the remote host
by constructing a malicious script and enticing a victim to visit a
web site or view a specially-crafted email message.

Solution
Microsoft has released a set of patches for Windows 2000, XP, 2003,
Vista and 2008:

http://www.microsoft.com/technet/security/Bulletin/MS08-069.mspx

Risk Factor
High/ CVSS Base Score: 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score: 7.3(CVSS2#E:POC/RL:OF/RC:C)