Penetration Testing mailing list archives
Re: vulnerability scanners not effective? or just a false-positive?
From: "Kyle Maxwell" <krmaxwell () gmail com>
Date: Thu, 30 Mar 2006 09:31:27 -0600
On 3/29/06, Joel Jose <joeljose420 () bonbon net> wrote:
But i think it is a very "huge" vulnerability. and nessus didnt even give a hinch!!
Well, Nessus is primarily focused on operating system vulnerabilities and problems with common services. I'm not sure how you're "accessing" the directories -- if it's via Windows sharing, you have multiple problems here that should be addressed immediately. If it's via some web application, then it's not surprising Nessus didn't pick it up, though you still have things the client should fix.
and one more quest. How many of you think that the existance of the default banners in services(eg apache default error pages) are a security threat, if not high, atleast medium?. I do.
First of all, such existence is a *vulnerability*, not a *threat*. Lots of people frequently misuse these terms and we should be clear in our terminology. Second, the proper way to do this is to define criteria for each severity level. For example you might say that "high" vulnerabilities allow code execution or access to restricted data, "medium" vulnerabilities violate best practices but don't necessarily allow code execution or data loss, and "low" vulnerabilities provide configuration information that shouldn't be disclosed but isn't a protected secret like a password. Those criteria should typically be more specific and take into account the overall risk environment of the client organization (industry, company policy, etc.) But in the general sense... I never classify default banners as a high vulnerability as it seems kind of "Chicken Little" to me. I recommend they be turned off (or changed to something else if the client is a little twisted) but it would be incorrect to give your client a false impression of the risk stemming from that decision. -- Kyle Maxwell http://caffeinatedsecurity.com [krmaxwell () gmail com] ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/forms/ec.php?pubid=10025 And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com ------------------------------------------------------------------------------
Current thread:
- vulnerability scanners not effective? or just a false-positive? Joel Jose (Mar 29)
- Re: vulnerability scanners not effective? or just a false-positive? James Davis (Mar 30)
- Re: vulnerability scanners not effective? or just a false-positive? Pete Herzog (Mar 30)
- Re: vulnerability scanners not effective? or just a false-positive? Kyle Maxwell (Mar 30)
- <Possible follow-ups>
- RE: vulnerability scanners not effective? or just a false-positive? David Ball (Mar 29)
- RE: vulnerability scanners not effective? or just a false-positive? Craig Wright (Mar 31)
- Re: vulnerability scanners not effective? or just a false-positive? Pete Herzog (Mar 31)
- Re: vulnerability scanners not effective? or just a false-positive? Joel Jose (Mar 31)