salut à tous voilà j'ai un serveur Linux au boulot sur lequel je gère mon DNS, mes mails avec sendmail et il y a apache 2.0 avec PHP et MYSQL
Ce serveur est en publique sur le Net alors j'ai posé une firewall sous Iptables qui devais me protéger des intrusions
Pour être sur de mon serveur j'ai lancé un Nessus desus et voilà ce que j'obtiens
est que quelqu'un pourrait m'aider à régler ces problèmes car je ne comprends rien à NESSUS
je suis sous RedHat 8.0
Nessus Scan Report
------------------
SUMMARY
- Number of hosts which were alive during the test : 1
- Number of security holes found : 1
- Number of security warnings found : 2
- Number of security notes found : 4
TESTED HOSTS
81.xx.xx.xx (Security holes found)
DETAILS
+ 81.xx.xx.xx :
. List of open ports :
o general/tcp (Security warnings found)
o domain (53/udp) (Security warnings found)
o general/udp (Security notes found)
o domain (53/tcp) (Security hole found)
. Warning found on port general/tcp
The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host.
An attacker may use this feature to determine if the remote
host sent a packet in reply to another request. This may be
used for portscanning and other things.
Solution : Contact your vendor for a patch
Risk factor :
Low
. Information found on port general/tcp
HTTP NIDS evasion functions are enabled.
You may get some false negative
results
. Warning found on port domain (53/udp)
The remote name server allows recursive queries to be performed
by the host running nessusd.
If this is your internal nameserver, then forget this warning.
If you are probing a remote nameserver, then it allows anyone
to use it to resolve third parties names (such as www.nessus.org).
This allows hackers to do cache poisoning attacks against this
nameserver.
See also : http://www.cert.org/advisories/CA-1997-22.html
Solution : Restrict recursive queries to the hosts that should
use this nameserver (such as those of the LAN connected to it).
If you are using bind 8, you can do this by using the instruction
'allow-recursion' in the 'options' section of your named.conf
If you are using another name server, consult its documentation.
Risk factor : Serious
CVE : CVE-1999-0024
. Information found on port domain (53/udp)
The remote bind version is :
9.2.1
. Information found on port domain (53/udp)
A DNS server is running on this port. If you
do not use it, disable it.
Risk factor :
Low
. Information found on port general/udp
For your information, here is the traceroute to
81.xx.xx.xx :
192.100.120.3
81.1xx.xx.xx
192.xx.xx.xx
199.xxx.xx.xx
194.xx.xxx.xx
?
. Vulnerability found on port domain (53/tcp) :
The remote BIND 9 server, according to its
version number, is vulnerable to a buffer
overflow which may allow an attacker to
gain a shell on this host or to disable
this server.
Solution : upgrade to bind 9.2.2 or downgrade to the 8.x series
See also : http://www.isc.org/products/BIND/bind9.html
Risk factor :
High
------------------------------------------------------
This file was generated by the Nessus Security Scanner
