Defective plugins 15520 and 11884 + info for 11154

Jesper S. Jensen jsj at uni-c.dk
Tue Jan 18 09:16:39 EST 2005


Nicolas Pouvesle wrote:
>> Plugin 15520 - checks for w32.spybot.fcd worm.
> Can you connect to tcp port 113 (with telnet) and do the following 
> request :
> 
> GET (enter here)
> 
> And give us the answer ?

Sure, already checked that.

telnet 1.2.3.4 113
---
GET
GET : USERID : UNIX : foobar
get
get : USERID : UNIX : foobar
dfh
dfh : USERID : UNIX : foobar

  : USERID : UNIX : foobar
---

As I said, it always answers same, wether I write GET, get, yada yada or 
even just hit return. It's the nullidentd server btw. if it helps.

PS. No that's not my real ip. :-)

>> Plugin 11884 finds that I have a WinSyslog running (on my Debian 
>> Box!). It's just the standard syslogd service "syslogd 1.4.1".
>>
> What is your version of Nessus ? this bug should have been fixed in 
> Nessus 2.1.X and later (even in last 2.0.X).

Oh sorry, that's my fault then. We are still running v2.0.7 because of 
some hacks and stuff. Guess it's time to consider a update.




More information about the Nessus mailing list