preview

Nt1330 Unit 5 Lab 1 Case Analysis

Decent Essays

1. Lab#5
The periodic assessment of risk to agency operations or assets resulting from the operation of an information system is an important activity. It summarizes the risks associated with the vulnerabilities identified during the vulnerability scan. Impact refers to the magnitude of potential harm that may be caused by successful exploitation. It is determined by the value of the resource at risk, both in terms of its inherent (replacement) value, its importance (criticality) to business missions, and the sensitivity of data contained within the system. The results of the system security categorization estimations for each system, is used as an aid to determining individual impact estimations for each finding. The level of impact is rated …show more content…

ICMP Timestamp Request Remote Date Disclosure has risk factor none. Solution is to filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14). For host 172.17.20.1 number of Open ports found are 5, high is 1, no medium and 8 low vulnerabilities were found. ICMP Timestamp Request Remote Date Disclosure data is same. An NTP server is listening on the remote host. It provides information about the current date and time of the remote system and may provide system information and has no risk factor. A telnet server is running on this port. The remote host is running a Telnet server over an unencrypted channel. Using Telnet over an unencrypted channel is not recommended as logins, passwords and commands are transferred in clear text. An attacker may eavesdrop on a Telnet session and obtain credentials or other sensitive information. Use of SSH is preferred nowadays as it protects credentials from eavesdropping and can tunnel additional data streams such as the X11 …show more content…

Name of Operating System is Microsoft Windows Server 2003 Service Pack 1. MS08-067: Microsoft Windows Server Service Crafted RPC Request Handling Remote Code Execution (958644) (uncredentialed check) i.e. the remote host is vulnerable to a buffer overrun in the 'Server' service that may allow an attacker to execute arbitrary code on the remote host with the 'System' privileges and risk factor is critical. The remote host implements TCP timestamps, as defined by RFC1323. A side effect of this feature is that the uptime of the remote host can sometimes be computed. The remote host seems to be a VMware virtual machine. The manufacturer can be deduced from the Ethernet OUI. It is possible to enumerate CPE names that matched on the remote system having risk factor none. A DCE/RPC service is running on the remote host with risk factor none. An ncacn http server is running on this port and a COM+ Internet Services (CIS) server is listening on this port. COM+ Internet Services are RPC over HTTP tunneling and require IIS to operate. CIS ports shouldn't be visible on internet but only behind a firewall. Also a DCE/RPC service is running on the remote host. It is also possible to obtain the network name of the remote host. The remote service understands the CIFS (Common Internet File System) or Server Message Block (SMB) protocol, used to provide shared access to files,

Get Access