From trumpjk at gmail.com Wed May 28 23:41:49 2014 Content-Type: multipart/mixed; boundary="===============7962602918782858998==" MIME-Version: 1.0 From: John Trump To: 389-users at lists.fedoraproject.org Subject: [389-users] Retna Scan Results Date: Wed, 28 May 2014 19:41:06 -0400 Message-ID: --===============7962602918782858998== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I have a system running 389-ds that was scanned using retna. Retna showed vulnerabilities which are fairly old. Can anyone confirm that these were fixed. Only thing using port 9830 is the admin-serv. Below are the rpm versions I have installed and the CVE's retna supposidly detected. 389-adminutil-1.1.19-1.el6.x86_64 389-ds-console-doc-1.2.6-1.el6.noarch 389-admin-1.1.35-1.el6.x86_64 389-admin-console-1.1.8-5.fc19.noarch 389-console-1.1.7-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-libs-1.2.11.25-1.el6.x86_64 389-ds-base-1.2.11.25-1.el6.x86_64 389-dsgw-1.1.11-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-doc-1.1.8-5.fc19.noarch Audit ID: 6310 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: Medium (Fail) - CVSS Score CVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P] BugTraq ID 27234,26838,27236,27237 CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-64 20,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678 CCE: N/A Exploit: No IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: BR T WB Server: (Apache($[[]^)]*$)?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2])) ?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\..= *)) ($|[[]^0-9.]([[]^(]*$[[]^R][[]^)]*$)*[[]^()]*$)) Found Value: Server: Apache/2.2##Content-Length: 301##Connection: close##Content-Type: text/html; charset[=3D]iso-8859-1######404 Not Found##

Not Found

(truncated...) Audit ID: 6059 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: Medium (Fail) - CVSS Score CVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N] BugTraq ID 24215,24645,25489,24649,24553 CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-57 52,CVE-2007-1863 CCE: N/A Exploit: No IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: RR T WB (Apache($[[]^)]*$)?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*$[[]^R][[]^)]*= $ )*[[]^()]*$)) Found Value: Apache/2.2 Audit ID: 9820 Vul ID: N/A Risk Level: Medium Sev Code: Category II PCI Level: High (Fail) - CVSS Score CVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C] BugTraq ID 35565,35253,35623,35251,34663,35221,35115 CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-00 23,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890 CCE: N/A Exploit: Yes IAV: N/A STIG: Context: TCP:9830 Result: Success Tested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0 -9])(\.[[]0-9]+)*)?($|[[]^0-9.]) Found Value: APACHE/2.2 --===============7962602918782858998== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+SSBoYXZlIGEgc3lzdGVtIHJ1bm5pbmcgMzg5LWRzIHRoYXQgd2FzIHNj YW5uZWQgdXNpbmcgcmV0bmEuIFJldG5hIHNob3dlZCB2dWxuZXJhYmlsaXRpZXMgd2hpY2ggYXJl IGZhaXJseSBvbGQuIENhbiBhbnlvbmUgY29uZmlybSB0aGF0IHRoZXNlIHdlcmUgZml4ZWQuIE9u bHkgdGhpbmcgdXNpbmcgcG9ydCA5ODMwIGlzIHRoZSBhZG1pbi1zZXJ2LiBCZWxvdyBhcmUgdGhl IHJwbSB2ZXJzaW9ucyBJIGhhdmUgaW5zdGFsbGVkIGFuZCB0aGUgQ1ZFJiMzOTtzIHJldG5hIHN1 cHBvc2lkbHkgZGV0ZWN0ZWQuPGRpdj4KCjxicj48L2Rpdj48ZGl2PjxkaXY+Mzg5LWFkbWludXRp bC0xLjEuMTktMS5lbDYueDg2XzY0PC9kaXY+PGRpdj4zODktZHMtY29uc29sZS1kb2MtMS4yLjYt MS5lbDYubm9hcmNoPC9kaXY+PGRpdj4zODktYWRtaW4tMS4xLjM1LTEuZWw2Lng4Nl82NDwvZGl2 PjxkaXY+Mzg5LWFkbWluLWNvbnNvbGUtMS4xLjgtNS5mYzE5Lm5vYXJjaDwvZGl2PjxkaXY+Mzg5 LWNvbnNvbGUtMS4xLjctMS5lbDYubm9hcmNoPC9kaXY+Cgo8ZGl2PjM4OS1kcy0xLjIuMi0xLmVs Ni5ub2FyY2g8L2Rpdj48ZGl2PjM4OS1kcy1iYXNlLWxpYnMtMS4yLjExLjI1LTEuZWw2Lng4Nl82 NDwvZGl2PjxkaXY+Mzg5LWRzLWJhc2UtMS4yLjExLjI1LTEuZWw2Lng4Nl82NDwvZGl2PjxkaXY+ Mzg5LWRzZ3ctMS4xLjExLTEuZWw2Lng4Nl82NDwvZGl2PjxkaXY+Mzg5LWRzLWNvbnNvbGUtMS4y LjYtMS5lbDYubm9hcmNoPC9kaXY+PGRpdj4zODktYWRtaW4tY29uc29sZS1kb2MtMS4xLjgtNS5m YzE5Lm5vYXJjaDwvZGl2PgoKPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5BdWRpdCBJRDo8c3Bh biBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPjYzMTA8c3BhbiBjbGFz cz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlZ1bCBJRDo8c3BhbiBjbGFzcz0i IiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk4vQTxicj48L2Rpdj48ZGl2PjxkaXY+ UmlzayBMZXZlbDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFu Pk1lZGl1bTwvZGl2PgoKPGRpdj5TZXYgQ29kZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUt c3BhY2U6cHJlIj4JPC9zcGFuPkNhdGVnb3J5IElJPC9kaXY+PGRpdj5QQ0kgTGV2ZWw6PHNwYW4g Y2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5NZWRpdW0gKEZhaWwpIC0g Q1ZTUyBTY29yZTwvZGl2PjxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hp dGUtc3BhY2U6cHJlIj4JPC9zcGFuPjUgW0FWOk4vQUM6TC9BdTpOL0M6Ti9JOk4vQTpQXTwvZGl2 PgoKPGRpdj5CdWdUcmFxIElEPHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+ CTwvc3Bhbj4yNzIzNCwyNjgzOCwyNzIzNiwyNzIzNzwvZGl2PjxkaXY+Q1ZFOjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q1ZFLTIwMDgtMDAwNSxDVkUtMjAw Ny02Mzg4LENWRS0yMDA3LTY0MjIsQ1ZFLTIwMDctNjQ8L2Rpdj48ZGl2PjIwLENWRS0yMDA3LTUw MDAsQ1ZFLTIwMDctNjQyMSxDVkUtMjAwOC0xNjc4PC9kaXY+Cgo8ZGl2PkNDRTo8c3BhbiBjbGFz cz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk4vQTwvZGl2PjxkaXY+RXhwbG9p dDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk5vPC9kaXY+ PGRpdj5JQVY6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5O L0E8L2Rpdj48ZGl2PlNUSUc6PC9kaXY+PGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VENQOjk4MzA8L2Rpdj4KCjxkaXY+UmVzdWx0Ojxz cGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+U3VjY2VzczwvZGl2 PjxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+QlIgVCBXQiBTZXJ2ZXI6PC9kaXY+PGRpdj4oQXBhY2hlKFwoW1tdXildKlwpKT8v KCgyXC4oKDIoXC5bW10wLTddKT8pfCgwKFwuKFtbXTEtNV0/W1tdMC05XXw2W1tdMC0yXSkpPC9k aXY+Cgo8ZGl2Pj8pfCgxKFwuLiopPykpKXwoMVwuKCgzKFwuKFtbXTEtM10/W1tdMC05XXw0MCkp Pyl8KFtbXTAtMl0oXC4uKik/KSkpfCgwK1wuLiopKTwvZGl2PjxkaXY+KCR8W1tdXjAtOS5dKFtb XV4oXSpcKFtbXV5SXVtbXV4pXSpcKSkqW1tdXigpXSokKSk8L2Rpdj48ZGl2PkZvdW5kIFZhbHVl OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+U2VydmVyOiBB cGFjaGUvMi4yIyNDb250ZW50LUxlbmd0aDogMzAxIyNDb25uZWN0aW9uOjwvZGl2PgoKPGRpdj5j bG9zZSMjQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7PC9kaXY+PGRpdj5jaGFyc2V0Wz1daXNvLTg4 NTktMSMjIyMmbHQ7IURPQ1RZUEUgSFRNTCBQVUJMSUM8L2Rpdj48ZGl2PiZxdW90Oy0vL0lFVEYv L0RURCBIVE1MIDIuMC8vRU4mcXVvdDsmZ3Q7IyZsdDtodG1sJmd0OyZsdDtoZWFkJmd0OyMmbHQ7 dGl0bGUmZ3Q7NDA0IE5vdDwvZGl2PjxkaXY+Rm91bmQmbHQ7L3RpdGxlJmd0OyMmbHQ7L2hlYWQm Z3Q7Jmx0O2JvZHkmZ3Q7IyZsdDtoMSZndDtOb3QgRm91bmQmbHQ7L2gxJmd0O8KgPC9kaXY+Cgo8 ZGl2Pih0cnVuY2F0ZWQuLi4pPC9kaXY+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48ZGl2PkF1 ZGl0IElEOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+NjA1 OTxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VnVsIElEOjxz cGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+Cgo8 ZGl2PlJpc2sgTGV2ZWw6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwv c3Bhbj5NZWRpdW08L2Rpdj48ZGl2PlNldiBDb2RlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0 ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q2F0ZWdvcnkgSUk8L2Rpdj48ZGl2PlBDSSBMZXZlbDo8c3Bh biBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPk1lZGl1bSAoRmFpbCkg LSBDVlNTIFNjb3JlPC9kaXY+Cgo8ZGl2PkNWU1MgU2NvcmU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9 IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj41IFtBVjpOL0FDOkwvQXU6Ti9DOlAvSTpOL0E6Tl08 L2Rpdj48ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJl Ij4JPC9zcGFuPjI0MjE1LDI0NjQ1LDI1NDg5LDI0NjQ5LDI0NTUzPC9kaXY+PGRpdj5DVkU6PHNw YW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5DVkUtMjAwNy0xODYy LENWRS0yMDA3LTM4NDcsQ1ZFLTIwMDctMzMwNCxDVkUtMjAwNi01NzwvZGl2PgoKPGRpdj41MixD VkUtMjAwNy0xODYzPC9kaXY+PGRpdj5DQ0U6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNw YWNlOnByZSI+CTwvc3Bhbj5OL0E8L2Rpdj48ZGl2PkV4cGxvaXQ6PHNwYW4gY2xhc3M9IiIgc3R5 bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5ObzwvZGl2PjxkaXY+SUFWOjxzcGFuIGNsYXNz PSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+Cgo8ZGl2PlNUSUc6 PC9kaXY+PGRpdj5Db250ZXh0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+VENQOjk4MzA8L2Rpdj48ZGl2PlJlc3VsdDo8c3BhbiBjbGFzcz0iIiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlN1Y2Nlc3M8L2Rpdj48ZGl2PlRlc3RlZCBWYWx1ZTo8 c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPlJSIFQgV0I8L2Rp dj4KCjxkaXY+KEFwYWNoZShcKFtbXV4pXSpcKSk/LygyXC4yKFwuW1tdMC01XSk/KSgkfFtbXV4w LTkuXShbW11eKF0qXChbW11eUl1bW11eKV0qXCk8L2Rpdj48ZGl2PikqW1tdXigpXSokKSk8L2Rp dj48ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUi Pgk8L3NwYW4+QXBhY2hlLzIuMjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+PGRpdj4K CkF1ZGl0IElEOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+ OTgyMDxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+VnVsIElE OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Ti9BPC9kaXY+ PGRpdj5SaXNrIExldmVsOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8 L3NwYW4+TWVkaXVtPC9kaXY+Cgo8ZGl2PlNldiBDb2RlOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+Q2F0ZWdvcnkgSUk8L2Rpdj48ZGl2PlBDSSBMZXZlbDo8 c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPkhpZ2ggKEZhaWwp IC0gQ1ZTUyBTY29yZTwvZGl2PjxkaXY+Q1ZTUyBTY29yZTo8c3BhbiBjbGFzcz0iIiBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlIj4JPC9zcGFuPjcuOCBbQVY6Ti9BQzpML0F1Ok4vQzpOL0k6Ti9BOkNd PC9kaXY+Cgo8ZGl2PkJ1Z1RyYXEgSUQ8c3BhbiBjbGFzcz0iIiBzdHlsZT0id2hpdGUtc3BhY2U6 cHJlIj4JPC9zcGFuPjM1NTY1LDM1MjUzLDM1NjIzLDM1MjUxLDM0NjYzLDM1MjIxLDM1MTE1PC9k aXY+PGRpdj5DVkU6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bh bj5DVkUtMjAwOS0xODkxLENWRS0yMDA5LTE5NTUsQ1ZFLTIwMDktMTE5MSxDVkUtMjAwOS0wMDwv ZGl2PgoKPGRpdj4yMyxDVkUtMjAwOS0xOTU2LENWRS0yMDA5LTExOTUsQ1ZFLTIwMDktMTg5MDwv ZGl2PjxkaXY+Q0NFOjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3Nw YW4+Ti9BPC9kaXY+PGRpdj5FeHBsb2l0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFj ZTpwcmUiPgk8L3NwYW4+WWVzPC9kaXY+PGRpdj5JQVY6PHNwYW4gY2xhc3M9IiIgc3R5bGU9Indo aXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5OL0E8L2Rpdj4KCjxkaXY+U1RJRzo8L2Rpdj48ZGl2PkNv bnRleHQ6PHNwYW4gY2xhc3M9IiIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+CTwvc3Bhbj5UQ1A6 OTgzMDwvZGl2PjxkaXY+UmVzdWx0OjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUiPgk8L3NwYW4+U3VjY2VzczwvZGl2PjxkaXY+VGVzdGVkIFZhbHVlOjxzcGFuIGNsYXNzPSIi IHN0eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+QVBBQ0hFKC1BRFZBTkNFREVYVFJBTkVU U0VSVkVSKT8vMlwuMihcLigxW1tdMDFdfFtbXTA8L2Rpdj4KCjxkaXY+LTldKShcLltbXTAtOV0r KSopPygkfFtbXV4wLTkuXSk8L2Rpdj48ZGl2PkZvdW5kIFZhbHVlOjxzcGFuIGNsYXNzPSIiIHN0 eWxlPSJ3aGl0ZS1zcGFjZTpwcmUiPgk8L3NwYW4+QVBBQ0hFLzIuMjwvZGl2PjwvZGl2PjxkaXY+ PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjwvZGl2Pgo= --===============7962602918782858998==--