Re: 3com switches false positives

On Thu, 23 Jun 2005, Michel Arboi wrote:

> On Thu Jun 23 2005 at 23:19, Jordan Wiens wrote:
>
> > We've been experiencing a large number of false positives for ID 11412
> > on 3com switches that's got me confused.  As far as I can tell, the
> > following nasl could should skip any non-IIS servers:
>
> > -----snip from iis_webdav_overflow.nasl------
> > port = get_http_port(default:80);
> >
> > sig = get_kb_item("www/hmap/" + port + "/description");
> > if ( sig && "IIS" >!< sig ) exit(0);
> > -----snip from iis_webdav_overflow.nasl------
>
> HMAP is an experimental script. Enable "experimental scripts" in
> "global settings" and Nessus will fingerprint your web servers.

Ok, I had dependancies enabled, but not the experimental scripts.  That 
would do it, thanks.  Any major drawbacks to HMAP or the experimental 
option I should be aware of?

Also, has anybody else seen the problem with the 3com switches generating 
false positives for IIS signatures when not running HMAP?  It might be 
nice to adjust the signatures if the cause could be found.  If I can get 
one in the lab to experiment with and find a better solution, I'll report 
back my findings.

Thanks for the help.

--
Jordan Wiens, CISSP
UF Network Security Engineer
(352)392-2061


_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus