Re: Question on a Plugin

On Wed, Jan 25, 2006 at 01:00:37PM -0500, Bilal Nasrallah wrote:

> I ran a nessus scan against one of our devices and it flagged a
> vulnerability in the telnet daemon. According to the report, the plugin
> that detected the vulnerability is pam_smb/pam_ntdom overflow under
> "Gain root remotely" family. Is there a way to find out what are the
> details of this test, this would help us to determine if this is a false
> positive or not.

The lion's share of Nessus plugins are coded using NASL, which is an
interpreted language, which in turn means that you can see how the
plugin works by reading the source code.

In this case, it sounds like the report is from plugin #10517,
pam_smb.nasl. The plugin's description, and indeed the report itself,
says that the telnet daemon closed the connection abruptly when given a
long username followed by a password and that this may be a false
positive. Have you looked at the logs on the affected system to see why
the connection closed? Did the daemon crash? Is pam_smb or pam_ntdom
even in use there?

George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus