Re: False plugin id 11475

On 11/20/07 18:39, Johannes.Badenhorst@atcoelectric.com wrote:

> We have been using Nessus 3/XP on a monthly basis to scan for 
> vulnerabilities after patch releases. This month for some reason my 
> report shows the following hole. This does not make sense since we have 
> not done anything to the server. Can someone please explain what this 
> means? 

The plugin first verified the host was reachable, sent a packet with a 
null-length for IP option 0xE4, and verified the host could no longer be 
reached.

>             It was possible to crash the remote host by sending a 
> specially crafted IP packet with a null length for IP option #0xE4.
>
>             CVE: CVE-2005-2577
>
>             BID: 7175, 14536
>
>             Plugin ID: 11475
>
>  
>
> My searches shows a Wyse Winterm client to be the culprit. 

For what it's worth, the issue was originally reported as affecting 3Com 
SuperStack II RAS 1500 routers (BID 7175).

> Any ideas

Do you have one of those routers in front of the target? Was there a 
loss in connectivity affecting either the Nessus server or the target 
while the scan was running? Did someone shut down the target? Is the 
result repeatable? ...


George
-- 
theall@tenablesecurity.com
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus