Joomla Security Fix to make McAfee compliant my Virtuemart

Public Clarification Board

Sharing of contact details is prohibited by the Terms of Service.

Post Message

• 

  songbird68

  Name Veritas Netbackup Agent Arbitrary Code Execution
  
  Description
  The remote host appears to be running the Veritas NetBackup Java Console service.
  
  This service is used by the NetBackup Java Console GUI to manage the backup server. A user, authorized to connect to this service, can use it as a remote shell with system privileges by sending 'command_EXEC_LIST' messages.
  
  
  General Solution
  Restrict access to the NetBackup service.
  
  
  
  Name Ssl Version 2 (v2) Protocol Detection
  
  Description
  The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients.
  
  
  General Solution
  Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead.
  
  Name Ssl Weak Cipher Suites Supported
  
  Description
  The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all.
  
  
  General Solution
  Reconfigure the affected application if possible to avoid use of weak ciphers.
  
  
  
  Name Openssh X11 Forwarding Session Hijacking
  
  Description
  According to its banner, the version of SSH installed on the remote host is older than 5.0. Such versions may allow a local user to hijack X11 sessions because it improperly binds TCP ports on the local IPv6 interface if the corresponding ports on the IPv4 interface are in use.
  
  
  General Solution
  Upgrade to OpenSSH version 5.0 or later.
  
  
  
  
  Name SSH Protocol Versions Supported
  
  
  Description
  We were able to determine which versions of the SSH protocol the remote SSH daemon supports.
  
  This gives potential attackers additional information about the system they are attacking.
  
  
  General Solution
  You are advised to check the versions of SSH that are currently being supported by the SSH daemon on your server for the following:
  - the version is not outdated. Cipher versions are outdated for a reason ... cryptographic flaws
  
  - non-compliance with your organizational security policies. Also review your security policies to see if it explicitly states that some versions are not to be used
  
  - it is advisable to look up industry standard best practices and use what the industry uses as a whole. This helps to get support if any problems arise in the future.
  
  Modifying the configuration file (sshd.conf; depends which SSH daemon is used) for the SSH daemon to include those protocols that are secure/supported is always a good idea.

  over 2 years ago

Show more messages