A vulnerability scan was performed by ComplyGuard as part of a PCI compliance check for the web server. This turned up two possible issues in the router or router configuration that I wonder if anyone has come across:
Code: Select all
[color=#0080BF]Possible vulnerability in ntpd
Description : If this vulnerability is present, a remote attacker could
gain root access to an affected system.[http://www.ntp.org/downloads.html] Upgrade to NTP 4.2.4p8 or higher,
or upgrade as designated by Linux vendor.
To find out if your version of ntpd is
vulnerable, enter the command:
ntpq -c version
CVE/CAN
CVE-2001-0414
Solution
[http://www.ntp.org/downloads.html] Upgrade to NTP 4.2.4p8 or higher,or upgrade as designated by Linux vendor.
Exceptions/False Postivies[/color]Is there a way to determine if this NTP vulnerability is actually present or if instead this is a false-positive? If an issue, has it been mitigated in a newer RoS Version?
The 2nd issue is a DoS vulnerability. I don't agree that this would be high in my case. Here is the issue that was reported:
Code: Select all
Synopsis : TCP reset using approximate sequence number
Description : A remote attacker could cause a denial of service on
systems which rely upon persistent TCP connections.To correct this problem on Cisco devices, apply one of the
fixes referenced in the Cisco security advisories for
[http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml] IOS and
[http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-nonios.shtml] non-IOS operating systems.
Refer to [http://www.kb.cert.org/vuls/id/415294#systems] US-CERT Vulnerability Note VU#415294 and
[http://www.uniras.gov.uk/niscc/docs/re-20040420-00391.pdf?lang=en] NISSC vulnerability advisory 236929 for other vendor fixes.
If a fix is not available, this problem can be worked
around by using a secure protocol such as
[http://rfc.net/rfc2411.html] IPsec, or by
filtering incoming connections to services such as BGP
which rely on persistent TCP connections at the firewall,
such that only allowed addresses may reach them.
CVE/CAN
CVE-2004-0230
Solution: To correct this problem on Cisco devices, apply one of thefixes referenced in the Cisco security advisories for[http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml] IOS and[http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-nonios.shtml] non-IOS operating systems.Refer to [http://www.kb.cert.org/vuls/id/415294#systems] US-CERT Vulnerability Note VU#415294 and[http://www.uniras.gov.uk/niscc/docs/re-20040420-00391.pdf?lang=en] NISSC vulnerability advisory 236929 for other vendor fixes. Any input would be greatly appreciated!
Marc