RE: Command Line RPC vulnerability scanner?

From: Russell Fulton (r.fulton_at_auckland.ac.nz)
Date: 07/31/03

  • Next message: Rodrigo Barbosa: "Re: Scan of TCP 552-554" 
    To: "Schmehl, Paul L" <pauls@utdallas.edu>
Date: 01 Aug 2003 08:26:14 +1200

    On Fri, 2003-08-01 at 03:30, Schmehl, Paul L wrote:
    > I have both eEye's tool and ISS's tool. I decided to run the ISS
    > commandline scanner on our entire class B last night. That way I could
    > come in this morning and have a complete report of patch compliance. Or
    > so I thought. When I got in to my office this morning, the ISS tool had
    > been running for 15 hours and had reported on a total of 99 hosts.

    I ran it on our class B a couple of days ago and after about 5 hours it
    stopped scanning after finding 7500 hosts listening on port 135. The
    process did not terminate it just hung with no more output being written
    to stdout. The output file had a truncated line at the end suggesting
    that the buffer had not been fully written.

    The number of host is close to what I would expect so I'm going to try
    again today.

    Another feature of this scanner is that it scans in random order so if
    anything goes wrong you can't simply restart from where you left off :(
    I don't know why ISS decided to do this rather than a simple sequential
    scan.

    As others have mentioned the scanner does two tests and returns one of 4
    results for each: [VULN], [ptch], [....] and [ ? ? ].

    THe meaning of the first two are obvious but the others are not
    specified and I would like to have more information of exactly what they
    mean. Anyone worked it out?

    We have found some systems that are proving very difficult to patch - we
    can't get them to the requisite SP levels because of lack of disk space
    or other issues. Does anyone know of safe workarounds for such systems?
      

    -- 
Russell Fulton, Network Security Officer, The University of Auckland,
New Zealand.
---------------------------------------------------------------------------
----------------------------------------------------------------------------
  • Next message: Rodrigo Barbosa: "Re: Scan of TCP 552-554"

    Relevant Pages

    • RE: MBSA scanner
      ... We have also moved our allegience to eEye Retina from ISS. ... well and is the best commercial scanner we've used. ... >We've moved all our business from ISS Scanner to Retina. ...
      (Pen-Test)
    • Re: ISS et al
      ... design my own scanner for NT systems. ... Another "cost" could have ... just stopped using ISS. ... If you're running it as a security admin, ...
      (Security-Basics)
    • ISS Contact Weds 9 Nov 17:47Z
      ... Take your HT or scanner out into the garden to listen to an ISS contact ... 73, Howard G6LVB ... Prev by Date: ...
      (uk.radio.amateur)