27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

FTP Client Initiated from an SMTP Server<br />

<strong>PVS</strong> ID: 6246 FAMILY: Backdoors RISK: HIGH NESSUS ID:Not Available<br />

Description: The remote SMTP server has just been observed initiating an FTP outbound session and<br />

retrieving a file. This may be an indicator that the system has been compromised and<br />

attackers are now retrieving files to the local server.<br />

realtimeonly<br />

Solution: Disable the SMTP service if it is not required. Additionally, the observed behavior is<br />

indicative of a system compromise.<br />

CVE Not available<br />

Distributed <strong>Network</strong> Protocol v3 'Disable Unsolicited' Alert (SCADA)<br />

<strong>PVS</strong> ID: 6247 FAMILY: SCADA<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: SCADA Alert - Distributed <strong>Network</strong> Protocol v3 'Disable Unsolicited' alert. The remote<br />

host is running the Distributed <strong>Network</strong> Protocol version 3. This protocol is common on<br />

SCADA networks. <strong>PVS</strong> has just detected a client sending the server a code 15 message.<br />

This message instructs the DNPv3 server to stop sending unsolicited messages.<br />

realtimeonly<br />

Solution: Ensure that the disabling of automated alerts was planned by network administrators.<br />

CVE Not available<br />

Distributed <strong>Network</strong> Protocol v3 'Cold Restart' Alert (SCADA)<br />

<strong>PVS</strong> ID: 6248 FAMILY: SCADA<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: SCADA Alert - Distributed <strong>Network</strong> Protocol v3 'Cold Restart' alert. The remote host is<br />

running the Distributed <strong>Network</strong> Protocol version 3. This protocol is common on SCADA<br />

networks. <strong>PVS</strong> has just detected a client sending the server a code '0D' message. This<br />

message instructs the remote server to do a cold restart. That is, the server will be<br />

unavailable for some time as it restarts and runs all power-up tests.<br />

realtimeonly<br />

Solution: If the PLC server supports it, disable 'Cold Restarts' except from trusted systems.<br />

Otherwise, ensure that SCADA network is only accessible by trusted hosts.<br />

CVE Not available<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Distributed <strong>Network</strong> Protocol v3 'Unauthorized Read Request' Alert (SCADA)<br />

Family Internet Services 1705

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!