WyWallet: Reverse engineering och säkerhet

SL Self-Signed Certificate

Description
The X.509 certificate chain for this service is not signed by a recognized certificate authority. If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. 

Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.
Solution
Purchase or generate a proper certificate for this service.
Plugin Information
Plugin Type:  remote
Plugin Publication Date: 2012/01/17
Plugin Last Modification Date: 2012/10/25
Risk Information
Risk Factor: Medium
CVSS Base Score: 6.4
CVSS Vector Score: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
Plugin Output
amss.accumulate.se 1
443 / tcp Service: www
The following certificate was found at the top of the certificate
chain sent by the remote host, but is self-signed and was not
found in the list of known certificate authorities :

|-Subject : C=SE/ST=Sweden/L=Stockholm/O=Accumulate AB/OU=AMSS/CN=AMSS CA/E=amss@accumulate.se

-------------snip-------------

TLS CRIME Vulnerability

Synopsis
The remote service has a configuration that may make it vulnerable to the CRIME attack.

Description
The remote service has one of two configurations that are known to be required for the CRIME attack:

- SSL / TLS compression is enabled.

- TLS advertises the SPDY protocol earlier than version 4.

Note that Nessus did not attempt to launch the CRIME attack against the remote service.
Solution
Disable compression and / or the SPDY service.
See Also
http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
http://www.nessus.org/u?a1e45597
https://discussions.nessus.org/thread/5546
http://www.nessus.org/u?e8c92220
https://issues.apache.org/bugzilla/show_bug.cgi?id=53219
Plugin Information
Plugin Type:  remote
Plugin Publication Date: 2012/10/16
Plugin Last Modification Date: 2013/01/09
Risk Information
Risk Factor: Medium
CVSS Base Score: 4.3
CVSS Vector Score: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS Temporal Score: 3.6
Vulnerability Information
Exploit Available: true
Exploitability Ease: Exploits are available
Vulnerability Publication Date: 2012/09/15
Reference Information
cve:CVE-2012-4930CVE-2012-4929
osvdb:8592785926
bid:5570755704
Plugin Output
amss.accumulate.se 1
443 / tcp Service: www
The following configuration indicates that the remote service
may be vulnerable to the CRIME attack :

  - SSL / TLS compression is enabled.

-------------------snip-------------------------

Apache HTTP Server httpOnly Cookie Information Disclosure

Synopsis
The web server running on the remote host has an information disclosure vulnerability.

Description
The version of Apache HTTP Server running on the remote host has an information disclosure vulnerability. Sending a request with HTTP headers long enough to exceed the server limit causes the web server to respond with an HTTP 400. By default, the offending HTTP header and value are displayed on the 400 error page. When used in conjunction with other attacks (e.g., cross-site scripting), this could result in the compromise of httpOnly cookies.
Solution
Upgrade to Apache version 2.2.22 or later.
See Also
http://fd.the-wildcat.de/apache_e36a9cf46c.php
http://httpd.apache.org/security/vulnerabilities_22.html
http://svn.apache.org/viewvc?view=revision&revision=1235454
Plugin Information
Plugin Type:  remote
Plugin Publication Date: 2012/02/02
Plugin Last Modification Date: 2012/05/22
Risk Information
Risk Factor: Medium
CVSS Base Score: 4.3
CVSS Vector Score: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS Temporal Score: 3.6
STIG Severity: I
Vulnerability Information
CPE: cpe:/a:apache:http_server
Exploit Available: true
Exploitability Ease: Exploits are available
Patch Publication Date: 2012/01/31
Vulnerability Publication Date: 2012/01/23

Apache HTTP Server Byte Range DoS

Synopsis
The web server running on the remote host is affected by a denial of service vulnerability.

Description
The version of Apache HTTP Server running on the remote host is affected by a denial of service vulnerability. Making a series of HTTP requests with overlapping ranges in the Range or Request-Range request headers can result in memory and CPU exhaustion. A remote, unauthenticated attacker could exploit this to make the system unresponsive.

Exploit code is publicly available and attacks have reportedly been observed in the wild.
Solution
Upgrade to Apache httpd 2.2.21 or later, or use one of the workarounds in Apache's advisories for CVE-2011-3192. Version 2.2.20 fixed the issue, but also introduced a regression.

If the host is running a web server based on Apache httpd, contact the vendor for a fix.
See Also
http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0203.html
http://www.gossamer-threads.com/lists/apache/dev/401638
http://www.nessus.org/u?404627ec
http://httpd.apache.org/security/CVE-2011-3192.txt
http://www.nessus.org/u?1538124a
http://www-01.ibm.com/support/docview.wss?uid=swg24030863
Plugin Information
Plugin Type:  remote
Plugin Publication Date: 2011/08/25
Plugin Last Modification Date: 2012/10/16
Risk Information
Risk Factor: High
CVSS Base Score: 7.8
CVSS Vector Score: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS Temporal Score: 6.4
Vulnerability Information
CPE: cpe:/a:apache:http_server
Exploit Available: true
Exploitability Ease: Exploits are available
Patch Publication Date: 2011/08/25
Vulnerability Publication Date: 2011/08/19
Exploitable With: 
Metasploit (Apache Range header DoS (Apache Killer))
Core Impact
Reference Information
cve:CVE-2011-3192
osvdb:74721
bid:49303
cert:405811
edb-id:1822117696
Plugin Output
82.99.63.56 1
443 / tcp Service: www
Nessus determined the server is unpatched and is not using any
of the suggested workarounds by making the following requests :

-------------------- Testing for workarounds --------------------
HEAD / HTTP/1.1
Host: 82.99.63.56
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Request-Range: bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10
Range: bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

HTTP/1.1 206 Partial Content
Date: Sun, 03 Feb 2013 22:27:48 GMT
Server: Apache/2.2.16 (Debian) mod_jk/1.2.26 mod_ssl/2.2.16 OpenSSL/0.9.8o
Last-Modified: Wed, 15 Oct 2008 12:48:11 GMT
Accept-Ranges: bytes
Content-Length: 1037
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: multipart/x-byteranges; boundary=4d4d97c8573c677b0
-------------------- Testing for workarounds --------------------

-------------------- Testing for patch --------------------
HEAD / HTTP/1.1
Host: 82.99.63.56
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Request-Range: bytes=0-,1-
Range: bytes=0-,1-
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

HTTP/1.1 206 Partial Content
Date: Sun, 03 Feb 2013 22:27:54 GMT
Server: Apache/2.2.16 (Debian) mod_jk/1.2.26 mod_ssl/2.2.16 OpenSSL/0.9.8o
Last-Modified: Wed, 15 Oct 2008 12:48:11 GMT
Accept-Ranges: bytes
Content-Length: 1590
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: multipart/x-byteranges; boundary=4d4d97ce0c2ca77b0
-------------------- Testing for patch --------------------