1

The IT Manager (my boss) has been running a vulnerabilities scan on a network of servers we have. The report has come back with some interesting vulnerabilities. The one I can't seem to find a lot on is "iSCSI Unauthenticated Target Detection".

What is this vulnerability? How can I fix it?

Improve this question
4
  • securiteam.com/windowsntfocus/6P01200EAK.html
    – RoraΖ
    Commented Feb 19, 2016 at 14:52
  • Hi, May I know how you solve "iSCSI Unauthenticated Target Detection" ? I got it too.
    – Sake
    Commented Apr 5, 2016 at 11:19
  • Sorry @Sake we have yet to fix this. We are going down the list and just haven't made it to this one yet. When we do I will make sure to post here.
    – Eddie Studer
    Commented Apr 5, 2016 at 13:30
  • Thanks. I'm having this problem withn Netezza server (Redhat based) IBM consultants are taking a look at this also.
    – Sake
    Commented Apr 5, 2016 at 13:38

2 Answers 2

Reset to default
3

Without sounding pretentious or even giving you a dummy answer that sounds too simple, what you need to do to really see the "meat" of the vulnerability, as well as mitigation solutions and other details, is to drill down into the hosts that contain the vulnerability. Click on the vulnerability itself and then on the plugin ID#; this will give you a generalized idea of the vuln. Next, click on an IP address of one of the hosts that is affected and it should tell you last time this vuln was observed, as well as how to mitigate it based on Tenable's recommended actions.

Improve this answer
5
  • Awesome, I didn't know, until now, you could even click on those numbers in the report. We weren't given much info other than the report in the email from above I will check that out
    – Eddie Studer
    Commented Feb 19, 2016 at 16:19
  • Within the Nessus console is where you'll want to click on the numbers and hostnames. I don't know that they make an exportable report that has actionable items in it. I should have mentioned that as I assumed you had access to the Nessus console. If you don't, you can still have someone who does have access get the information I mentioned and export that to you as well. Let me know if you need further help.
    – Brad Bouchard
    Commented Feb 19, 2016 at 16:31
  • I don't have access at this time but other than the IT Manager I am the most knowledgeable when it come to IT Security in our unit. Its only a matter of time before I do get access. The report seems to have hyperlinks associated to all the ID Numbers.
    – Eddie Studer
    Commented Feb 19, 2016 at 16:40
  • Ah, very good, someone included the links then. That should get you what you need, and at worst you could look over your manager's shoulder to see the info.
    – Brad Bouchard
    Commented Feb 19, 2016 at 16:51
  • Glad I could help.
    – Brad Bouchard
    Commented Feb 22, 2016 at 19:16
2

Let's examine this vulnerability from both "definition" and "impact" sides.

Definition iSCSI is a protocol (i.e., a way to interface / talk with) associated with SAN disks that are part of a Storage Area Network. What it means is, you can interact with the SAN disks using tools that implement this protocol (e.g., iscsiadm can be used to talk to a SAN disk).

Impact What this vulnerability says is this - SAN disks in this network are accessible and they won't even ask you the password! Feel free to browse through what we have kept in our huge storage network (for which we paid, and are continuing to pay, a big sum because the data is important to us)!

This article demonstrates how penetrations testers became domain admin through this vulnerability.

This paper, presented in BlackHat, provides further information about various weaknesses in iSCSI.

Hope it helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .