1

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 vulnerabilities for the web access pages for HP and Cisco switches/routers/iLO interfaces. Some include:

1.3.6.1.4.1.25623.1.0.11715 - Header overflow against HTTP proxy
1.3.6.1.4.1.25623.1.0.17231 - CERN httpd CGI name heap overflow
1.3.6.1.4.1.25623.1.0.11127 - HTTP 1.0 header overflow

The hardware is not out of date, the SSL certs are good. I disable HTTP logins for all devices I can and make sure they are up to date with the latest firmware but these alerts keep coming in for the same devices. I can't find anyone with the same issues online. Are there steps I can take to further secure these or is it safe to just ignore them?

  • Sounds like maybe a question for the manufacturer of the device(s) in question? "Why are my non-EOL fully patched devices triggering the following alerts during my vulnerability scans?" – DarkMatter Dec 5 '18 at 16:33
1

You should check with your vendor. Many Vulnerability scanners just detect a version and then assume the vulnerabilities based on that version of the software. This doesn't allow for back patching and can be an annoyance to Systems teams as far as false positives. Something like this could be happening.

Also, you seem to mention it, but you have disabled TLS 1.0 right? Attackers will try to downgrade connections and see if the server allows out of date ones, which they often do as a default, like AWS's load balancer for example (at last check).

I would never ignore a finding, if possible. Escalate to the vendor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.