0

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, and how do I fix them?

> Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-09-03 12:25 IST

Nmap scan report for *********
Host is up (0.00012s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
25/tcp  open  smtp
443/tcp open  https
902/tcp open  iss-realsecure

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds
4
  • 3
    If nmap output would be enough to say that the system is vulnerable or not, they would've make a switch like nmap --is-vulnerable which would only output yes or no.
    – Cthulhu
    Sep 3, 2015 at 7:17
  • @Cthulhu: There is: --script=vuln Sep 3, 2015 at 8:04
  • hmm, let me run this command :)
    – Dave Mn
    Sep 3, 2015 at 8:21
  • 1
    @Cthulhu host.isVulnerable = host.isUp Sep 3, 2015 at 13:48

2 Answers 2

4

There are some false assumptions here that you need to deal with before you can get any meaningful answer:

  1. "Open ports are vulnerabilities." False. An open port is simply an address. It tells your operating system how to deliver network traffic to a program. The program may have vulnerabilities, but you can't tell that by just looking at its address.

  2. "Scanning localhost shows what ports are open to the network." Nope. Your operating system has multiple IP addresses configured, and localhost refers to a special one that is not accessible from the network. A program can listen on a port that is bound to "any address" (the most common case) or it can choose an address to use. If it uses the localhost address, then it can only be accessed from within that computer. This is commonly done with SMTP and printer-related ports (like 631/tcp).

  3. "Running Nmap will tell me what ports are open." Look at the output: Not shown: 997 closed ports. That means that Nmap only scanned 1000 TCP ports. That's the default, and it will catch the majority of network services, but it's not comprehensive. There are 65535 valid TCP ports, plus UDP and a small number of less-popular transports that use the "port" idea. Unless you suspect you are infected with a rootkit, it is nearly always better to use netstat, ss, or lsof to show listening ports on your own computer. These programs query the operating system directly, finish quickly, and can show all listening services, including information about the process that is using each port. Nmap is most useful for probing computers from the outside and building a complete picture of exposure.

1
  • Thanks! I got following IP when i checked for active connections using netstat (oi59.tinypic.com/2la9d6u.jpg) plz let me know..b/w i scanned my pc via VM kali linux nmap.
    – Dave Mn
    Sep 4, 2015 at 8:09
3

Vulnerability is an intrinsic property of the asset that exposes it to threats. So if you intend to serve SMTP service, the open port 25 is a vulnerability since it exposes your service to external threats targeting this service.

Vulnerability by itself does not constitute a risk. You computer might not be accessible due to a firewall policy, attacker might not have any incentive to attack you etc.

TL;DR: you are vulnerable but might not be at risk.

4
  • Thanks, SMTP is not open at first, but i tried to set up 'psad' firewall n configured it to mail me logs..Then this 'SMTP' is open. Any idea how i can close SMTP? Thanks.. b/w both 443/tcp open https 902/tcp open iss-realsecure is open, this not vulnerable right?
    – Dave Mn
    Sep 3, 2015 at 8:24
  • Knowing if you are at risk is a real job you have to do. It's called a risk analysis. Software and protocols can be exploited etc. I have no basis to say if your system can be compromised or not just based on which ports are open on your system.
    – M'vy
    Sep 3, 2015 at 8:26
  • hmm ic, thanks again, any idea how do i protect? :/ how do i close ports?
    – Dave Mn
    Sep 3, 2015 at 8:30
  • @Dave Mn I do not see a point in closing ports. If ports are actively not required, they should be there at the first place. But if you do use SMTP on 25 and it's absolutely needed - there are filters which can help. A rule based security can provide you a solution, it's not always that you close a port if vulnerabilities are identified and you still need the business coming through from that port or it has an infrastructural requirement on the network premises. Sep 3, 2015 at 8:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .