[Openvas-plugins] Various plugins SMB issue?

[Carsten Koch-Mauthe]

Hi,

> I've run a scan against a host I had previously tested with a professional
> feed fo Nessus and am seeing some weird plugins fire that were not present
> in the Nessus scan. I appreciate and understand the 2 products may find
> different results but the plugin output was a little weird.
>
> Anyway I get multiple plugins firing returning the error below where
> xxx.xxx.xxx.xxx is the IP:
>
> Error getting SMB-Data -> CONNECTION TO xxx.xxx.xxx.xxx FAILED (ERROR
>  NT_STATUS_CONNECTION_REFUSED)
>
> and
>
> Error getting SMB-Data ->

These messages are only notes that something went wrong when running the 
scripts. For example wrong smb credentials for accessing the host. What is 
the Host OS ?

>
> One ofthe plugins doing this is "Windows Vulnerability In DNS Client Could
> Allow Spoofing (945553)" and another is "Adobe Flash Player 9.0.115.0 And
> Earlier Vulnerability" It seems like when the plugin errors its
> (incorrectly?) saying the host is vulnerable.

The messages should be shown as "Security note" within OpenVAS-Client.This 
will not mean that this host is vulnerable. In this cases it only means  that 
something went wrong running the scripts and give you a hint what happend.

>
> I am using Openvas client 1.0.4, server 1.0.2, libnasl 1.0.1, libraries
> 1.0.2 and plugins 1.0.2 and have done a fresh nvt-sync.
>
> Can anyone suggest why this is happening and how to resolve?

Probably wrong credentials. These scripts need credentials for administrator 
or user with administration rights. 
Firewall active on target host ? 

-- 
Gruss
    Carsten Koch-Mauthe
    
 http://www.dn-systems.de  mail: c.koch-mauthe at dn-systems.de 
 DN-Systems Enterprise Internet Solutions GmbH
 Hornemannstr. 11 31137 Hildesheim, Germany     
 Tel. +49-5121-28989-0 Fax. +49-5121-28989-11 
 21 Sunrise Ct, S.San Francisco, CA 94080, USA
 Tel. +1-650-472-2512  Mob. +1-650-430-1219
 Handelsregister HRB-3213 Amtsgericht Hildesheim
 Geschäftsführer Lukas Grunwald