It was possible to log into the
remote host using the following
login/password
combinations
:
'administrator'/''
'administrator'/'administrator'
'guest'/''
'guest'/'guest'
It
was possible to log into the remote host using a NULL
session.
The concept of a NULL session is to provide
a null username and
a null password, which grants the
user the 'guest' access
To prevent null sessions,
see MS KB Article Q143474 (NT 4.0) and
Q246261
(Windows 2000).
Note that this won't completely
disable null sessions, but will
prevent them from
connecting to IPC$
Please see
http://msgs.securepoint.com/cgi-bin/get/nessus-0204/50/1.htmlThe
remote host defaults to guest when a user logs in using
an invalid
login. For instance, we could log in using
the account 'nessus/nessus'
All the smb tests
will be done as 'administrator'/'' in domain
WORKGROUP
CVE : *******
BID :
494, 990
Plugin ID :
10394