`

Sample Vulnerability
Assessment Report -
Example Institute

Prepared By

[email protected]
Table of Contents
1. Executive Summary ............................................................................................................................. 2
2. Scan Results......................................................................................................................................... 2
3. Methodology ....................................................................................................................................... 3
4. Findings ............................................................................................................................................... 3
5. Risk Assessment .................................................................................................................................. 4
Critical Severity Vulnerability ........................................................................................................... 4
High Severity Vulnerability ............................................................................................................... 5
Medium Severity Vulnerability ......................................................................................................... 7
Low Severity Vulnerability................................................................................................................ 8
6. Recommendations ............................................................................................................................... 9
Remediation .................................................................................................................................. 10
Security Policy & Configuration ...................................................................................................... 15

1|P a ge
[email protected]
1. Executive Summary
The purpose of this vulnerability scan is to gather data on Windows and third-party software patch levels
on specified hosts in the domain. The audit was performed on “DATE” using Nessus v8.2.2.

Of the 35 hosts identified, 32 systems were found to be active and were scanned. A total of 447 unique
vulnerabilities were found during this scan. Critical, high, and medium severity vulnerabilities were found
to exist across all 32 systems.

Vulnerability Risk Unique Count

Critical Severity Vulnerabilities 44
High Severity Vulnerabilities 309
Medium Severity Vulnerabilities 84
Low Severity Vulnerabilities
10
The vulnerabilities found on Windows hosts consist of outdated Windows patches and third-party
software including Google Chrome and Adobe Flash. Systems were also found to be missing patches from
2014. Older vulnerabilities present a more significant risk as malicious actors will often automate
exploitation of known vulnerabilities in an attempt to catch the lowest hanging fruit. Therefore, we
strongly recommend applying the latest patch to the outdated software as soon as possible.

The vulnerabilities found on the HP switches consist of TLS/SSL certificate vulnerabilities and deal mainly
with using outdated encryption suites. Though outdated/self-signed certificates on internal devices are
not as high risk as the same on external facing devices, proper, up-to-date SSL certificates should be
installed to meet best practice. Additionally, switches were found to be running variations of 3 versions
of firmware; these switches should be updated to the newest firmware supported by the vendor.

It is our recommendation that immediate action be taken to resolve these vulnerabilities by applying
patches and adjusting system configurations as necessary.

In addition, a patch and configuration management process should be implemented to continually assess
system risk level as vulnerabilities are discovered. This will ensure relevant security patches and
configurations are applied in a timely manner.

2. Scan Results
We have included supplemental material to this report consisting of the Nessus scan results and Nessus
report.

Scan Results - The scan results provide granular detail of each vulnerability, which are categorized by their
severity: critical, high, medium, and low. An expanded definition of the known threat and solutions for
remediating the vulnerability are also available.

Nessus Report – The Nessus Report provides a comprehensive analysis of the scan results.

2|P a ge
[email protected]
3. Methodology
Internal credentialed patch audits are used as a tool to gather data in order to assess the effectiveness of
“the client patching effort. Further, this data will be used to support findings and recommendations found
under the “Recommendations” section.

The scan was conducted using the Nessus Professional vulnerability scanning platform connected to the
“THE CLIENT” environment. The purpose of utilizing a scanning engine inside the network perimeter
along with valid domain credentials is to bypass existing external security controls and host-based
security measures to gain a detailed look at system configuration and patch levels. The 00.00.00.0/00
subnet was identified by “THE CLIENT”, with further specification to scan hosts residing in the “THE
CLIENT” domain.

When performing vulnerability scans, the risk of system crash or degraded performance is always
present. In order to mitigate risk of system downtime or impairment, some systems (such as network
switches or printers) are excluded from scans.

The vulnerability scan occurs in two phases:

1. Network Discovery
2. Vulnerability Assessment

The network discovery phase is conducted to discover live hosts on the target network and involves
various host discovery methods such as ICMP pings, ARP pings, and TCP connections to well-known ports.
The vulnerability assessment uses data gathered during the first phase to generate the report.

4. Findings
The results from the credentialed patch audit are listed below. It is important to note that not all
identified hosts were able to be scanned during this assessment – of the 35 hosts identified by “THE
CLIENT” as belonging to the “THE CLIENT” domain, only 32 were successfully scanned. In addition, some
of the hosts scanned were not included in the host list provided.

The remainder of the hosts were either offline during scans or the supplied credentials failed to
authenticate to the hosts. Though not all hosts were not able to be scanned, the findings should be
representative of the current overall vulnerability status of hosts in the network.

A full listing of scanned hosts is available in the “Scan Results” section of this report.

• Outdated Windows Patch Levels: Many systems reported the need for patches and updates that
have been published for at least thirty-days.

• Outdated Third-Party Software: Many systems reported missing necessary security updates for
popular third-party software packages such Google Chrome, and Adobe Flash.

3|P a ge
[email protected]
5. Risk Assessment
This report identifies security risks that could
have significant impact on mission-critical
applications used in day-to-day business
operations. These risks are quantified
according to their likelihood of occurrence
and the potential damage if they occur. Risk
factors are combined to form an overall risk
index for each system, allowing you to
prioritize your remediation activities accordingly. Of the 32 systems scanned, a total of 447 unique
vulnerabilities were found.

Critical Severity Vulnerability

44 were critical severity vulnerabilities. Critical vulnerabilities require immediate attention. They are
relatively easy for attackers to exploit and may provide them with full control of the affected systems.

A list of the most frequent critical severity vulnerabilities is provided below:

PLUGIN NAME DESCRIPTION SOLUTION COUNT

The remote Windows host is missing security

KB4022715: Windows update KB4022715. It is therefore affected Apply security update
10 Version 1607 and by multiple vulnerabilities. A local attacker KB4022715 as well as
Windows Server 2016 can exploit these via a specially crafted script refer to the KB article 5
June 2017 Cumulative to bypass the Device Guard Code Integrity for additional
Update policy and inject arbitrary code into a trusted information.
PowerShell process.
The Microsoft .NET Framework installation
on the remote host is missing security
updates. A remote code execution
Security Updates for Microsoft has released
vulnerability exists in .NET Framework and
Microsoft .NET security updates for
Visual Studio software when the software 4
Framework (February Microsoft .NET
fails to check the source markup of a file. An
2019) Framework.
attacker who successfully exploited the
vulnerability could run arbitrary code in the
context of the current user.
The Microsoft .NET Framework installation
on the remote host is missing security
updates. A remote code execution
vulnerability exists when the Microsoft .NET
Microsoft has released
Security Updates for Framework fails to validate input properly.
security updates for
Microsoft .NET An attacker who successfully exploited this 4
Microsoft .NET
Framework (December vulnerability could take control of an
Framework.
2018) affected system. An attacker could then
install programs, view, change, or delete
data; or create new accounts with full user
rights.
4|P a ge
[email protected]
 According to its self-reported version
number, the installation of Microsoft SQL
Upgrade to a version
Microsoft SQL Server Server on the remote host is no longer
of Microsoft SQL
Unsupported Version supported. Lack of support implies that no 3
Server that is currently
Detection new security patches for the product will be
supported.
released by the vendor. As a result, it is likely
to contain security vulnerabilities.
Microsoft has released
The remote Windows host is missing a a set of patches for
security update. An elevation of privilege Windows Vista, 2008,
vulnerability exists in the Web Proxy Auto 7, 2008 R2, 8, 2012,
MS16-077: Security Discovery (WPAD) protocol due to improper 8.1, RT 8.1, 2012 R2,
Update for WPAD handling of the proxy discovery process. A and 10. Note that 3
(3165191) remote attacker can exploit this by cumulative update
responding to NetBIOS name requests for 3160005 in MS16-063
WPAD to bypass security restrictions and must also be installed
gain elevated privileges. in order to fully resolve
CVE-2016-3213.

High Severity Vulnerability

309 were high severity vulnerabilities. High severity vulnerabilities are often harder to exploit and may
not provide the same access to affected systems.

A list of the most frequent high severity vulnerabilities is provided below:

PLUGIN NAME DESCRIPTION SOLUTION COUNT

The remote Windows host is affected by a

remote code execution vulnerability due to
how the Group Policy service manages policy
MS15-011: Microsoft has released
data when a domain-joined system connects
Vulnerability in Group a set of patches for
to a domain controller. An attacker using a
Policy Could Allow Windows Vista, 2008, 18
controlled network can exploit this to gain
Remote Code Execution 7, 2008 R2, 8, 2012,
complete control of the host. Note that
(3000483) 8.1, and 2012 R2.
Microsoft has no plans to release an update
for Windows 2003 even though it is affected
by this vulnerability.
The Internet Explorer installation on the
remote host is missing security updates. A
remote code execution vulnerability exists
Microsoft has released
Security Updates for when Internet Explorer improperly accesses
security updates for
Internet Explorer (June objects in memory. This vulnerability could 18
the affected versions
2017) corrupt memory in such a way that an
of Internet Explorer.
attacker could execute arbitrary code in the
context of the current user

5|P a ge
[email protected]
 The version of Internet Explorer installed on
the remote host is missing Cumulative Microsoft has released
MS15-124: Cumulative Security Update 3116180. An a set of patches for
Security Update for unauthenticated remote attacker can exploit Windows Vista, 2008,
18
Internet Explorer these issues by convincing a user to visit a 7, 2008 R2, 8, RT,
(3116180) specially crafted website resulting in the 2012, 8.1, RT 8.1, 2012
execution of arbitrary code in the context of R2, and 10.
the current user.

Apply Security Only

update KB4056898 or
The remote Windows host is missing security
Cumulative Update
KB4056898: Windows update 4056898 or cumulative update
KB4056895. Due to a
8.1 and Windows 4056895. A vulnerability exists within
compatibility issue
Server 2012 R2 January microprocessors utilizing speculative
with some antivirus 9
2018 Security Update execution and indirect branch prediction
software products it
(Meltdown)(Spectre) which may allow an attacker with local user
may not be possible to
access to disclose information via a side-
apply the required
channel analysis
updates.

The remote Windows host is missing security

update 4343888 or cumulative update
Apply Security Only
4343898. A remote code execution
KB4343888: Windows update KB4343888 or
vulnerability exists in the way that Microsoft
8.1 and Windows Cumulative Update
browsers access objects in memory. The
Server 2012 R2 August KB4343898 as well as
vulnerability could corrupt memory in a way 9
2018 Security Update refer to the KB article
that could allow an attacker to execute
(Foreshadow) for additional
arbitrary code in the context of the current
information.
user. An attacker who successfully exploited
the vulnerability could gain the same user
rights as the current user

6|P a ge
[email protected]
Medium Severity Vulnerability
84 were medium severity vulnerabilities. These vulnerabilities often provide information to attackers that
may assist them in mounting subsequent attacks on your network. These should also be fixed in a timely
manner but are not as urgent as the other vulnerabilities.

A list of the most frequent medium severity vulnerabilities is provided below:

PLUGIN NAME DESCRIPTION SOLUTION COUNT

Force the use of SSL as

The remote version of the Remote Desktop a transport layer for
Protocol Server (Terminal Service) is this service if
vulnerable to a man-in-the-middle (MiTM) supported| or/and -
Microsoft Windows
attack. The RDP client makes no effort to Select the 'Allow
Remote Desktop
validate the identity of the server when connections only from 19
Protocol Server Man-in-
setting up encryption. An attacker with the computers running
the-Middle Weakness
ability to intercept traffic from the RDP Remote Desktop with
server can establish encryption with the Network Level
client and server without being detected. Authentication' setting
if it is available.

The remote host is missing one of the Apply the client

MS KB3009008: workarounds referenced in the Microsoft registry key
Vulnerability in SSL 3.0 Security Advisory 3009008. If the client workaround and the
Could Allow registry key workaround has not been server registry key 18
Information Disclosure applied, any client software installed on the workaround suggested
(POODLE) remote host (including IE) is affected by an by Microsoft in the
information disclosure vulnerability when advisory.
using SSL 3.0.

The remote Windows host has at least one

Ensure that any
service installed that uses an unquoted
Microsoft Windows services that contain a
service path, which contains at least one
Unquoted Service Path space in the path 7
whitespace. A local attacker can gain
Enumeration enclose the path in
elevated privileges by inserting an executable
quotes.
file in the path of the affected service
The Microsoft .NET Framework installation
Security Updates for on the remote host is missing a security Microsoft has released
Microsoft .NET update. An attacker who successfully security updates for
4
Framework (January exploited the vulnerability could retrieve Microsoft .NET
2019) content, that is normally restricted, from a Framework.
web application.
7|P a ge
[email protected]
 The remote Microsoft SQL Server is missing a
security update. It is, therefore, affected by a Microsoft has released
ADV180002: Microsoft
vulnerability exists within microprocessors a set of patches for
SQL Server January
utilizing speculative execution and indirect SQL Server 2008, 2008 4
2018 Security Update
branch prediction, which may allow an R2, 2012, 2014, 2016,
(Meltdown) (Spectre)
attacker with local user access to disclose and 2017.
information via a side-channel analysis.

Low Severity Vulnerability

10 were low severity vulnerabilities. Low severity vulnerabilities do not need to be patch immediately and
can be resolved during the next updates maintenance window.

A list of the most frequent critical severity vulnerabilities is provided below:

PLUGIN NAME DESCRIPTION SOLUTION COUNT

The remote Windows host is missing

a security update. It is, therefore,
affected by an information disclosure
vulnerability in the Windows
Microsoft has released a set of
MS16-153: Security Common Log File System (CLFS) due
patches for Windows Vista, 2008,
Update for Common to improper handling of objects in 2
7, 2008 R2, 2012, 8.1, RT 8.1,
Log File System memory. A local attacker can exploit
2012 R2, 10, and 2016.
Driver (3207328) this vulnerability, via a specially
crafted application, to bypass security
measures and disclose sensitive
information.
The remote Windows host is affected
MS15-006:
by a vulnerability in the Windows
Vulnerability in
Error Reporting service component
Windows Error Microsoft has released a set of
that allows bypassing the 'Protected
Reporting Could patches for Windows 8, 2012, 1
Process Light' security feature. A
Allow Security 8.1, and 2012 R2.
remote attacker can exploit this
Feature Bypass
vulnerability to gain access to the
(3004365)
memory of a running process.
The version of Windows running on
the remote host is affected by a
security downgrade vulnerability that
MS15-014:
affects workstations and servers
Vulnerability in Microsoft has released a set of
configured to use Group Policy. A
Group Policy Could patches for Windows 2003, Vista,
man-in-the-middle attacker can 1
Allow Security 2008, 7, 2008 R2, 8, 2012, 8.1,
cause the policy file to become
Feature Bypass and 2012 R2.
corrupted and unreadable, resulting
(3004361)
in the Group Policy settings reverting
to their default, potentially less
secure state.

8|P a ge
[email protected]
 The Microsoft Exchange install on the Delete the following registry
Microsoft Exchange
remote host contains an unspecified value:
Server Elevation of
flaw that allows an authenticated HKEY_LOCAL_MACHINE\SYSTEM\
Privilege 1
man-in-the-middle attacker to CurrentControlSet\Control\Lsa\
Vulnerability
impersonate another user and DisableLoopbackCheck as shown
(November 2018)
escalate privileges. in the advisory.
The remote Windows host is missing
a security update. It is, therefore,
affected by multiple information Microsoft has released a set of
MS16-124: Security
disclosure vulnerabilities in the kernel patches for Windows Vista, 2008,
Update for Windows 1
API that allow a local attacker, via a 7, 2008 R2, 2012, 8.1, RT 8.1,
Registry (3193227)
specially crafted application, to 2012 R2, and 10.
disclose sensitive registry
information.

6. Recommendations
Recommendations in this report are based on the available findings from the credentialed patch audit.
Vulnerability scanning is only one tool to assess the security posture of a network. The results should not
be interpreted as definitive measurement of the security posture of the “THE CLIENT” network. Other
elements used to assess the current security posture would include policy review, a review of internal
security controls and procedures, or internal red teaming/penetration testing.

Patch management and system configuration are the main security elements that need to be addressed
by “THE CLIENT”. While it is possible to remediate all discovered vulnerabilities through applying patches
or adjusting system configurations, issues will re-appear as new vulnerabilities are discovered.

It is recommended that a patch and configuration management process be implemented to audit system
risk level and configuration drift on a regular basis to ensure that relevant security patches and
configuration changes are applied in a timely manner.

9|P a ge
[email protected]
Remediation
Taking the following actions across 9 hosts will resolve 20% of the vulnerabilities on the network:

ACTION TO TAKE VULNS HOSTS

Adobe Flash Player <= 32.0.0.114 (APSB19-06): Upgrade to Adobe Flash Player
767 1
version 32.0.0.142 or later

MS KB3065823: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer:

172 1
Install Microsoft KB3065823.

Install KB4489873 135 5

Install KB4489881 72 1

Install KB4489891 47 1

Google Chrome < 73.0.3683.75 Multiple Vulnerabilities: Upgrade to Google Chrome

18 1
version 73.0.3683.75 or later.

Install KB4489880 16 1

Microsoft Malware Protection Engine < 1.1.14700.5 RCE: Enable automatic updates
to update the scan engine for the relevant antimalware applications. Refer to
11 1
Knowledge Base Article 2510781 for information on how to verify that MMPE has
been updated.
HP Insight Management Agents Multiple Vulnerabilities: Upgrade to HP Insight
8 2
Management Agents 9.0.0.0 or later.

Install KB4489878 6 2

Install KB4023307 6 2

KB4023307: Security Update for the Windows Uniscribe Remote Code Execution
Vulnerability for Microsoft Silverlight 5 (June 2017): Apply security update 6 2
KB4023307.

Install MS18-01 5 1

Install KB3185911 5 1

Install KB4480059 4 1

10 | P a g e
[email protected]
Install KB4035055 4 1

Install KB4489882 4 2

Install KB4480058 3 1

Install KB4018466 3 1

Install KB4015380 3 1

Install KB4483453 3 1

Install KB3156019 3 1

Install KB3110329 3 1

Install KB2993651 3 1

Security Updates for Exchange (Jun 2018): Microsoft has released the following
3 1
security updates to address this issue: -KB4295699 -KB4099855 -KB4099852

Install MS18-05 2 1

Install KB4457037 2 1

Install KB4483457 2 1

Install KB4470637 2 1

Install KB4457038 2 1

Install KB4344151 2 1

Install KB4344149 2 1

11 | P a g e
[email protected]
Install KB4340583 2 1

Install KB4039266 2 1

Install KB4026059 2 1

Install KB4025240 2 1

Install KB4015068 2 1

Install KB4012583 2 1

Install KB3170455 2 1

Install KB3157569 2 1

Install KB3126446 2 1

Install KB3133043 2 2

Install KB3126587 2 2

Install KB2538243 1 1

Install KB3135995 1 1

Install KB4489876 1 1

Install KB4093223 1 1

Install KB4048970 1 1

Install KB4025674 1 1

12 | P a g e
[email protected]
Install KB4022750 1 1

Install KB4018821 1 1

Install KB4015383 1 1

Install KB4014793 1 1

Install KB4014652 1 1

Install KB3216775 1 1

Install KB3197655 1 1

Install KB3196726 1 1

Install KB3196718 1 1

Install KB3188726 1 1

Install KB4480057 1 1

Install KB3184943 1 1

Install KB3156017 1 1

Install KB3153704 1 1

Install KB3135994 1 1

Install KB3109560 1 1

Install KB3097997 1 1

13 | P a g e
[email protected]
Install KB3084135 1 1

Install KB3076895 1 1

Install KB3075220 1 1

Install KB3004365 1 1

Install KB3000483 1 1

Install KB2957189 1 1

HP Version Control Agent (VCA) < 7.3.3 Multiple SSL Vulnerabilities: Upgrade to VCA
0 2
7.3.3 or later.

14 | P a g e
[email protected]
Security Policy & Configuration
All services users authenticate against, such as an internal Active Directory environment or a third-party
provider of a CMS application, include some kind of security policy. Typically, this includes criteria around
passwords, administrative access, and auditing.

Industry Best Practice

User accounts with administrative rights should be periodically reviewed and adjusted as necessary to
comply with the principle of least privilege, which states that accounts have only the level of access
necessary to perform required functions. If an account is compromised, the potential damage is therefore
limited to the minimum amount possible.

Additionally, the following password and lockout settings are recommended:

Policy Setting Description Recommendation

The number of previous passwords that the user

Enforce Password History 24
is prohibited from re-using.
The maximum length of time that may elapse
Maximum Password Age 120 Days
before a user is forced to change their password
The length of time that must pass before a user
Minimum Password Age 1 Day
can change their password again
The number of characters that must be used in
Minimum Password Length 8 Characters
a password
Requires users to use 2 out of 3 of Upper Case,
Password Complexity
Number or Symbol in a password. E.g Pass2017, Enabled
Requirements
or test123!.
Locks users workstation after specified duration 15 Minutes or
Screen Lock Policy
of inactivity less
Disables access to an account for a specified
30 Minute
duration after a number of login attempts with
Account Lockout Policy Lockout after 10
an invalid password. Is effective against
attempts
automated attempts to guess user passwords.

15 | P a g e
[email protected]