Mailing List Archive: no results on plugin 20008

no results on plugin 20008

Oct 13, 2005, 2:19 PM

Post #1 of 5 (1386 views)

Greetings all,

I appear to be getting no results on the nessus plugin 20008 for
MS05-051 (network-based check). I've run it against a large (class C)
group of hosts and got nothing, then ran it against a VM system I've got
running insufficiently-patched Win2K with no luck.

Some troubleshooting indicates it fails at its first "if (!port)" for
the known unpatched 2K box. Is it relying solely on the presence of
port 593?

I'd appreciate any suggestions.

As a side note, since 20008 is part of the direct feed, how much of it
is ok to ask about publicly? Should I be sending requests to for plugins
that are still only on the direct feed directly to Tenable?

Cheers,
Brian

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Brian Smith-Sweeney Sr. Network Security Analyst
ITS Technology Security Services, New York University
bsmithsweeney@nyu.edu
http://www.nyu.edu/its/security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: no results on plugin 20008 [ In reply to ]

bsmithsweeney at nyu

Oct 13, 2005, 2:34 PM

Post #2 of 5 (1351 views)

Permalink

As a follow up to my own post, it appears the script gets the port data
from a kb item which does in fact have a value (I dumped the results of
get_kb_list to get this), and it's not 593. But still the port test is
failing. Thoughts?

Brian Smith-Sweeney wrote:
> Greetings all,
>
> I appear to be getting no results on the nessus plugin 20008 for
> MS05-051 (network-based check). I've run it against a large (class C)
> group of hosts and got nothing, then ran it against a VM system I've got
> running insufficiently-patched Win2K with no luck.
>
> Some troubleshooting indicates it fails at its first "if (!port)" for
> the known unpatched 2K box. Is it relying solely on the presence of
> port 593?
>
> I'd appreciate any suggestions.
>
> As a side note, since 20008 is part of the direct feed, how much of it
> is ok to ask about publicly? Should I be sending requests to for plugins
> that are still only on the direct feed directly to Tenable?
>
> Cheers,
> Brian
>

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Brian Smith-Sweeney Sr. Network Security Analyst
ITS Technology Security Services, New York University
bsmithsweeney@nyu.edu
http://www.nyu.edu/its/security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: no results on plugin 20008 [ In reply to ]

theall at tenablesecurity

Oct 14, 2005, 8:16 AM

Post #3 of 5 (1363 views)

Permalink

On Thu, Oct 13, 2005 at 05:19:35PM -0400, Brian Smith-Sweeney wrote:

> I appear to be getting no results on the nessus plugin 20008 for
> MS05-051 (network-based check). I've run it against a large (class C)
> group of hosts and got nothing, then ran it against a VM system I've got
> running insufficiently-patched Win2K with no luck.

Update to the latest set of plugins and try the scan again.
dcetest.nasl, on which the network-based check depends, was
substantially revised last night and should fix the problem.

> As a side note, since 20008 is part of the direct feed, how much of it
> is ok to ask about publicly? Should I be sending requests to for plugins
> that are still only on the direct feed directly to Tenable?

This isn't a problem

George
--
theall@tenablesecurity.com
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

no results on plugin 20008 [ In reply to ]

eliot at u

Oct 18, 2005, 12:31 PM

Post #4 of 5 (1356 views)

Permalink

I have the latest plugin set (dcetest.nasl is dated 10/14/05)
and I ran 20008 on a unpatched SP4 W2K box and got nothing.
I was wondering if anyone else has gotten a positive result.

thanks

eliot
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: no results on plugin 20008 [ In reply to ]

npouvesle at tenablesecurity

Oct 19, 2005, 6:02 AM

Post #5 of 5 (1350 views)

Permalink

On Oct 18, 2005, at 3:31 PM, eliot wrote:

>
> I have the latest plugin set (dcetest.nasl is dated 10/14/05)
> and I ran 20008 on a unpatched SP4 W2K box and got nothing.
> I was wondering if anyone else has gotten a positive result.

msdtc service is not activated by default. This service only runs if
a sql database is installed (MSDE, SQLSERVER) or if another service
like Message Queueing service is started.
You can start this service manually too if you want to test the plugin.

Regards,

Nicolas
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers