Mailing List Archive: macosx_10_4_11.nasl false positive?

macosx_10_4_11.nasl false positive?

Feb 28, 2008, 12:37 PM

Post #1 of 3 (2257 views)

Hi all,

macosx_10_4_11.nasl seems to trigger on a host which has been upgraded
from Tiger to Leopard (10.5.2). We aren't using any authentication
during the scan, so it's using purely external factors. Has anyone
else seen this, and is there a good way to eliminate this false
positive?

Thanks,
Erik
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

Re: macosx_10_4_11.nasl false positive? [ In reply to ]

raleel at gmail

Feb 28, 2008, 1:45 PM

Post #2 of 3 (2114 views)

Permalink

we've seen our 10.5 boxes return quite a few "unpatched" results. I don't
have the numbers handy, or any more good information, but I had figured it
was because the ssh string is not enough.

On Fri, Feb 29, 2008 at 4:37 AM, <nessus@eriko.mobi> wrote:

> Hi all,
>
> macosx_10_4_11.nasl seems to trigger on a host which has been upgraded
> from Tiger to Leopard (10.5.2). We aren't using any authentication
> during the scan, so it's using purely external factors. Has anyone
> else seen this, and is there a good way to eliminate this false
> positive?
>
> Thanks,
> Erik
> _______________________________________________
> Plugins-writers mailing list
> Plugins-writers@list.nessus.org
> http://mail.nessus.org/mailman/listinfo/plugins-writers
>

--
Doug Nordwall
Unix, Network, and Security Administrator
You mean the vision is subject to low subscription rates?!!? - Scott Stone,
on MMORPGs

Re: macosx_10_4_11.nasl false positive? [ In reply to ]

deraison at nessus

Feb 28, 2008, 3:06 PM

Post #3 of 3 (2118 views)

Permalink

Which version of this plugin are you using ? We recently fixed a false
positive issue in it, make sure to run version 1.6 or newer.

Thanks,
-- Renaud

On Feb 28, 2008, at 9:37 PM, nessus@eriko.mobi wrote:

> Hi all,
>
> macosx_10_4_11.nasl seems to trigger on a host which has been upgraded
> from Tiger to Leopard (10.5.2). We aren't using any authentication
> during the scan, so it's using purely external factors. Has anyone
> else seen this, and is there a good way to eliminate this false
> positive?
>
> Thanks,
> Erik
> _______________________________________________
> Plugins-writers mailing list
> Plugins-writers@list.nessus.org
> http://mail.nessus.org/mailman/listinfo/plugins-writers
>

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers