Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of our web servers just failed PCI-DSS compliance because the vulnerability scan detected the OS was Windows Server 2003 Service Pack 1 (obviously very outdated!).

My question is how did the vuln scan detect this as I can't seem to find a way to source the same information without having AD access to that box (it's on a service providers network). Even with nmap, it only provides guesses to the OS version:

Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (99%)

So how do I verify this before sending a very, very angry email to our provider? If this is accurate, then I'd say this is negligence and my email tone to them won't be very good.

I have no login access to this box.

share|improve this question
2  
If it is a web server, it could be leaking information about the version of IIS in an HTTP request. It could be that there is some bug or vulnerability that was detected that would have been handled by SP2. –  Zoredache May 8 '13 at 21:17
2  
Why not ask the company that performed the audit? Or check the docs related to that tool? –  Zoredache May 8 '13 at 21:23
1  
I kinda wonder if this would get better results over on the security.stackexchange.com. It seems like they might know what magical methods are commonly being used in VULN scanners these days. –  Zoredache May 8 '13 at 21:32
1  
Does your contract with the provider include them keeping the server up to date with patches? If not, then patching it is your responsibility, not theirs. –  joeqwerty May 8 '13 at 21:35
1  
@Zoredache I had no idea there was now a security.stackexchange.com... geeze... there are FAR too many stackexchanges now... each with almost no userbase and end up not being helpful in the slightest. ... I digress... –  SnakeDoc May 8 '13 at 22:13

1 Answer 1

That Aggressive OS guesses line is based on what nmap (or nmap-like scanner) was able to match against its fingerprint database. While it claims that it is "99%" confident, that claim means it's confident based on what it knows about other OS' fingerprints. It is possible that Win2k3 SP3 and higher have identical fingerprints because those hotfixes did not touch tcp/ip or udp/ip stack or server signature in any way.

The only sure way to know if a server is vulnerable to all the claimed CVEs is to actually try to exploit them. But doing that will probably get you into hot water :)

Since you also don't have direct access to the server itself, your best bet is to request(or even demand) that they provide you with a list of all installed hotfixes on the server. It can be easily accomplished with C:\>wmic qfe list command.

share|improve this answer
    
Better late then never? lol. I actually forgot about this post. I think the problem at the time was a 3rd party vuln scanner was flagging the box as being SP1 (it correctly identifies other SP levels on other boxes and includes them in the report). The nmap portion was just me seeing if I could glean the same information. I imagine they do some analysis of packet headers and server responses to determine a "profile" for certain versions of certain software. –  SnakeDoc Jan 24 at 22:47
    
@SnakeDoc this question floated up in the queue..didn't look at the date asked. :) –  Mxx Jan 24 at 22:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.