R. Kinney Williams - Yennik, Inc.®
R. Kinney Williams
 Yennik, Inc.

IT Project Report
Your Financial Institution
Anywhere, USA
Internal VISTA IP Audit Study
 sorted by host


Please be patient.  This page may take a few minutes to load.
This is only a sample internal report for Network Administrators.

To assist your Network Administrator toward improving potential internal exposure, the Project Management Report is sorted into three vulnerability categories, which are Confirmed Vulnerabilities, Potential Vulnerabilities, and Information Gathered.   Within each category, the vulnerabilities discovered are ranked according to severity from Urgent (5), Critical (4), Serious (3), Medium (2), and Minimal (1), where "5.0" is the highest and "1.0" the lowest security risk from unauthorized internal intrusion.  Go to Vulnerability Categories and Severity Levels for more information.  

The Project Management Report below is provided for your Network Administrator to evaluate the institution's exposure and make any necessary configuration changes.  This report should help your Network Administrator to manage vulnerability fixes.  Vulnerabilities should be fixed by working first with the Confirmed Vulnerabilities starting with the most severe and working to the least severe.  Then work on the Potential Vulnerabilities and Information Gathered vulnerabilities.  While vulnerabilities ranked "2" and "1" are not necessarily considered a security risk from internal unauthorized intrusion, your Network Administrator, information technology vendors, and information systems personnel are the experts on your computer operations and should review the test results as the results apply to your information technology operation.

After expanding the following categories (to expanded each category, click the plus (+) icon next to the category name), you can print a  hard copy of this report by using your browser's Print button.

1)  List of Vulnerabilities (Confirmed)
2)  Potential Vulnerabilities
3)  Information Gathered
4)  Appendices (Vulnerability severity explanation and inactive hosts if any)

Understanding the VISTA Reports          Vulnerability Categories and Severity Levels          General help page
IT Project Report

 
Report Summary
Company: Your Financial Institution
Anywhere, USA
 
Template Title: Penetration Study
IPs Scanned: 6
Date Range: N/A
Trend Analysis: Latest report
Include Detailed Results: Vulnerability Description, Consequences, Solution, Results
Sort by: Host
   
Filters: Vulnerability Checks: Disabled checks, Ignored checks
Asset Groups/IPs: 192.xxx.1.1 - 192.xxx.1.6

Summary of Vulnerabilities
Vulnerabilities Total 256
Average Security Risk 4.5
Business Risk
64/100
by Severity
Severity Vulnerabilities
5 12
4 19
3 80
2 63
1 100
5 Biggest Categories
Category Vulnerabilities
TCP/IP 60
General remote services 39
SMB / NETBIOS 38
Information gathering 29
Windows 28
Detailed Results
192.xxx.1.3 (Server Name) Microsoft Windows 2000 SP4
Vulnerabilities Total 117
Security Risk 5.0
by Severity
Severity Vulnerabilities
5 5
4 5
3 52
2 16
1 39
5 Biggest Categories
Category Vulnerabilities
General remote services 33
Windows 14
Web server 13
TCP/IP 9
SMB / NETBIOS 9
5
Microsoft NNTP Remote Code Execution Vulnerability (MS04-036)  
New
QID:90185   Category:Windows   CVE ID:CAN-2004-0574
Vendor Reference:MS04-036
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
A remote code execution vulnerability exists in the Network News Transfer Protocol (NNTP) component of affected operating systems.
IMPACT:
An attacker who successfully exploits this vulnerability could take complete control of an affected system.
SOLUTION:
Microsoft has released a patch to address this issue. Apply the patch from Microsoft Security Bulletin MS04-036 to fix this issue.
RESULT:
200 NNTP Service 5.00.0984 Version: 5.0.2195.6702 Posting Allowed
5
Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
port 8080/tcp
New
QID:62042   Category:Proxy   CVE ID:CAN-2004-0492
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
Apache Web server includes a proxying module (mod_proxy) to provide a proxy/cache for FTP, HTTP, and SSL.

A remote buffer overflow vulnerability exists in Apache mod_proxy. The vulnerability occurs in the proxyutil.c source file. The source of the issue is that users can pass a negative value to be used as the length in a memory copy operation. Specifically, the length value is passed to the ap_bread() function, which results in a memcpy() with a negative length argument. This could permit a malicious user to corrupt process memory. This may triggered if a remote user specifies a negative Content-Length: HTTP header field to be passed through the proxy.

IMPACT:
The successful exploitation of this vulnerability will likely result in a denial of service. There is also an unconfirmed potential for the execution of arbitrary code.

It has been conjectured that FreeBSD may permit exploitation since its memcpy() implementation will copy data backwards, potentially allowing for corruption of sensitive variables that affect execution flow of the program. Apache also calls signal handling routines when encountering a SEGV, which may provide an exploitation vector for this vulnerability.

SOLUTION:
Apache has fixed the security issue in the development tree, but they have not released a fixed version yet. Check Apache's Web site for updates.

Multiple other vendors have released patched versions of their own distributions of the software. This includes Mandrake, Debian, Gentoo, OpenPKG, OpenBSD, SGI, IBM, and HP. Check the individual distributions' Web sites for download information.

RESULT:
No results available
5
TCP Connections Established to Firewalled/Filtered Ports via HTTP Proxy
port 8080/tcp
New
QID:62036   Category:Proxy   CVE ID:N/A  
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
Successful TCP connections were established to firewalled/filtered ports using the CONNECT method allowed by the HTTP proxy server. These ports were otherwise inaccessible because direct TCP connection attempts to them failed.

Note that the service only tried to connect to the firewalled/filtered ports. No attempts were made to detect potential vulnerabilities that may exist on the daemons/services listening on these ports.

IMPACT:
This vulnerability may be exploited to bypass the security rules set up on the firewall or filtering device to protect the internal network.
SOLUTION:
Reconfigure your proxy server to disable the CONNECT method and/or restrict its access.
RESULT:
PortServer Banner or Version
443 
4
Installed PCAnywhere  
New
QID:90055   Category:Windows   CVE ID:N/A  
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
PCAnywhere seems to be installed on this computer. PCAnywhere is a complete administration tool, allowing remote administrators to control the computer as if they were physically logged on.
IMPACT:
With PCAnywhere installed, a malicious remote user could take complete control of the computer.
SOLUTION:

If you did not intentionally install PCAnywhere for remote maintenance reasons, then it should be removed.

If this application was intentionally installed and is currently in use, then we recommend that you follow all vendor suggested guidelines to make it safe. For more information, refer to the Addressing Security with pcAnywhere PDF document.

RESULT:
Detected service pcanywhere and os Windows 2000 Service Pack 4
Detected on TCP port 5631.
4
Remote Windows User List Disclosure Vulnerability  
New
QID:45003   Category:Information gathering   CVE ID:CVE-2000-1200
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
A null session connection to the IPC$ share was successful. NetBIOS access can be obtained with any authenticated account on this host. Therefore unauthorized users can steal the remote user list. This kind of attack is commonly exploited by users with weak passwords, such as the GUEST account.
IMPACT:
By exploiting this vulnerability, unauthorized users can launch brute force password attacks and other intrusive attacks based on collected information. Employee, customer, and partner information may be gathered. Spamming the user list is also possible.
SOLUTION:
It is recommended that you disable null sessions. Read this Microsoft document called How to Use the RestrictAnonymous Registry Value for more information.

For Windows NT, setting this registry value limits only certain interfaces to this data. It is not possible to completely eliminate this vulnerability through a registry setting.

There is another interesting Microsoft document called Local Policies about Windows security policies settings for local policies.

Windows XP onwards Microsoft has added more granular control to the anonymous user access by adding couple of more DWORD registry values in the same key location as RestrictAnonymous, RestrictAnonymousSAM and EveryoneIncludesAnonymous. Set RestrictAnonymous = 1 to restrict share information access, RestrictAnonymousSAM = 1 to prevent enumeration of SAM accounts (User Accounts) and EveryoneIncludesAnonymous = 0 to prevent null-sessions from having any rights.

If possible, filter out Microsoft networking ports such as TCP ports 135, 137, 138, 139, and UDP ports 135, 137, 138.

RESULT:
Aministratt
TsInternetUser
IUSR_1
IWAM_1
1$
4
TCP Connections Established to Open Port(s) on the Host via HTTP Proxy
port 8080/tcp
New
QID:62035   Category:Proxy   CVE ID:N/A  
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
Successful TCP connections were established to open ports on the host using the CONNECT method allowed by the HTTP proxy server.
IMPACT:
This vulnerability may be exploited to connect to your internal network that is otherwise unaccssible.
SOLUTION:
Reconfigure your proxy server to disable the CONNECT method or restrict its access.
RESULT:
Based on server's reply:
HTTP/1.1 200 Connection established
Via: 1.1 server1,
we have used the proxy to successfully connect (CONNECT 127.0.0.1:<port>) to following ports:
443
4
Writeable SNMP Information
port 161/udp
New
QID:78031   Category:SNMP   CVE ID:CAN-1999-0792 CAN-2000-0147 CAN-2001-0380 CAN-2001-1210 CAN-2002-0478 CVE-2000-0515
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
Unauthorized users can modify all SNMP information because the access password is not secure.
IMPACT:
The system can be attacked in a number of ways--by route redirection, denial of service, complete loss of network service, reboots or crashes, and traffic monitoring.
SOLUTION:
If SNMP access is not required on this system, then disallow it. Otherwise, use a secure un-guessable "community name", and restrict the hosts that talk SNMP with your system to a defined list of IP addresses.
RESULT:
public
2
Anonymous Access to LDAP Server
port 3268/tcp
New
QID:45007   Category:Information gathering   CVE ID:CVE-1999-0385
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
Anonymous users can obtain a full contact or user list using LDAP access.
IMPACT:
Unauthorized users can obtain a list of your commercial contacts, customers or users. With this information, an attacker might try to gain information about your network through social engineering, a method of interacting with people in order to trick them into disclosing sensitive information.

Please note that the results below represent only the first 5 entries that could be extracted from the server.

SOLUTION:
Restrict access to your LDAP server using an authentication policy.
RESULT:
cn: Anonymous Logon
instanceType: 4
distinguishedName: CN=Anonymous Logon,CN=WellKnown Security Principals,CN=Conf
iguration,DC=domainserver,DC=dom
objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=ah
bdomain,DC=dom
objectClass: top
objectClass: foreignSecurityPrincipal
objectGUID:: /EL+jwCYBUCcREB6xr9VVQ==
objectSid:: AQEAAAAAAAUHAAAA
name: Anonymous Logon
uSNChanged: 1304
uSNCreated: 1304
whenChanged: 20020117183856.0Z
whenCreated: 20020117183856.0Z

cn: Authenticated Users
instanceType: 4
distinguishedName: CN=Authenticated Users,CN=WellKnown Security Principals,CN=
Configuration,DC=domainserver,DC=dom
objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=ah
bdomain,DC=dom
objectClass: top
objectClass: foreignSecurityPrincipal
objectGUID:: rUeav5hiDEOcIPrT1zf1ig==
objectSid:: AQEAAAAAAAULAAAA
name: Authenticated Users
uSNChanged: 1299
uSNCreated: 1299
whenChanged: 20020117183856.0Z
whenCreated: 20020117183856.0Z

cn: Batch
instanceType: 4
distinguishedName: CN=Batch,CN=WellKnown Security Principals,CN=Configuration,
DC=domainserver,DC=dom
objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=ah
bdomain,DC=dom
objectClass: top
objectClass: foreignSecurityPrincipal
objectGUID:: XCL4li5e60mnB3DNd407YA==
objectSid:: AQEAAAAAAAUDAAAA
name: Batch
uSNChanged: 1301
uSNCreated: 1301
whenChanged: 20020117183856.0Z
whenCreated: 20020117183856.0Z

cn: Creator Group
instanceType: 4
distinguishedName: CN=Creator Group,CN=WellKnown Security Principals,CN=Config
uration,DC=domainserver,DC=dom
objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=ah
bdomain,DC=dom
objectClass: top
objectClass: foreignSecurityPrincipal
objectGUID:: a/MCrZ8qtE6MTKpL9WNqWw==
objectSid:: AQEAAAAAAAMBAAAA
name: Creator Group
uSNChanged: 1297
uSNCreated: 1297
whenChanged: 20020117183856.0Z
whenCreated: 20020117183856.0Z

cn: Creator Owner
instanceType: 4
distinguishedName: CN=Creator Owner,CN=WellKnown Security Principals,CN=Config
uration,DC=domainserver,DC=dom
objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=ah
bdomain,DC=dom
objectClass: top
objectClass: foreignSecurityPrincipal
objectGUID:: 3mWCrlcxHUGykm///qGOfQ==
objectSid:: AQEAAAAAAAMAAAAA
name: Creator Owner
uSNChanged: 1296
uSNCreated: 1296
whenChanged: 20020117183856.0Z
whenCreated: 20020117183856.0Z

3
Microsoft Window's NNTP Denial of Service Vulnerability
port 119/tcp
New
QID:54009   Category:News Server   CVE ID:CVE-2001-0543
Vendor Reference:N/A  
First Detected:10-1-02 at 15:04:50   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:

Network News Transfer Protocol (NNTP) is a protocol used to process posting, distributing, searching and archiving news articles posted to Usenet newsgroups. By default, NNTP runs if Windows NT 4.0 Option Pack or Windows 2000 Server are installed. It is not installed by default on Windows NT 4.0 or Windows 2000 Professional.

Due to a flaw in the Microsoft NNTP service, it's possible for a host to be led to consume all available memory resources. This behavior is the result of flaws in the server's memory management.

Malformed news postings submitted repeatedly to an affected host will result in the accumulation of allocated memory that is not freed after use.

IMPACT:
By exploiting this vulnerability, it's possible to exhaust the memory resources of the target system, potentially impacting the NNTP service and other applications running on the affected host.

You must restart your system in order to regain normal functionality.

Note: Since we don't exploit Denial Of Service vulnerabilities, we can't detect whether or not your machine is patched. If you've already applied the appropriate patch, then you can safely ignore this warning.

SOLUTION:
Microsoft Security Bulletin MS01-043 contains information about which patch should be applied to your system and where to get it.
RESULT:
200 NNTP Service 5.00.0984 Version: 5.0.2195.6702 Posting Allowed
5
Multiple Vendor SNMP Request and Trap Handling Vulnerabilities  
Active
QID:78035   Category:SNMP   CVE ID:CAN-2002-0012 CAN-2002-0013
Vendor Reference:MS:MS02-006,SGI:20020201-01-A,CERT-VN:VU#854306
First Detected:02/21/2004 at 14:00:44   Last Detected:10-1-02 at 15:04:50   Times Detected:2
THREAT:
SNMP requests are messages sent from manager to agent systems. They typically poll the agent for current performance or configuration information, ask for the next SNMP object in a Management Information Base (MIB), or modify the configuration settings of the agent.

SNMP traps are messages sent from agent to manager systems. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent.

Multiple vulnerabilities have been discovered in the request and trap handling in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP request and trap messages.

IMPACT:
Possible consequences include causing a denial of service condition and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product.
SOLUTION:
Fixes are available for several systems. Please contact your vendor for more information.
RESULT:
Detected service snmp and os Windows 2000 Service Pack 4
1
LDAP Information Gathering  
N/A
QID:45016   Category:Information gathering   CVE ID:CAN-1999-0646
Vendor Reference:N/A  
First Detected:N/A   Last Detected:10-1-02 at 15:04:50   Times Detected:1
THREAT:
RootDSE is a standard attribute defined in the LDAP Version 3.0 specification. RootDSE contains information about the directory server, including its capabilities and configuration. The search response will contain a standard set of information, which is defined in the following RFC:

RFC 2251-Lightweight Directory Access Protocol(v3)

The root DSE (DSA-Specific Entry) data can be retrieved from an LDAPv3 server by performing a base-level search with a null BaseDN and filter ObjectClass=*. The root DSE publishes information about the LDAP server, including which LDAP versions it supports, any supported SASL mechanisms, supported controls, and the DN for its subschemaSubentry. In addition to server information, operational attributes may be exposed that allow for extended administration functionality.

IMPACT:
The information gathered can be used to launch further attacks against the system or network hosting the LDAP service.
RESULT:
currentTime: 20041018195934.0Z
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=domainserver,DC=dom
dsServiceName: CN=NTDS Settings,CN=CANCAN1,CN=Servers,CN=Default-First-Site
-Name,CN=Sites,CN=Configuration,DC=domainserver,DC=dom
namingContexts: CN=Schema,CN=Configuration,DC=domainserver,DC=dom
namingContexts: CN=Configuration,DC=domainserver,DC=dom
namingContexts: DC=domainserver,DC=dom
defaultNamingContext: DC=domainserver,DC=dom
schemaNamingContext: CN=Schema,CN=Configuration,DC=domainserver,DC=dom
configurationNamingContext: CN=Configuration,DC=domainserver,DC=dom
rootDomainNamingContext: DC=domainserver,DC=dom
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedLDAPVersion: 3
supportedLDAPVersion: 2
supportedLDAPPolicies: MaxPoolThreads
supportedLDAPPolicies: MaxDatagramRecv
supportedLDAPPolicies: MaxReceiveBuffer
supportedLDAPPolicies: InitRecvTimeout
supportedLDAPPolicies: MaxConnections
supportedLDAPPolicies: MaxConnIdleTime
supportedLDAPPolicies: MaxActiveQueries
supportedLDAPPolicies: MaxPageSize
supportedLDAPPolicies: MaxQueryDuration
supportedLDAPPolicies: MaxTempTableSize
supportedLDAPPolicies: MaxResultSetSize
supportedLDAPPolicies: MaxNotificationPerConn
highestCommittedUSN: 574688
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
dnsHostName: cancan1.domainserver.dom
ldapServiceName: domainserver.dom:cancan1$@DOMAINSERVER.DOM
serverName: CN=CANCAN1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Co
nfiguration,DC=domainserver,DC=dom
supportedCapabilities: 1.2.840.113556.1.4.800
supportedCapabilities: 1.2.840.113556.1.4.1791
isSynchronized: TRUE
isGlobalCatalogReady: TRUE

Appendices
Vulnerability Levels
A Vulnerability is a design flaw or mis-configuration which makes your network (or a host on your network) susceptible to malicious attacks from local or remote users. Vulnerabilities can exist in several areas of your network, such as in your firewalls, FTP servers, Web servers, operating systems or CGI bins. Depending on the level of the security risk, the successful exploitation of a vulnerability can vary from the disclosure of information about the host to a complete compromise of the host.
 
Severity Level Description
1
Minimal Intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities.
2
Medium Intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions.
3
Serious Intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mail-relaying.
4
Critical Intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host.
5
Urgent Intruders can easily gain control of the host, which can lead to the compromise of your entire network security. For example, vulnerabilities at this level may include full read and write access to files, remote execution of commands, and the presence of backdoors.
 

Potential Vulnerability Levels
A potential vulnerability is one which we cannot confirm exists. The only way to verify the existence of such vulnerabilities on your network would be to perform an intrusive scan, which could result in a denial of service. This is strictly against our policy. Instead, we urge you to investigate these potential vulnerabilities further.
 
Severity Level Description
1
Minimal If this vulnerability exists on your system, intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities.
2
Medium If this vulnerability exists on your system, intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions.
3
Serious If this vulnerability exists on your system, intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mail-relaying.
4
Critical If this vulnerability exists on your system, intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host.
5
Urgent If this vulnerability exists on your system, intruders can easily gain control of the host, which can lead to the compromise of your entire network security. For example, vulnerabilities at this level may include full read and write access to files, remote execution of commands, and the presence of backdoors.
 

Information Gathered
Information Gathered includes visible information about the network related to the host, such as traceroute information, Internet Service Provider (ISP), or a list of reachable hosts. Information Gathered severity levels also include Network Mapping data, such as detected firewalls, SMTP banners, or a list of open TCP services.
 
Severity Level Description
1
Minimal Intruders may be able to retrieve sensitive information related to the host, such as open UDP and TCP services lists, and detection of firewalls.
2
Medium Intruders may be able to determine the operating system running on the host, and view banner versions.
3
Serious Intruders may be able to detect highly sensitive data, such as global system user lists.
 

Back Button

R. Kinney Williams & Associates
5704 71st Street
Lubbock, Texas 79424
Office 806-798-7119; Examiner@yennik.com

 All rights reserved; Our logo R. Kinney Williams & Associates is registered with the United States Patent and Trademark Office.
Terms and Conditions, Privacy Statement, Copyright Yennik, Incorporated
VISTA

CONFIDENTIAL AND PROPRIETARY INFORMATION Yennik, Inc. and its testing company (Qualys, Inc.) provide the vulnerability services "As Is" without any warranty of any kind.  Yennik, Inc. and its testing company make no warranty that the vulnerability service will detect every vulnerability in your network, or that the suggested solutions and advice provided in this report, together with the results of the scan, will be error-free or complete.  The Service does not include wireless specific vulnerabilities.  Yennik, Inc. and its testing company shall not be responsible or liable for the accuracy, usefulness, or availability of any information transmitted via the vulnerability service, and shall not be responsible or liable for any use or application of the information contained in this report.  The correctness and completeness of your vulnerability reports is very important to us. If you believe our system made an error in your report, please notify us.