信息系统评估风险分析

制定医保网对医保服务器的访问策略可在医保服务器上加装放火墙软件来实现对从医保网来的访问控制制定加强医保服务器和内网连接的访问控制策略通过改变网络拓扑在医保服务器和内网间配置硬件防火墙，或通过内网核心交换机实现对医保服务器的访问控制。192.168.0.70、192.168.0.60、192.168.100.150、192.168.100.102、192.168.0.102192.168.4.1、192.168.0.56、192.9.200.130、192.9.200.133、192.168.4.100、192.168.0.60192.168.0.56、192.168.0.60、192.168.100.102、192.168.100.102、192.168.0.102192.168.0.56、192.168.0.60192.168.4.1192.168.0.16、192.168.0.24、192.168.5.2、192.168.4.1、、192.9.200.133、192.168.0.60、192.168.0.165等linevty04passwordxxxxxlogin删除cisco交换机全部已有SNMP只读及读写密码使用以下命令，删除SNMP只读及读写密码：修改cisco交换机SNMP只读及读写密码使用以下命令，修改SNMP只读及读写密码：修改SNMP只读及读写密码使用以下命令，修改SNMP只读及读写密码：Defaultpassword'root'foraccount'root'

Theaccount'root'hasthepassword'root'.Anattackermayuseitto

gainfurtherprivilegesonthissystem

Riskfactor:High

Solution:Setapasswordforthisaccountordisableit

CVE:CVE-1999-0502

NessusID:Apache<1.3.41MultipleVulnerabilities

Synopsis:

Theremotewebservermaybeaffectedbyseveralissues.

Description:

Accordingtoitsbanner,theversionofApache1.3installedonthe

remotehostisolderthan1.3.41.Suchversionsmaybeaffectedby

severalissues,including:

-Adenialofserviceissueinmod_proxywhenparsing

date-relatedheaders(CVE-2007-3847).

-Across-sitescriptingissueinvolvingmod_imagemap

(CVE-2007-5000).

-Across-sitescriptingissueinmod_statusinvolving

therefreshparameter(CVE-2007-6388).

-Across-sitescriptingissueusingUTF-7encoding

inmod_proxy_becauseitdoesnot

defineacharset(CVE-2008-0005).

Notethattheremotewebservermaynotactuallybeaffectedbythese

vulnerabilities.Nessusdidnottrytodeterminewhethertheaffected

modulesareinuseortocheckfortheissuesthemselves.Oracletnslsnrsecurity

Synopsis:

Theremotedatabaseserviceisnotpassword-protected.

Description:

TheremoteOracleListenerProgram(tnslsnr)hasnopasswordassigned.

Anattackermayusethisfacttoshutitdownarbitrarily,thus

preventinglegitimateusersfromusingit.12OracleDBS_SCHEDULERvulnerability

TheremoteOracleDatabase,accordingtoitsversionnumber,

isvulnerabletoaremotecommandexecutionvulnerabilitywhichmayallow

anattackerwhocanexecuteSQLstatementswithcertainprivilegesto

executearbitrarycommandsontheremotehost.

Solution:

RiskFactor:High1OracleDatabase8i/9iMultipleDirectoryTraversalVulnerabilities

Synopsis:

Theremotedatabaseserverisaffectedbydirectorytraversalflaws.

Description:

Accordingtoitsversionnumber,theinstallationofOracleonthe

remotehostisreportedlysubjecttomultipledirectorytraversal

vulnerabilitiesthatmayallowaremoteattackertoread,write,or

renamearbitraryfileswiththeprivilegesoftheOracleDatabase

server.AnauthenticatedusercancraftSQLqueriessuchthatthey