Re: Vulnerability scanning

[Stuart MacIntosh <stuart@xxxxxxxxxxxx>]

I've used Nessus although not with IBM i. Some of the issues it found 
were irrelevant due to incorrect OS detection, did it detect the OS 
correctly?

In my experience simply scanning some TCP/IP stacks/hosts with Nessus 
was enough to reproduce issues with them or break applications. Nessus 
is thorough and finds a lot. It finds too much sometimes, and there are 
false positives to omit from reporting, conversely it may also miss 
things especially for a niche OS like IBM i.

-Stuart

On 14/08/24 03:52, DEnglander--- via MIDRANGE-L wrote:
> Does anyone use the Nessus vulnerability scanning software?
>
> We have scanned our IBM i servers and the software is detecting a TCP/IP
> vulnerability. I have created a case with IBM and they said that the
> TCP/IP stack the vulnerability is referencing is not used by IBM.
>
> Has anyone else experienced this?
>
> Thank you
>
> Doug
>
>
>
> "CONFIDENTIALITY NOTICE:  This e-mail transmission (and/or the attachments accompanying it) contain confidential information belonging to the sender.  The information is intended only for the use of the intended recipient.  If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of the information is strictly prohibited.  Any unauthorized interception of this transmission is illegal under the law.  If you have received this transmission in error, please promptly notify the sender by reply e-mail, and then destroy all copies of the transmission."