PCI-DSS : CVE-2005-4473

Hey,

When we perform a scan "PCI compliant" on our external IP, we have a fail on 2005 items.

But Solarwinds indicates that they are PCI-DSS compliant.

Is it possible to update this by myself or do I have to wait for a new release? It's rather urgent ...

Best Regards

Find more posts tagged with

pci

serv-u

Accepted answers

All comments

josh.d

Is this scanner accessible from the web? I'm not familiar with "JRun"- are you sure you were hitting a serv-u server?

sylvainj

This is a scan from a Qualys appliance (which was scanning our external IPs).
Yes it is indeed the Serv-U server, we only have this FTP / HTTP server on the DMZ IP address (Serv-U DMZ).

josh.d

I looked, and Serv-U does not seem to use JRun. Either I am wrong, the scanner has faulty a fingerprint module, or there is another service on your server. You can see who is listening on what port by running "netstat -ab" or using sysinternals's tcpview.

Adobe doesn't even allow JRun to be sold anymore: Adobe - Macromedia JRun 4: FAQ.

You can also try running the scan against the demo server (note the demo server may not be the most current version):

Serv-U MFT & FTP Demo| Serv-U

What version of serv-u are you running?

sylvainj

When I perform the netstat -ab, for the 443TCP :

It's strange... Only this process.

I'm using Serv-U 15.1.1.108

calc2014

I havent seen this before or heard of JRun but could it be something linked to the Java detection in Serv-U for using Web Client Pro or FTP Voyager JV?

You would need someone from Solarwinds to confirm exactly what is loaded and what might be triggering this, bshopp, can you help?

sylvainj

I opened a ticket to Qualys's PCI-Team.

They are looking for this point...

peter.kruty

Hi Sylvain, I'd be curious to know where you see indication we are PCI compliant, can you direct me please? Thanks!

sylvainj

For sure Peter

FTP Server PCI Compliance | Serv-U

Regards