1. Introduction
This report details the vulnerability “Asset Attribute: Fully Qualified Domain Name (FQDN)”. This involves reporting the FQDN for a remote host, which can be used in reconnaissance to identify systems on a network. It has an Info severity level and primarily impacts confidentiality by revealing system names.
2. Technical Explanation
This vulnerability reports internal tags associated with the Fully Qualified Domain Name (FQDN) of a remote host. There is no exploitation path as this plugin only gathers information; it does not actively exploit any weaknesses. The precondition for reporting is simply network connectivity to the target host.
- Root cause: The plugin successfully retrieves and reports internal tags associated with the FQDN.
- Exploit mechanism: There is no exploit mechanism as this vulnerability is informational only.
- Scope: All systems with a resolvable Fully Qualified Domain Name (FQDN) are potentially affected.
3. Detection and Assessment
Confirming whether the system is reporting its FQDN requires checking if the plugin has successfully gathered the information. A thorough method involves reviewing the scan results for the presence of FQDN data.
- Quick checks: No direct quick check exists as this vulnerability reports existing data, it does not expose a setting.
- Scanning: N/A – This is an informational report and doesn’t have signature IDs.
- Logs and evidence: Review scan logs for the presence of FQDN entries associated with scanned hosts.
4. Solution / Remediation Steps
There are no remediation steps required as this vulnerability is informational only and does not indicate a security flaw. The report simply provides data about the system’s FQDN.
4.1 Preparation
- No backups or snapshots are needed, and no services need to be stopped.
- There are no dependencies or pre-requisites. A roll back plan is not required as there are no changes being made.
- Change window needs and approvals are not relevant.
4.2 Implementation
- No implementation steps are needed.
4.3 Config or Code Example
Before
After
4.4 Security Practices Relevant to This Vulnerability
No security practices directly address this vulnerability type as it is informational only.
- Practice 1: N/A
- Practice 2: N/A
4.5 Automation (Optional)
Automation is not applicable for this informational report.
5. Verification / Validation
- Post-fix check: No change in output is expected, as this vulnerability does not require a fix.
- Re-test: Re-run the scan and verify that FQDN data is still present.
- Smoke test: N/A
- Monitoring: N/A
6. Preventive Measures and Monitoring
No preventive measures or monitoring are relevant to this vulnerability type as it is informational only.
- Baselines: N/A
- Pipelines: N/A
- Asset and patch process: N/A
7. Risks, Side Effects, and Roll Back
There are no risks or side effects associated with this informational report. A roll back is not required as there were no changes made.
- Risk or side effect 1: N/A
- Risk or side effect 2: N/A
- Roll back: No steps are needed.
8. References and Resources
No specific references are available for this informational report.
- Vendor advisory or bulletin: N/A
- NVD or CVE entry: N/A
- Product or platform documentation relevant to the fix: N/A