Help with PCI compliance | SMTP SSL | Courier IMAP | Port 3306

[Deoxymono]

Info: Parallels Plesk Panel v10.3.1 / OS: CentOS 5

Hello, I need some help with PCI compliance on a VPS. I've already fixed a few different problems, yet could do with help/clarification on the following scan failings by SecurityMetrics as its starting to give me a headache

---------------------------
1st Failure:

Protocol: TCP | Port: 143 | Program: imap | Score: 7.5

Summary:

Title: possible format string vulnerability in Courier IMAP Impact: A remote attacker could execute arbitrary commands.

Resolution: [http://www.courier-mta.org/download.php#imap] Upgrade to Courier IMAP 3.0.4 or higher, or set DEBUG_LOGIN equal to the default value of 0 in the IMAP configuration file, which is typically located in /usr/lib /courier-imap/etc/imapd.

2nd Failure:

Protocol: TCP | Port: 465 | Program: urd | Score: 5.0

Summary:

Description: SSL Certificate Expiry Synoposis: The remote server's SSL certificate has already expired.

Impact: This script checks expiry dates of certificates associated with SSL- enabled services on the target and reports whether any have already expired.

Resolution: Purchase or generate a new SSL certificate to replace the existing one.

3rd Failure:

Protocol: TCP | Port: 3306 | Program: N/A | Score: 4.0

Summary:

Title: Open MySQL database port Synoposis: An open MySQL database port was detected Impact: Open MySQL database port

Resolution: Disable public facing access to your MySQL database If you feel that you have received this notice in error, please contact SecurityMetrics support.

4th Failure:

Protocol: TCP | Port: 3306 | Program: N/A | Score: 4.0

Summary:

Title: Possible internet facing database on port 3306 Impact: Attackers could gain access to the database.

Resolution: Ensure that you absolutely need this available to the internet, or that the service is not available over the internet. Make sure the software is up to date.
---------------------------------------

Many thanks in advance to anyone who can help

 

[IgorG]

Did you apply all recommendations from http://download1.parallels.com/Plesk/PP10/10.4/Doc/en-US/online/plesk-pci-compliance-guide/ ?
Why you do not use latest version of Plesk?

 

[Deoxymono]

Well I managed to sort all problems apart from the Courier IMAP one which I believe is a false positive anyway.

For the expired SSL I simply created a new self-signed one and replaced it. And for the accessible port 3306, I simply blocked access using the firewall.

I have checked and the server is running courier-imap version 3.0.8 (which is higher than required), also DEBUG_LOGIN=0 is already enabled in the imapd file. I ran the following commands:

yum list installed | grep courier-imap
grep DEBUG_LOGIN /etc/courier-imap/imapd

and have sent the log file to SecurityMetrics to prove they are flagging a false-positive. Hopefully they will override the failed scan.

In reply to IgorG:

I believe I have already applied all recommendations at http://download1.parallels.com/Plesk/PP10/10.4/Doc/en-US/online/plesk-pci-compliance-guide/ sometime in the past (also I don't see any fixes which would help me with the above failings).

I haven't upgraded plesk as I was slightly worried it would overwrite previous adjustments I had made for PCI compliance on the server. I will upgrade once this scan is passed.