(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
host is running Plain Old Webserver (POW), a Firefox plugin that allows the user to run a
web server via a browser plugin. This version of POW is vulnerable to a directory traversal
flaw. An attacker exploiting this flaw would send a malformed request that contained '../'
strings. Such a request would allow the attacker to obtain confidential files from outside the
web root directory. Successful exploitation would lead to the loss of confidential data.
Solution: Upgrade to version 0.0.9 or higher.
CVE-2007-0872
Mercury LoadRunner Detection
PVS ID: 3911 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is running Mercury's LoadRunner. This tool is used to manage and test
network applications. In the past, LoadRunner has been vulnerable to remote attacks. The
following information was culled from the Agent:\n\n%L
Solution: Ensure that you are running the latest version of LoadRunner and consider using ACLs to
ensure that untrusted hosts cannot connect to the LoadRunner application.
CVE Not available
Cisco VPN Server Detection (PPTP)
PVS ID: 3912 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote Cisco server is acting as a PPTP VPN server.
Solution: N/A
CVE Not available
Cisco VPN Concentrator Administrative Interface Detection
PVS ID: 3913 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote Cisco server is acting as a PPTP VPN server. Further, the server
has enabled web administration over unencrypted HTTP. The VPN Concentrator handles
user accounts and other confidential data. An attacker with the ability to sniff the network
would be able to gather confidential data that would be useful in future attacks. The
reported machine name is:\n\n%L
Solution: Use Access Control Lists (ACLs) to block access from untrusted machines. In addition,
force the communication over an SSL connection.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1013