27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

arbitrary code.<br />

Solution: Upgrade to version 8.1.0178 or higher.<br />

CVE-2007-2931<br />

Subversion (SVN) < 1.4.5 Directory Traversal Privilege Escalation<br />

<strong>PVS</strong> ID: 4198 FAMILY: Generic<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote<br />

host is running Subversion, an open-source file management product. According to the<br />

version number, the remote system is reported to be vulnerable to a flaw where<br />

authenticated users can write to files outside the Subversion folders. By prepending '../' to a<br />

file name, an attacker can overwrite sensitive system files that may then be executed by a<br />

SYSTEM process. Given this, successful exploitation would likely result in the attacker<br />

gaining elevated access to the server hosting Subversion.<br />

Solution: Upgrade to version 1.4.5 or higher.<br />

CVE-2007-3846<br />

Yahoo! Messenger < 8.1.0.419 YVerInfo ActiveX Buffer Overflow<br />

<strong>PVS</strong> ID: 4199 FAMILY: Internet Messengers RISK: HIGH NESSUS ID:25955<br />

Description: Synopsis :\n\nThe remote Windows host has an ActiveX control that is affected by a buffer<br />

overflow vulnerability.\n\n The remote host contains the 'YVerInfo' ActiveX control,<br />

distributed as part of the Yahoo! services suite typically downloaded with the installer for<br />

Yahoo! Messenger. The version of this control installed on the remote host reportedly<br />

contains a boundary error. If an attacker can trick a user on the affected host into visiting a<br />

specially-crafted web page, he may be able to leverage this issue to execute arbitrary code<br />

on the host subject to the user's privileges.<br />

Solution: Either disable the use of this ActiveX control from within Internet Explorer by setting its<br />

'kill' bit or upgrade to Yahoo! Messenger version 8.1.0.419 (version 2007.8.27.1 of the<br />

YVerInfo control itself) or higher.<br />

CVE-2007-4515<br />

EnterpriseDB Advanced Server Version Detection<br />

<strong>PVS</strong> ID: 4200 FAMILY: Database RISK: INFO NESSUS ID:Not Available<br />

Description: The remote host is running EnterpriseDB Advanced Server version: \n %L<br />

Solution: N/A<br />

CVE Not available<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 1091

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!