(PVS) Signatures - Tenable Network Security

PVS ID: 4225 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote server requires authentication for certain resources. Specifically,
the resource "%P" requires user authentication. However, the server does not require a
strong encryption of the passed credentials. Specifically, the server allows clients to send
credentials using HTTP Basic authentication. The client credentials are passed in plaintext
and slightly obfuscated by using base64 encoding. Such encoding is trivial and a passive
attacker with the ability to sniff the traffic can easily gain access to a user's credentials.
Solution: Use SSL or a stronger authentication mechanism.
CVE Not available
Firebird Database Plaintext Password
PVS ID: 4226 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote host appears to be running a Firebird database client. This instance
of the Firebird client allows the passing of confidential data over an unencrypted session.
Given this, an attacker can sniff confidential data such as database name, user ID, or
credentials to gain elevated access to the database. The sniffed account was \n%L
Solution: Require remote clients to use an encrypted session.
CVE Not available
Firebird Database Plaintext Password
PVS ID: 4227 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote host seems to be running a Firebird database server. This instance
of the Firebird server allows the passing of confidential data over an unencrypted session.
An attacker can sniff confidential data such as database name, user ID and credentials to
gain elevated access to the database. The sniffed account was \n%P
Solution: Require remote clients to use an encrypted session.
CVE Not available
Firebird Database Version Detection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4228 FAMILY: Database RISK: INFO NESSUS ID:Not Available
Family Internet Services 1099