(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running the Google Urchin web application. The
reported version is '%L'\nThis version of Urchin is reported prone to a flaw where an
attacker can gain administrative access to the application. The 'report.cgi' script fails to
adequately verify that the user is authorized. An attacker exploiting this flaw would be able
to perform some subset of administrative duties without authentication.
Solution: Upgrade to a version of Urchin higher than 5.7.03.
CVE-2007-5113
Winamp < 5.5 libFLAC Integer Overflow
PVS ID: 4243 FAMILY: Generic RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running Winamp, a multi-media software application. This version of Winamp includes a
library that is reported to be prone to a remote integer overflow. An attacker exploiting this
flaw would need to be able to convince a Winamp user to open a file with malformed
FLAC data. Successful exploitation would result in the attacker executing arbitrary code on
the remote client system.
Solution: Upgrade to version 5.5 or higher.
CVE-2007-4619
Avocent KVM Appliance Detection
PVS ID: 4244 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is running an Avocent Enterprise KVM appliance. This appliance
allows remote users to manage their network servers remotely.
Solution: N/A
CVE Not available
Apache Tomcat < 6.0.15 WEBDAV Lock Request Information Disclosure
PVS ID: 4245 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server can be manipulated to disclose confidential
data.\n\nThe remote host is running a version of Tomcat server less than 6.0.15. This
version of Tomcat is vulnerable to a flaw in the way that it parses WEBDAV 'lock'
requests. Specifically, if the lock request references an external file, Tomcat will
retrieve the file. This could lead to information disclosure of potentially confidential
data. An attacker exploiting this flaw would need to have the ability to authenticate
to the Tomcat server.
Solution: Upgrade to version 6.0.15 or higher.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1104