(PVS) Signatures - Tenable Network Security

CVE Not available
VMWare Server Plaintext Authorization
PVS ID: 4288 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote host is running VMWare server, an application that allows users to
run multiple operating systems virtually. Futher, this instance of VMWare is a server
application that allows remote administrator access to the VMWare console. The displayed
banner is '%L'\nThis version of VMWare Server allows authentication without SSL.
Sending credentials in plaintext allows passive attackers to either execute
man-in-the-middle attacks or sniff the credentials while in transit.
Solution: Newer versions of the VMware Authentication daemon can be configured to only accept
authentication over SSL.
CVE Not available
LIVE555 Media Server < 2007.11.18 DoS
PVS ID: 4289 FAMILY: Generic RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running LIVE555 Media Server, a media streaming server. The version of
LIVE55 installed on the remote host is vulnerable to a denial of service attack when sent a
request of less than 8 bytes. An attacker exploiting this flaw would only need the ability to
connect to the RTSP server via the network. Successful exploitation would result in the
service crashing.
Solution: Upgrade to version 2007.11.18 or higher.
CVE-2007-4561
Ability Mail Server < 2.61 Multiple Vulnerabilities
PVS ID: 4290 FAMILY: IMAP Servers
RISK:
MEDIUM
NESSUS ID:28289
Description: Synopsis :\n\nThe remote mail server is affected by multiple denial of service
vulnerabilities.\n\n The remote host appears to be running Ability IMAP Server. According
to its banner, the installed version of Ability Mail Server is affected by two issues that
could cause the application to crash. One involves messages that are changed to a blank
string, the other concerns IMAP4 commands with malformed number list ranges. It is not
currently known whether either or both issues can be exploited without authentication.
Solution: Upgrade to version 2.61 or higher.
CVE-2007-6101
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1116