27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>PVS</strong> ID: 4343 FAMILY: Generic RISK: INFO NESSUS ID:Not Available<br />

Description: Synopsis :\n\nAn asset management server is running on the remote host.\n\n The remote<br />

service is a netOctopus Server, the server component of the netOctopus asset management<br />

software suite.<br />

Solution: Filter incoming traffic to this port.<br />

CVE Not available<br />

QuickTime < 7.4 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 4344 FAMILY: Web Clients RISK: HIGH NESSUS ID:29982<br />

Description: Synopsis : \n\nThe remote host contains an application that is affected by multiple<br />

vulnerabilities.\n\n The version of QuickTime installed on the remote host is older than 7.4.<br />

Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary<br />

code on the remote host if a user opens a specially-crafted movie or PICT file with<br />

QuickTime. The installed version of QuickTime is: \n %L<br />

Solution: Upgrade to version 7.4 or higher.<br />

CVE-2008-0036<br />

WinErr Messages OS Detection<br />

<strong>PVS</strong> ID: 4345 FAMILY: Operating System Detection RISK: INFO NESSUS ID:Not Available<br />

Description: According to the Windows error report that was just sent to watson.microsoft.com, the<br />

remote host is running Microsoft operating system version %L<br />

Solution: N/A<br />

CVE Not available<br />

MyBB < 1.2.11 forumdisplay.php sortby Parameter Command Execution<br />

<strong>PVS</strong> ID: 4346 FAMILY: CGI RISK: HIGH NESSUS ID:29996<br />

Description: Synopsis :\n\nThe remote web server contains a PHP script that allows arbitrary command<br />

execution.\n\n The version of MyBB installed on the remote host fails to sanitize input to<br />

the 'sortby' parameter of the 'forumdisplay.php' script before using it in an 'eval()' statement<br />

to evaluate PHP code. An unauthenticated attacker can leverage this issue to execute<br />

arbitrary code on the remote host subject to the privileges of the web server user ID. In<br />

addition, this version of MyBB is vulnerable to several SQL injection attacks that, if<br />

exploited, would give the attacker the ability to execute arbitrary SQL commands on the<br />

database server utilized by MyBB.<br />

Solution: Upgrade to version 1.2.11 or higher.<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 1132

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!