(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host may be tricked into running an executable file\n\nThe
version of Skype installed on the remote host is vulnerable to a flaw wherein specially
formatted 'file://' URI will allow the download and execution of executable files. An
attacker, exploiting this flaw, would need to be able to coerce a user into browsing a
malicious URI. Successful exploitation would result in the attacker executing arbitrary
code.
Solution: Upgrade to Skype release 3.8.0.139.
CVE-2008-1805
Sun-One ASP Server Version Detection
PVS ID: 4532 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the Sun-One ASP server version: \n %L
Solution: N/A
CVE Not available
Sun Java System ASP < 4.0.3 Multiple Vulnerabilities
PVS ID: 4533 FAMILY: Web Servers RISK: HIGH NESSUS ID:33439
Description: Synopsis :\n\nThe remote web server is affected by several vulnerabilities.\n\nThe remote
host is running Sun Java System Active Server Pages (ASP), or an older variant such as
Sun ONE ASP or Chili!Soft ASP. The web server component of the installed version of
Active Server Pages on the remote host is affected by several vulnerabilities :\n\n - A flaw
in an include file used by several of the administration server's ASP applications allows an
attacker to write arbitrary data to a file specified by an attacker on the affected host. This
issue does not affect ASP Server on a Windows platform (CVE-2008-2401).\n - Password
and configuration data are stored in the administration server's web root and can be
retrieved without credentials. This issue does not affect ASP Server on a Windows platform
(CVE-2008-2402).\n - Multiple directory traversal vulnerabilities exist in several of the
administration server's ASP applications can be abused to read or even delete arbitrary files
on the affected host. This issue does not affect ASP Server on a Windows platform
(CVE-2008-2403).\n - A stack buffer overflow allows code execution in the context of the
ASP server (by default root) and can be exploited without authentication
(CVE-2008-2404).\n - Several of the administration server's ASP applications fail to filter
or escape user input before using it togenerate commands before executing them in a shell.
While access to these applications nominally requires authentication, there are reportedly
several methods of bypassing authentication (CVE-2008-2405).\nIAVA Reference :
2008-A-0038\nSTIG Finding Severity : Category I
Solution: Upgrade to Sun Java System ASP version 4.0.3 or later.
CVE-2008-2405
CA eTrust SCM Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1184