(PVS) Signatures - Tenable Network Security

executable files downloaded from a site if that site is in an IE7 zone with 'Launching
applications and unsafe files' set to 'Enable' or an IE6 'Local intranet ' / ' Trusted sites' zone
(CVE-2008-2306).\n - There is a memory corruption issue in WebKit's handling of
JavaScript arrays that could be leveraged to crash the application or execute arbitrary code
if visiting a malicious site (CVE-2008-2307).\n - When handling an object with an
unrecognized content type, Safari does not prompt the user before downloading the object
(aka, the 'carpet-bombing' issue). If the download location is the Windows Desktop (the
default), this could lead to arbitrary code execution (CVE-2008-2540).\nIAVT Reference :
2009-T-0021\nSTIG Finding Severity : Category II
Solution: Update to version 3.1.2 or higher.
DC++ Client Detection
CVE-2008-2540
PVS ID: 4557 FAMILY: Policy RISK: INFO NESSUS ID:Not Available
Description: The remote host is running DC++, an open source peer-to-peer client. The reported version
is: \n %L
Solution: Ensure that this application is authorized according to corporate policy.
CVE Not available
Kismet Server Information Disclosure
PVS ID: 4558 FAMILY: Policy
RISK:
MEDIUM
NESSUS ID:33257
Description: Synopsis :\n\nIt is possible to collect information from the remote wireless monitoring
service.\n\nThe remote host is running a Kismet server and allows clients to use it to
monitor wireless activity. An anonymous attacker may use the information collected to
enumerate a network.
Solution: Limit incoming traffic to this port if and, if appropriate, do not allow clients to list WEP
keys.
CVE Not available
WebGUI < 7.5.13 RSS Feed Authentication Bypass
PVS ID: 4559 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running WebGUI, a content management framework.
The remote version of this software is vulnerable to a flaw in the way that it handles access
to data. Protected data can be accessed by requesting the data within an RSS feed. An
attacker exploiting this flaw would only need the ability to request an RSS subscription.
Family Internet Services 1191