27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

currently unknown; however, the vendor has released a fix. The reported version of MyBB<br />

is: \n %L<br />

Solution: Upgrade to version 1.4.1 or higher.<br />

CVE-2008-3966<br />

Database Connection Configuration Information Disclosure<br />

<strong>PVS</strong> ID: 4656 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote web application server may be prone to a policy<br />

violation.\n\n<strong>PVS</strong> has just noted a web transaction that included database connection<br />

information. This includes database name, user ID, password and more. The information<br />

resides at the following location: \n%P\n\nThe information that is hosted on the remote web<br />

server includes the following: \n %L >\n\n<br />

Solution: Ensure that such information is not stored or sent in plaintext. Note: <strong>PVS</strong> only reports on<br />

the first occurence of this item on a web server. Parse your entire web source for similar<br />

occurrences.<br />

CVE Not available<br />

Dns2TCP Service Detection<br />

<strong>PVS</strong> ID: 4657 FAMILY: Backdoors RISK: NONE NESSUS ID:Not Available<br />

Description: The remote service supports the DNS-to-TCP protocol. This protocol hides network traffic<br />

protocols by embedding the traffic within seemingly innocuous DNS queries. This service<br />

can be used to bypass firewalls or proxies by obfuscating the true protocol within the DNS<br />

protocol. The configured 'zone' for the Dns2TCP server is '%P'<br />

Solution: Ensure that such services are allowed according to network policies and guidelines. Limit<br />

incoming traffic to this port if desired.<br />

CVE Not available<br />

Database Connection Configuration Information Disclosure<br />

<strong>PVS</strong> ID: 4658 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote web application server may be prone to a policy<br />

violation.\n\n<strong>PVS</strong> has just noted a web transaction that included database connection<br />

information. This includes database name, user ID, password and more. The information<br />

resides at the following location: \n%P\n\nThe information that is hosted on the remote web<br />

server includes the following: \n %L >\n\n<br />

Solution:<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 1221

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!