27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Description: The remote web server is hosting .conf files. As an example, consider the following file<br />

%P\nDistributing such files over the web can be done, but the webmaster should make sure<br />

that they do not contain confidential data. '.conf' files are typically configuration files that<br />

may contain information regarding local applications and settings.<br />

Solution: Ensure that confidential data is not present within the '.conf' file. Note: <strong>PVS</strong> only reports on<br />

the first occurence of this item on a web server. Parse your entire web source for similar<br />

occurrences.<br />

CVE Not available<br />

Internal IP Address Disclosure<br />

<strong>PVS</strong> ID: 4666 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available<br />

Description: The remote web server has not properly configured its 'Host' settings. The server discloses<br />

its internal IP addresses within HTTP headers. Such information can give an attacker useful<br />

information regarding the IP address scheme of the internal network. This may aid the<br />

attacker in future attacks. The leaked information was: \n %L \n\nThe request that triggered<br />

this response was: \n%P<br />

Solution: Ensure that the server has a properly configured hostname. Note: <strong>PVS</strong> only reports on the<br />

first occurence of this item on a web server. Parse your entire web source for similar<br />

occurrences.<br />

CVE Not available<br />

Persistent Cookie Utilization<br />

<strong>PVS</strong> ID: 4667 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available<br />

Description: The remote web server utilizes persistent cookies. Persistent cookies are stored on the hard<br />

drive by the user browser. If there is confidential data within the cookies (such as user ID,<br />

authentication tokens, etc.), an attacker with access to the hard drive can view this data. The<br />

application that generated this cookie was: \n%P\n\nThe cookie that was passed was: \n %L<br />

Solution: Ensure that persistent cookies are not used for any sort of confidential data. Note: <strong>PVS</strong> only<br />

reports on the first occurence of this item on a web server. Parse your entire web source for<br />

similar occurrences.<br />

CVE Not available<br />

ActiveX Control Detection<br />

<strong>PVS</strong> ID: 4668 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available<br />

Description: The remote web server is hosting content that includes an embedded call to ActiveX. The<br />

CLSID of the ActiveX control is: \n %L \n\nThe control is referenced at the following<br />

location: \n%P<br />

realtimeonly<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 1224

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!