27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Description: The remote web client posted a form with what appears to be an embedded user ID<br />

and password. You should manually verify that confidential data is not being leaked<br />

from the network. The observed POST request was: \n %L<br />

Solution: Ensure that confidential data is not passed via plaintext form fields. Note: <strong>PVS</strong> only reports<br />

on the first occurence of this item on a web server. Parse your entire web source for similar<br />

occurrences.<br />

CVE Not available<br />

Possible User ID and Password Sent Within a Web Form (GET)<br />

<strong>PVS</strong> ID: 4673 FAMILY: Data Leakage RISK: INFO NESSUS ID:Not Available<br />

Description: The remote web client posted a form with what appears to be an embedded user ID<br />

and password. You should manually verify that confidential data is not being leaked<br />

from the network. The observed POST request was: \n %L<br />

Solution: Ensure that confidential data is not passed via plaintext form fields. Use SSL for any type<br />

of authentication. Also, you should consider forcing the use of POST versus GET on web<br />

forms. Note: <strong>PVS</strong> only reports on the first occurence of this item on a web server. Parse<br />

your entire web source for similar occurrences.<br />

CVE Not available<br />

Flash '.swf' File Detection<br />

<strong>PVS</strong> ID: 4674 FAMILY: Policy RISK: INFO NESSUS ID:Not Available<br />

Description: The remote web server is hosting .swf files. As an example, consider the following file<br />

%P\nDistributing such files over the web can be done, but the webmaster should make sure<br />

that they do not contain confidential data. Flash '.swf' files are easily decompiled into<br />

source code using tools such as Flare (www.nowrap.de/flare.html).<br />

Solution: Ensure that confidential data is not present within the '.swf' file. Note: <strong>PVS</strong> only reports on<br />

the first occurence of this item on a web server. Parse your entire web source for similar<br />

occurrences.<br />

CVE Not available<br />

SOAP '.wsdl' File Detection<br />

<strong>PVS</strong> ID: 4675 FAMILY: Policy RISK: INFO NESSUS ID:Not Available<br />

Description: The remote web server is running a SOAP service that is enumerated via a '.wsdl'<br />

configuration file. As an example, consider the following file %P\nDistributing such files<br />

over the web can be done, but the webmaster should make sure that they do not contain<br />

confidential data.<br />

Solution:<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 1226

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!