(PVS) Signatures - Tenable Network Security

Description: Synopsis:\n\nThe remote web server is affected by an access restriction bypass
vulnerability.\n\nThe remote host is running a nginx HTTP server. For your information,
the observed version of nginx is:\n %L \n\n Versions earlier than 1.2.1(stable version) or
versions earlier than 1.3.1(development version) are vulnerable to an access restriction
bypass vulnerability.\nBy using a request with a specially crafted directory name, such as
'/directory::$index_allocation' in place of '/directory', an attacker may be able to bypass
access restrictions.\nNote that this vulnerability only affects installs on Windows.
(CVE-2012-4963)
Solution: Upgrade to nginx 1.2.1(stable version) or 1.3.1(development version) or later.
CVE-2011-4963
PHP 5.4.x < 5.4.5 _php_sream_scandir Overflow
PVS ID: 6530 FAMILY: Web Servers RISK: HIGH NESSUS ID:60086
Description: Synopsis :\n\nThe remote web server uses a version of PHP that is affected by an overflow
vulnerability.\n\nFor your information, the version of PHP installed on the remote host is
:\n %L \n\nPHP versions earlier than 5.4.5 are affected by the following vulnerabilities.\n\n
- An unspecified overflow vulnerability in the function '_php_stream_scandir' in the file
'main/streams/streams.c'\n
Solution: Upgrade to PHP version 5.4.5 or later.
CVE-2012-2688
Android Mobile Device App Download Detection
PVS ID: 6531 FAMILY: Mobile Devices RISK: INFO NESSUS ID:Not Available
Description: The remote host is an Android mobile client which has just downloaded the following
software : %L
Solution: N/A
realtimeonly
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Detection of uploading a file to scribd.com - (HTML method)
PVS ID: 6532 FAMILY: Internet Services RISK: INFO NESSUS ID:Not Available
Description: The remote host has uploaded a file to scribd.com via their HTML uploader. Scridb is the
world's largest online library where one can share, view, and dowload documents across
web and mobile clients.
Solution: Ensure that such usage is in aligment with Corporate policy
Family Internet Services 1786