(PVS) Signatures - Tenable Network Security

Finjan SurfinGate Proxy FHTTP Command Admin Functions Authentication Bypass
PVS ID: 1169 FAMILY: Web Servers RISK: HIGH NESSUS ID:12036
Description: Synopsis :\n\nThe remote proxy can be tricked into executing commands\n\nThe remote
host is running a Finjan proxy. It may be possible to use this proxy and force it to connect
to itself, to then issue administrative commands to this service. An attacker may use this
flaw to force this proxy to restart continuously, although other administrative commands
might be executable.
Solution: Block all connections to '*:ControlPort'
CVE-2004-2107
PPTP Set-Link-Info - Setup of PPTP VPN Channel Detection
PVS ID: 1170 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running client software which may be considered
questionable\n\nThe remote host has created a PPTP VPN connection. You should ensure
that this sort of connection is authorized within existing Company guidelines or policies.
Solution: Block port 1723 and ensure this connection is authorized.
CVE Not available
HTTP Based ZIP File Download Detection
PVS ID: 1171 FAMILY: Web Clients RISK: LOW NESSUS ID:Not Available
Description: An HTTP transfer of a file compressed with the ZIP algorithm was just observed. This file
may contain malicious code, or content that may not be subjected to any content filtering in
place. However, if the host attempting the download is a web server, email server or other
server, this behavior may be indicative of a system compromise.
Solution: Block all HTTP requests with content type: application/zip, and ensure a content filtering
system is in place that handles ZIP compressed files.
CVE Not available
LDAP Server NULL Bind Detection
PVS ID: 1172 FAMILY: Generic
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:10723
Description: Synopsis :\n\nThe remote LDAP server allows NULL connections\n\nThe remote server is
an LDAP server. Further, it appears as if the server allows NULL BIND requests. If this is
an internal server, then this is considered an acceptable configuration.
Solution: Ensure that this server is authorized with respect to Corporate standards and policies.
Family Internet Services 298