(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is running client software that may be considered
questionable.\n\nThe remote server is running a MetaSploit Framework server. Metasploit
allows users to easily exploit and backdoor vulnerable applications via the network. The
fact that there is one running on your network may be indicative of a penetration testing
team or malicious individual exploiting weaknesses on the network.\nFor your information,
the remote server is running %L
Solution: Ensure that this server is sanctioned by policy and guidelines regarding acceptable
network usage.
CVE Not available
Courier IMAP Server < 3.0.7 Multiple Vulnerabilities
PVS ID: 1210 FAMILY: IMAP Servers RISK: HIGH NESSUS ID:12103
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow\n\nThe remote mail server
is the Courier-IMAP imap server. Versions of Courier-IMAP prior to 3.0.7 are prone to a
remote buffer overflow and a remote format string vulnerability.
Solution: If applicable, upgrade to Courier-Imap 3.0.7 or later.
CVE-2004-0777
HP Jet Admin 7.x Traversal Arbitrary Command Execution
PVS ID: 1211 FAMILY: Web Servers RISK: LOW NESSUS ID:12120
Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw\n\nThe remote
host is an HP Web JetAdmin server. 7.X versions of this server are vulnerable to a
directory traversal attack which can reveal the contents of arbitrary files, or be used to
execute arbitrary commands.
Solution: Set a password for the JetAdmin and ensure that you are running the latest version of the
Webserver software. In addition, the device supports IP-based Access Control Lists (ACLs)
which can be used to restrict access to only valid administrators.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Squid Proxy < 2.5.STABLE6 %xx URL Encoding ACL Bypass
PVS ID: 1212 FAMILY: Web Servers RISK: HIGH NESSUS ID:12124
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows for the bypassing of
authentication\n\nThe remote squid caching proxy, according to its version number, is
vulnerable to a flaw that may allow an attacker to gain access to unauthorized resources.
The flaw in itself consists of sending a malformed username containing the %00 (null)
character, that may allow an attacker to access otherwise restricted resources.
Solution: Upgrade to squid 2.5.STABLE6 or later.
Family Internet Services 308