(PVS) Signatures - Tenable Network Security

PVS ID: 1444 FAMILY: Web Servers RISK: HIGH NESSUS ID:10447
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows for the bypassing of
authentication.\n\nThe remote web server is running a version of Zope which is older than
2.1.7. There is a security problem in all the releases older than 2.1.7 which may allow the
content of DTMLDocuments (or DTMLMethods) to be changed by any user without
authentication.
Solution: Upgrade to Zope 2.1.7 or higher.
CVE-2000-0483
Zope < 2.2.5 Multiple Vulnerabilities
PVS ID: 1445 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10702
Description: Synopsis :\n\nThe remote web server contains an application server that fails to protect
stored content from modification by remote users.\n\nAccording to its banner, the remote
web server is Zope < 2.2.5. Such versions suffer from security issues involving incorrect
protection of a data updating method on Image and File objects. Because the method is not
correctly protected, it is possible for users with DTML editing privileges to update the raw
data of a File or Image object via DTML even though they do not have editing privileges
on the objects themselves.
Solution: Upgrade to Zope 2.2.5 or higher.
CVE-2000-0483
Zope < 2.3.3 ZClass Permission Mapping Modification Local Privilege Escalation
PVS ID: 1446 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10777
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows for the bypassing of
authentication.\n\nThe remote web server is a version of Zope which is older than 2.3.3.
There is a security issue in all releases prior to version 2.3.3 which allow any user to visit a
ZClass declaration and change its permission mappings for methods and other objects
defined within the ZClass, possibly allowing unauthorized access within the Zope instance.
Solution: Update to Zope 2.3.3 or higher.
CVE-2001-0567
Zeus < 3.3.5a Web Server Null Byte Request CGI Source Disclosure
PVS ID: 1447 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:10327
Family Internet Services 372