(PVS) Signatures - Tenable Network Security

CVE-2001-0098
WebLogic Internal Management Servlet Authentication Bypass
PVS ID: 1455 FAMILY: Web Servers RISK: HIGH NESSUS ID:11486
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows for the bypassing of
authentication.\n\nThe remote web server is an unpatched version of WebLogic. This
version has an internal management servlet which does not properly check the user
credentials and can be accessed from the outside, allowing an attacker to change the
passwords of the users or even to upload or download any file on the remote server.
Solution: Apply SP2 rolling patch 3 on WebLogic 6.0, service pack 4 on WebLogic 6.1 and SP2 on
WebLogic 7.0
CVE-2003-0151
vqServer < 1.9.30 Directory Traversal File Access
PVS ID: 1456 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
web server (vqServer) is vulnerable to a directory traversal bug which may allow attackers
to read arbitrary files on the remote host.
Solution: Upgrade to version 1.9.30 or higher.
CVE-2000-0240
VisualRoute Web Server Detection
PVS ID: 1457 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10744
Description: Synopsis :\n\nThe remote application allows attackers to 'bounce' attacks against other
networks.\n\nThe remote host is running VisualRoute, a web server allowing anyone to
perform a traceroute interactively. An attacker may use this interface to perform traceroutes
on third party hosts without being noticed, therefore using a VisualRoute server as a relay
for their discoveries.
Solution: Disable this server if you do not use it, or block its access on the firewall
CVE Not available
Vignette StoryServer Cross-user Session Information Disclosure
PVS ID: 1458 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:11526
Family Internet Services 375