27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

thttpd < 2.05 If-Modified-Since Header Remote Overflow<br />

<strong>PVS</strong> ID: 1469 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:10286<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote thttpd<br />

server is vulnerable to a stack overflow when it is issued a malformed HTTP header. An<br />

attacker may use this bug to run arbitrary code on the remote server, with the privileges of<br />

the thttpd daemon (typically root or nobody).<br />

Solution: Upgrade to thttpd 2.05 or higher.<br />

CVE-2000-0359<br />

SWAT Server Detection<br />

<strong>PVS</strong> ID: 1470 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:10273<br />

Description: The remote host is running SWAT (Samba Web Administration Tool). SWAT allows<br />

Samba users to change their passwords and provides the system administrator with an<br />

easy-to-use web interface to configure Samba. It is not recommended to let SWAT be<br />

accessed by the world, as it allows an intruder to attempt to brute force some account<br />

passwords. In addition to this, the traffic between SWAT and the web client is not ciphered,<br />

so an eavesdropper can gain cleartext passwords easily.<br />

Solution: Disable SWAT once your Samba server is configured.<br />

CVE-2000-0935<br />

Sun Cobalt Adaptative Firewall Detection<br />

<strong>PVS</strong> ID: 1471 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Sun Cobalt hosts contain a firewall mechanism, which can be configured remotely using<br />

Cobalt's built-in HTTP server. To access it, a user simply has to enter a passphrase which<br />

could possibly be brute-forced.<br />

Solution: Block incoming connections to this port<br />

CVE Not available<br />

StrongHold Web Server Detection<br />

<strong>PVS</strong> ID: 1472 FAMILY: Web Servers<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:11230<br />

Description: The remote host seems to be running the StrongHold web server. This server comes with a<br />

sample script (swish) which allows a user to obtain the physical path to the remote webroot<br />

directory. It may also display system-specific information about the remote host. Note: The<br />

Family Internet Services 379

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!