(PVS) Signatures - Tenable Network Security

CVE-2002-0466
Hosting Controller Multiple Script Arbitrary Directory Browsing
PVS ID: 1701 FAMILY: Web Servers RISK: HIGH NESSUS ID:11746
Description: The Hosting Controller application resides on this server. This version is vulnerable to
multiple remote exploits. See
http://archives.neohapsis.com/archives/bugtraq/2002-01/0039.html for more information
Solution: No solution is known at this time.
CVE-2001-0938
Microsoft IIS bdir.htr Directory Listing
PVS ID: 1702 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10577
Description: The file bdir.htr is a default IIS file which can give a malicious user information about your
file system.
Solution: Obtain patch from Microsoft. If not required, delete the file.
CVE Not available
Microsoft IIS 5.0 PROPFIND Remote DoS
PVS ID: 1703 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10667
Description: The remote IIS web server has PROPFIND enabled. There is at least one exploit which
utilizes the PROPFIND vector in order to compromise IIS web servers.
Solution: Use URLSCAN to disable PROPFIND requests. In addition, ensure that your system has
installed all relevant IIS patches.
CVE-2001-0151
Microsoft IIS viewcode.asp Arbitrary File Access
PVS ID: 1704 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:10576
Description: The file viewcode.asp is a default IIS file which can give a malicious user a information
about your file system or source files. Specifically, viewcode.asp can allow a remote user to
potentially read any file on a web server's hard drive.
Solution: Delete the file if not needed, or use suitable access control lists to ensure that the file is not
world-readable.
Family Internet Services 433