(PVS) Signatures - Tenable Network Security

PVS ID: 2147 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running a version of the Easy File Share Web
Server that is vulnerable to an information disclosure vulnerability. It is reported that in
versions up to 1.25, an attacker may obtain read access to the server underlying filesystem
using virtual folders URLs.
Solution: No solution is known at this time.
CVE-2004-1743
Easy File Sharing Large HTTP Request Remote DoS
PVS ID: 2148 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running a version of the Easy File Sharing Web Server that is vulnerable to
an remote denial of service. An attacker may deny service to legitimate users by sending
large HTTP request to the web server. When processing such requests, this service
consumes CPU resources exponentially.
Solution: No solution is known at this time.
CVE-2004-1744
PHP Code Snippet Library index.php XSS
PVS ID: 2149 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe
remote host is running a version of PHP-CSL that is reported prone to a cross-site scripting
vulnerability. An attacker may steal cookie-based authentication credentials from a
legitimate user using crafted link to this web application.
Solution: No solution is known at this time.
CVE-2004-1746
Outlook Express BCC: Recipient Disclosure
PVS ID: 2150 FAMILY: SMTP Clients
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote email client is vulnerable to a flaw where the 'BCC' address is
not hidden.\n\nThe remote host is using Outlook Express version 6.00 or 6.00 SP1. It is
reported that the effectiveness of the BCC: field in these versions cannot be trusted. People
receiving the mail through the To: and CC: fields can find the invisible receipients by
opening the mail in a text editor.
Family Internet Services 536