27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE-2004-0903<br />

SnipSnap < 1.0b1 POST Request HTTP Response Splitting<br />

<strong>PVS</strong> ID: 2289 FAMILY: CGI RISK: LOW NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to an HTTP 'response splitting'<br />

vulnerability.\n\nThe remote host seems to be running SnipSnap, a weblog application<br />

implemented in Java. It is reported that versions of SnipSnap prior 1.0.0b1 are prone to a<br />

HTTP response splitting vulnerability. An attacker may influence how the website is<br />

served, cached and interpreted by the means of a malformed link to the web site that would<br />

alter the server HTTP headers.<br />

Solution: Upgrade to SnipSnap 1.0b1 or higher.<br />

CVE-2004-1470<br />

Apache < 2.0.51 ${ENVVAR} Local Overflow<br />

<strong>PVS</strong> ID: 2290 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is<br />

running a vulnerable version of Apache. It is reported that versions prior 2.0.51 are prone to<br />

a local buffer overflow when processing ${ENVVAR} constructs in .htaccess and<br />

httpd.conf files. An attacker with interactive access to the computer may use this flaw to<br />

execute arbitrary code in the context of the web server.<br />

Solution: Upgrade to Apache 2.0.51 or higher.<br />

CVE-2004-0747<br />

Apache < 2.0.51 mod_dav DAV LOCK Command Remote DoS<br />

<strong>PVS</strong> ID: 2291 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe<br />

remote host is running a vulnerable version of Apache. It is reported that versions prior<br />

2.0.51 are prone to a remote denial of service issue. An attacker may issue a specific<br />

sequence of DAV LOCK commands to crash the process. If Apache is configured to use<br />

threads, it may completely crash the Apache process.<br />

Solution: Upgrade to Apache 2.0.51 or higher.<br />

CVE-2004-0809<br />

Apache < 2.0.51 IPv6 Remote Buffer Overflow<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 576

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!