(PVS) Signatures - Tenable Network Security

CVE Not available
EmuLive Server4 Authentication Bypass / DoS
PVS ID: 2314 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running EmuLive Server4. It is reported that versions up to and including Build 7569 are
prone to an authentication bypass vulnerability and remote denial of service. An attacker
may directly access the administration console to bypass the authentication or deny service
to legitimate users. Note that Build 7569 is only vulnerable to the denial of service issue.
Solution: No solution is known at this time.
CVE-2004-1695
Subversion (SVN) Unreadable Path Metadata Information Disclosure
PVS ID: 2315 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:14800
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote host is running Subversion, an open-source file management
product. According to the version number, the remote system is prone to an information
disclosure issue. An attacker may gather information about the remote host using metadata
in unreadable paths.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2004-0749
Macromedia JRun Multiple Vulnerabilities
PVS ID: 2316 FAMILY: Web Servers RISK: HIGH NESSUS ID:14810
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\n The remote host is
running JRun, a J2EE application server running on top of IIS or Apache. There are
multiple vulnerabilities in the remote version of this software :\n- The JSESSIONID
variable is not implemented securely. An attacker may use this flaw to guess the session id
number of other users\n- There is a code disclosure issue that may allow an attacker to
obtain the contents of a .cfm file by appending ';.cfm' to the file name\n- There is a buffer
overflow vulnerability if the server connector is configured in 'verbose' mode. An attacker
may exploit this flaw to execute arbitrary code on the remote host.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2004-2182
Passive Vulnerability Scanner (PVS) Signatures
Full Revolution aspWebCalendar calendar.asp SQL Injection
Family Internet Services 583