(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote ProFTPd server is as old or older than 1.2.10.\nIt is possible to
determine which user names are valid on the remote host based on timing analysis attack of
the login procedure.\nAn attacker may use this flaw to set up a list of valid usernames for a
more efficient brute-force attack against the remote host.
Solution: Upgrade to version 1.2.11 or higher.
CVE-2004-1602
Mantis < 0.19.1 Multiple Information Disclosure Vulnerabilities
PVS ID: 2394 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote host appears to be running a vulnerable version of Mantis, a bug
tracker web application written in PHP. It is reported that versions up to 0.19.0 are prone to
multiple information disclosure vulnerabilities flaws that may allow an attacker to view
stats of all projects or receive information from a project he was removed.
Solution: Upgrade to Mantis version 0.19.1 or higher.
CVE Not available
SlimFTPd < 3.16 Multiple Command Remote Overfow
PVS ID: 2395 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host
seems to be running a vulnerable version of SlimFTPd, a small FTP server for Windows. It
is reported that versions up to 3.15 are prone to a buffer overflow vulnerability that may
allow an attacker to execute arbitrary code on this host. A attacker needs a valid FTP
account on the server to exploit this vulnerability.
Solution: Upgrade to SlimFTPd version 3.16 or higher.
CVE-2004-2418
Pavuk < 0.9.31 Multiple Unspecified Remote Buffer Overflows
PVS ID: 2396 FAMILY: Web Clients
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an flaw that allows attackers to execute
arbitrary commands.\n\nThe remote host is using a version of Pavuk, a web spider, that is
vulnerable to multiple unspecified buffer overflows. An attacker can construct a malicious
website that is designed to trigger the vulnerability and run arbitrary code on the client
machine.
Family Internet Services 606