(PVS) Signatures - Tenable Network Security

CVE Not available
Comersus Default Install Script Admin Access
PVS ID: 2554 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running Comersus, a web application shopping cart.
This version of Comersus is vulnerable to a remote attack where anonymous users can gain
administrative access by requesting a .asp script that was a part of the install process but
never deleted after the install.
Solution: Delete all /comersus_backoffice_install scripts. In addition, upgrade or patch according to
vendor recommendations.
CVE Not available
Mac OS X Multiple Vulnerabilities (Security Update 2005-001)
PVS ID: 2555 FAMILY: Operating System Detection RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is missing a critical security patch or upgrade.\n\nThe
remote host is missing Security Update 2005-001. This security update contains a number
of enhancements for the following programs :\n\n - at commands\n - ColorSync\n -
libxml2\n - Mail\n - PHP\n - Safari\n - SquirrelMail\n
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0525
ISC BIND < 8.4.6 q_usedns Array Remote Overflow DoS
PVS ID: 2556 FAMILY: DNS Servers
RISK:
MEDIUM
NESSUS ID:16260
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS)
attack.\n\nThe remote BIND DNS server is, according to its version number,
vulnerable to a remote buffer overflow in the 'q_usedns' buffer. An attacker may be
able to launch a denial of service attack against the remote BIND Server.
Solution: Upgrade to Bind 8.4.6 or higher or the newest version of BIND 9.
CVE-2005-0033
ISC BIND < 8.4.6 dnssec authvalidated Crafted Packet Remote DoS
PVS ID: 2557 FAMILY: DNS Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:16261
Family Internet Services 651