27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

MRTG Web Application Detection<br />

<strong>PVS</strong> ID: 2565 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available<br />

Description: The remote host is running Multi Router Traffic Grapher (MRTG). MRTG is a web-based<br />

tool that collects data from routers and switches and then displays the information in a<br />

graph format. An attacker perusing this page would be able to gain information regarding<br />

routers, interfaces, traffic patterns, and more. This information could then be used to launch<br />

more sophisticated, targeted attacks.\nThe remote version of MRTG is %L<br />

Solution: Ensure that the page is protected by a password and/or ACLs.<br />

CVE Not available<br />

Mercury Test Director Application Detection<br />

<strong>PVS</strong> ID: 2566 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host may give an attacker information useful for future<br />

attacks.\n\nThe remote host is running Mercury Test Director. Test Director is a web-based<br />

application that is used to aid in the planning, deployment, and testing of Internet<br />

applications. The application leaks information regarding broken applications, servers, and<br />

more.\nThe remote server is running version %L<br />

Solution: Ensure that the application utilizes strong ACLS and/or encryption.<br />

CVE Not available<br />

Lotus Domino Address Book Information Disclosure<br />

<strong>PVS</strong> ID: 2567 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host may give an attacker information useful for future<br />

attacks.\n\nThe remote host is running Lotus Domino's names.nsf application. This<br />

application allows web clients to browse address books via the web. An attacker can use<br />

this information to mount more sophisticated attacks.<br />

Solution: Remove the application or use Access Control Lists (ACLs) to filter access to the<br />

application.<br />

CVE Not available<br />

UW-imapd CRAM-MD5 Authentication Bypass<br />

<strong>PVS</strong> ID: 2568 FAMILY: IMAP Servers<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of<br />

authentication.\n\nThere is a flaw in the remote UW-IMAP server that allows an<br />

authenticated user to log into the server as any user. The flaw is in the CRAM-MD5<br />

authentication theme. An attacker exploiting this flaw would only need to identify a<br />

Family Internet Services 654

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!