(PVS) Signatures - Tenable Network Security

een discovered with this version of PBLang. Specifically, files outside of the web root
may be displayed to remote users. This sort of attack is known as a 'directory-traversal'
attack, and would allow an attacker to craft a remote query such that the returned data
would contain potentially confidential data (/etc/passwd file, HTTPD configuration files,
and more.)
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0630
ProZilla < 1.3.7.4 Location Header Format String
PVS ID: 2644 FAMILY: Web Clients RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote client is vulnerable to a remote overflow.\n\nThe remote host is
using Prozilla, a download accelerator for Linux and Unix systems. The remote version of
this software contains a flaw in the way that it handles server HTTP headers. Specifically,
Prozilla does not properly handle format strings, which would allow the remote attacker to
execute arbitrary code on the client (Prozilla) machine. An attacker exploiting this flaw
would need to be able to convince a user to browse a malicious website. In addition, the
remote host is reported vulnerable to a remote buffer overflow. The details of this overflow
have not been made public at this time.
Solution: Upgrade to version 1.3.7.4 or higher.
CVE-2005-2961
Cyrus IMAPD < 2.2.12 Multiple Remote Overflows
PVS ID: 2645 FAMILY: IMAP Servers RISK: HIGH NESSUS ID:17208
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nAccording to its
banner, the remote Cyrus IMAPD server is vulnerable to multiple remote buffer overflow
attacks. An attacker exploiting these flaws would need to be able to communicate with the
IMAPD server (usually on TCP port 143). A successful attack would result in the attacker
executing arbitrary code on the IMAPD server.
Solution: Upgrade to version 2.2.12 or higher.
CVE-2005-0546
Fedora YUM Updater Detection
PVS ID: 2646 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is running Fedora YUM updater.
Solution: N/A
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 676