(PVS) Signatures - Tenable Network Security

MySQL Multiple Vulnerabilities
PVS ID: 2696 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:17313
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of MySQL that is older than version 4.0.24. This version of MySQL is
vulnerable to multiple remote attacks. Specifically\n1) The MySQL is vulnerable to a flaw
where the database temporary files are world-writeable and use a common name syntax. An
attacker may be able to guess a file name and inject data into the temp file.\n2)
Authenticated users that have 'CREATE TEMPORARY TABLE' privileges will be able to
corrupt MySQL files with the privileges of the MySQL process\n3) Authenticated users
with the 'INSERT' and 'DELETE' privileges may be able to escalate their database rights
due to an input validation error in MySQL\n4) Authenticated users that have 'INSERT' and
'DELETE' privileges may also abuse the 'CREATE FUNCTION' statement in order to gain
access to restricted data structures.
Solution: Upgrade to version 4.0.24, 4.1.10a or higher.
CVE-2005-0710
Xerox Document Centre Denial of Service (DoS)
PVS ID: 2697 FAMILY: Generic RISK: HIGH NESSUS ID:18268
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running Xerox Document Centre, an administrative, web-based GUI to a
Xerox device. This version is reportedly prone to a remote Denial of Service (DoS) attack.
An attacker exploiting this flaw would only need to be able to send malformed HTTP
requests to the web interface of the printer. A successful attack would result in a loss of
availability to the users of the printer.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
Xerox Document Centre Authentication Bypass
PVS ID: 2698 FAMILY: Generic RISK: HIGH NESSUS ID:18258
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running Xerox Document Centre, an administrative,
web-based GUI to a Xerox device. This version is reportedly prone to a remote
authentication bypass attack. While there are no details currently available, it is believed
that remote anonymous users may be able to subvert the authentication mechanism in such
a way as to gain administrative access to all or portions of the web server.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-1936
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 692