(PVS) Signatures - Tenable Network Security

CVE Not available
Apple QuickTime Server < 4.1.3 Multiple Vulnerabilities
PVS ID: 2762 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running the Apple Quicktime Streaming Server. This version is vulnerable to an
information disclosure bug. Specifically, the parse_xml.cgi script can be coerced into
giving away local system information (path, file name, and more). Such information can
aid an attacker in more sophisticated attacks. A second flaw would allow an attacker the
ability to run arbitrary code on the remote server. Specifically, malformed requests are not
properly parsed prior to being logged. When the logs were viewed by a local user, code
could be executed with the permissions of the user reading the logs (typically an
administrator). The remote server is also reported prone to a remote Cross-Site Scripting
(XSS) flaw. An attacker exploiting this flaw would need to be able to convince a user to
browse to a malicious URI. Successful exploitation would result in the theft of confidential
data (cookies, authentication materials, and more).
Solution: Upgrade to version 4.1.3 or higher.
CVE-2003-0051
Apple QuickTime < 4.1.4 Directory Traversal, Denial of Service, and Script Disclosure Vulnerabilities
PVS ID: 2763 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running the Apple Quicktime Streaming Server. This version is vulnerable to a remote
directory traversal flaw. An attacker exploiting this flaw would be able to access data
outside of the web root. In addition, several remote denial of service (DoS) flaws have been
reported in this version of QTSS. Thirdly, this version of QTSS has been reported prone to
script disclosure attacks. An attacker exploiting this flaw would be able to read script
source code. This could lead to more sophisticated attacks.
Solution: Upgrade to Apple Quicktime Server 4.1.4 or higher.
CVE-2004-0169
Apple QuickTime Streaming Server < 5.0.3.2 DoS
PVS ID: 2764 FAMILY: Generic
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote Apple QuickTime Server is reported prone to a remote Denial of Service (DoS)
attack. The details of the attack are currently unknown. An attacker with access to the
specific attack vectors would be able to impact the availability of the server.
Family Internet Services 711