(PVS) Signatures - Tenable Network Security

NNTP server fails. Successful exploitation would result in a loss of availability.
Solution: Upgrade to version 1.11.3 or higher.
CVE-2005-1911
Gaim < 1.3.1 Multiple Vulnerabilities
PVS ID: 3012 FAMILY: Internet Messengers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host appears to be running Gaim, a popular open-source, multi-protocol instant
messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.
Namely\n\n1) A Gaim client downloading a non-Ascii support file will crash when
processing the file\n2) The Gaim MSN Messenger module, when processing a malformed
message, will crash.\n\nBoth of these vulnerabilities are Denial of Service (DoS) attacks
that introduce a risk to availability.
Solution: Update to version 1.3.1 or higher.
CVE-2005-1269
Outlook Express NNTP LIST Command Remote Overflow
PVS ID: 3013 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:18489
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running Outlook Express. This version of Outlook Express is vulnerable to a buffer
overflow when malformed NNTP responses are parsed by versions of msoe.dll prior to
6.00.2800.1506. An attacker exploiting this flaw would need to host a malicious NNTP
server and be able to convince a local Outlook user to connect to the NNTP server.
Successful exploitation would result in arbitrary code being executed on the machine
running Outlook Express.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-1213
Outlook Web Access with Exchange 5.5 SP4 XSS
PVS ID: 3014 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:18488
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack\n\nThe
remote server is running Outlook Web Access (OWA) on Exchange %L\n\nThis version of
OWA, coupled with Exchange 5.5 SP4, is reported to be vulnerable to a remote Cross-Site
Scripting (XSS) flaw. An attacker exploiting this flaw would typically need to be able to
convince a user to browse to a malicious URI. Successful exploitation would result in
arbitrary code executing in the client browser and possible theft of confidential data (such
as authentication cookies).
Family Internet Services 768