27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Solution: Upgrade to version 2.7.0 pl1 or higher.<br />

CVE-2005-4079<br />

Apache James < 2.2.1 Spooler retrieve Function DoS<br />

<strong>PVS</strong> ID: 3320 FAMILY: POP Server<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe<br />

remote host is running the Apache James software, a Java-based POP3, SMTP, and NNTP<br />

server. This version of JAMES is vulnerable to a flaw in the way that the spooler handles<br />

malformed messages. An attacker exploiting this flaw would need to be able to send<br />

multiple malformed emails to the server. Successful exploitation would result in the<br />

JAMES server depleting all system resources and eventually crashing.<br />

Solution: Upgrade to version 2.2.1 or higher.<br />

CVE-2004-2650<br />

Apache James < 2.2.1 Spooler retrieve Function DoS<br />

<strong>PVS</strong> ID: 3321 FAMILY: SMTP Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe<br />

remote host is running the Apache James software, a Java-based POP3, SMTP, and NNTP<br />

server. This version of JAMES is vulnerable to a flaw in the way that the spooler handles<br />

malformed messages. An attacker exploiting this flaw would need to be able to send<br />

multiple malformed emails to the server. Successful exploitation would result in the<br />

JAMES server depleting all system resources and eventually crashing.<br />

Solution: Upgrade to version 2.2.1 or higher.<br />

CVE-2004-2650<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Courier Mail Server < 0.52.2 Deactivated Account Authentication Bypass<br />

<strong>PVS</strong> ID: 3322 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host may allow deactivated users to access their accounts using<br />

their old credentials.\n\nThe remote host is running Courier Mail Server, an open source<br />

mail server for Linux and Unix. The installed version of Courier is prone to a bug in the<br />

way that it handles deactivated accounts. Versions of Courier less than 0.52.2 will still<br />

allow deactivated accounts to be accessed and used. An attacker exploiting this flaw would<br />

need to have the deactivated credentials in order to exploit this flaw.<br />

Solution: Upgrade to Courier Mail Server 0.52.2 or higher.<br />

Family Internet Services 856

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!