(PVS) Signatures - Tenable Network Security

Description: The remote host is running SocketScanner, a security tool that inspects and blocks
malicious traffic. SocketScanner is often run in conjunction with WormRadar. WormRadar
is a tool that monitors worm activity and sends the information to the wormradar.com
servers.
Solution: Ensure that you are running the latest version of SocketScanner.
CVE Not available
Apache < 1.6.1 auth_ldap Module Remote Format String
PVS ID: 3360 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a remote 'format string' flaw.\n\nThe remote
host is running the Apache auth_ldap module, a module for authenticating remote users
against an LDAP server. This version of auth_ldap is vulnerable to a format string flaw. An
attacker exploiting this flaw would be able to execute arbitrary code on the remote web
server.
Solution: Upgrade to version 1.6.1 or higher.
CVE-2006-0150
Eudora Internet Mail Server < 3.2.8 NTLM Authentication Request DoS
PVS ID: 3361 FAMILY: SMTP Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running Eudora Internet Mail Server (EIMS), an SMTP server for Mac OS.
The installed version of EIMS is vulnerable to a remote Denial of Service (DoS). An
attacker exploiting this flaw would be able to cause the remote mail server to crash,
impacting the availability of the service to valid users.
Solution: Upgrade to version 3.2.8 or higher.
CVE-2006-0141
ClamAV < 0.88.0 UPX File Processing Overflow
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 3362 FAMILY: Web Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a heap overflow.\n\nThe remote host is
running ClamAV, an open-source antivirus solution for Unix and Windows systems. This
version of ClamAV is reported to be vulnerable to a flaw where the parsing of a malicious
file will cause the clamav process to execute arbitrary code. While the details of the attack
are currently unknown, it is rumoured that an attacker exploiting this flaw would only need
to be able to craft and send a malformed email to a ClamAV server. Successful exploitation
results in the server executing arbitrary code or crashing.
Family Internet Services 865