27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

RISK:<br />

MEDIUM<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is<br />

running Alt-N MDaemon, an SMTP/IMAP server for Windows. This version of MDaemon<br />

is vulnerable to a flaw in the way that it handles malformed IMAP commands. An attacker<br />

exploiting this flaw would need to be able to authenticate to the server and issue IMAP<br />

'CREATE' and 'LIST' commands. Successful exploitation would result in the attacker<br />

executing arbitrary code or crashing the service.<br />

Solution: Upgrade to version 8.15 or higher.<br />

CVE-2006-0925<br />

Lighttpd < 1.4.10a Crafted Filename Request Source Disclosure<br />

<strong>PVS</strong> ID: 3450 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve<br />

sensitive files or data.\n\nThe remote host is running Lighttpd, a small web server. This<br />

version of Lighttpd is vulnerable to a flaw where an attacker can retrieve source code files.<br />

An attacker exploiting this flaw would be able to retrieve potentially sensitive data that<br />

would aid them in further attacks.<br />

Solution: Upgrade to version 1.4.10a or higher.<br />

CVE-2006-0814<br />

<strong>Network</strong>Activ < 3.5.16 Crafted Filename Request Source Code Disclosure<br />

<strong>PVS</strong> ID: 3451 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve<br />

sensitive files or data.\n\nThe remote host is running <strong>Network</strong>Activ, a web server. This<br />

version of <strong>Network</strong>Activ is vulnerable to a flaw where an attacker can request and<br />

download source code. This can lead to more sophisticated future attacks.<br />

Solution: Upgrade to version 3.5.16 or higher.<br />

CVE-2006-0815<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Woltlab Burning Board < 2.7.1 Multiple Script SQL Injection<br />

<strong>PVS</strong> ID: 3452 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection<br />

attack.\n\nThe remote host is running Woltlab Burning Board, a web bulletin board written<br />

in PHP. This version of Burning Board is vulnerable to a remote SQL Injection attack. An<br />

attacker exploiting this flaw would send a malformed 'fileid' parameter to the 'info_db.php'<br />

Family Internet Services 888

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!