27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Solution: Ensure that this application is authorized according to corporate policies and guidelines.<br />

CVE Not available<br />

SimpleBoard sbp Parameter Remote File Inclusion<br />

<strong>PVS</strong> ID: 3684 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:22023<br />

Description: Synopsis :\n\nThe remote web server contains a PHP application that is prone to remote file<br />

inclusion attacks.\n\nThe remote host is running SimpleBoard, a web-based bulletin board<br />

component for Mambo / Joomla. The version of SimpleBoard installed on the remote host<br />

fails to sanitize input to the 'sbp' parameter of the 'image_upload.php' and reportedly other<br />

scripts before using it to include PHP code. Provided PHP's 'register_globals' setting is<br />

enabled, an unauthenticated attacker may be able to exploit these flaws to view arbitrary<br />

files on the remote host or to execute arbitrary PHP code, possibly taken from third-party<br />

hosts.<br />

Solution: No solution is known at this time.<br />

CVE-2006-5043<br />

MetaSploit Shell Detection<br />

<strong>PVS</strong> ID: 3685 FAMILY: Policy<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is running software that should be authorized with respect to<br />

corporate policy.\n\nThe remote server is running a MetaSploit Framework server.<br />

Metasploit allows users to automatically exploit and backdoor vulnerable applications via<br />

the network. The version of MetaSploit is %L. \nFurther, the Metasploit shell server is<br />

bound to a non-localhost socket. This allows users to connect to the shell and run exploits<br />

from the server. You should ensure that this application can only be accessed by trusted<br />

security staff.<br />

Solution: Ensure that this application is authorized according to corporate policies and guidelines.<br />

WebInspect Detection<br />

CVE Not available<br />

<strong>PVS</strong> ID: 3686 FAMILY: Policy<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is running software that should be authorized with respect to<br />

corporate policy.\n\nThe remote server is running a WebInspect web scanner. WebInspect<br />

is a security tool that allows security staff and administrators to automate web-based attacks<br />

and exploits against web servers.<br />

Family Internet Services 952

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!