(PVS) Signatures - Tenable Network Security

Cisco SIP TFTP Server Detection
PVS ID: 3764 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or
application.\n\nThe remote host is running a Cisco SIP VOIP server. The device is
configured to allow TFTP access. An attacker can guess the name of the image files and
download the device configuration. Such information would include passwords and IDs.
Solution: Ensure that the TFTP server and associated ACLs are in alignment with corporate policies
and guidelines.
CVE Not available
Sipsak VOIP Vulnerability Scanner Detection
PVS ID: 3765 FAMILY: Policy RISK: INFO NESSUS ID:Not Available
Description: The remote client is scanning the network with the Sipsak VOIP vulnerability scanner. This
tool scans networks and detects vulnerable VOIP SIP phones. The version of Sipsak was: \n
%L
Solution: Ensure that such scanning is in alignment with corporate policies and guidelines.
CVE Not available
McAfee ePolicy Orchestrator HTTP Server Source Header Remote Overflow
PVS ID: 3766 FAMILY: Web Servers RISK: HIGH NESSUS ID:22494
Description: Arbitrary code can be executed on the remote host due to a flaw in the web service. The
remote host is running McAfee ePolicy Orchestrator. The remote version of this software is
vulnerable to a stack overflow vulnerability. An unauthenticated attacker can exploit this
flaw by sending a specially crafted packet to the remote host. A successful exploitation of
this vulnerability would result in remote code execution with the privileges of the
SYSTEM.
Solution: Upgrade to version 3.5.0 Patch 6 or higher.
SIP Server Detection
CVE-2006-5156
PVS ID: 3767 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the following SIP server: \n %L \nThis protocol is used to
connect VoIP users via the Internet.
Solution: N/A
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 973