(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 2.0.5 or higher.
CVE-2006-5705
SQLYog MySQL HTTP Tunnel Detection
PVS ID: 3804 FAMILY: Backdoors
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or
application.\n\nThe remote host is running a MySQL database. In addition, a PHP script is
installed that allows MySQL connections to be tunneled over HTTP. This sort of
connection is typically utilized when the database administrator does not have access to
connect to the database from remote locations. The tunnel does not use any sort of
encryption and exposes credentials to passive sniffing. In addition, as the PHP script
connects to the database from the localhost, database authentication does not look for the
originating IP address within the GRANT tables but instead uses the server IP as the
originating source. Not only does the script allow database admins to bypass firewall
restrictions and log in insecurely, it also exposes the database to brute-force attacks from
anonymous users. The database information contained within the client request was:\n%P\n
Solution: For remote database administration, choose a method of connection that is restricted to only
trusted sources and encrypts the authentication credentials.
CVE Not available
MetaSploit Server Detection
PVS ID: 3805 FAMILY: Policy
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running software that should be authorized with respect to
corporate policy\n\nThe remote server is running a MetaSploit Framework server.
Metasploit allows users to automatically exploit and backdoor vulnerable applications via
the network.
Solution: Ensure that this application is authorized according to corporate policies and guidelines.
CVE Not available
MetaSploit Server Detection
PVS ID: 3806 FAMILY: Policy
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running software that should be authorized with respect to
corporate policy.\n\nThe remote server was just observed making an SSL connection to
metasploit.com. An SSL connection to metasploit.com usually indicates a Metasploit server
that is downloading updates from the metasploit.com web site. Metasploit is an attack
framework that allows users to automatically exploit and backdoor vulnerable applications
Family Internet Services 984