(PVS) Signatures - Tenable Network Security

Description: The remote web server contains a PHP application that is vulnerable to a cross-site
scripting attack.\n\n The version of Horde installed on the remote host fails to sanitize input
to the 'new_lang' parameter before using it in the 'framework/NLS/NLS.php' script to
generate dynamic content. An unauthenticated remote attacker may be able to leverage this
issue to inject arbitrary HTML or script code into a user's browser to be executed within the
security context of the affected site.
Solution: Upgrade to version 3.1.4 or higher.
CVE-2007-1473
Firefox < 1.5.0.11 / 2.0.0.3 Multiple Vulnerabilities
PVS ID: 3951 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:24875
Description: Synopsis :\n\nThe remote Windows host contains a web browser that can be manipulated
remotely for network abuse.\n\nThe FTP client support in the installed version of Firefox
has a flaw that could allow a remote attacker with control of an FTP server to perform a
rudimentary port scan of the user's internal network.
Solution: Upgrade to version 1.5.0.11, 2.0.0.3 or higher.
CVE-2007-1562
Squid < 2.6 STABLE12 TRACE Request DoS
PVS ID: 3952 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:24873
Description: Synopsis :\n\nThe remote proxy server is vulnerable to a denial of service
vulnerability.\n\nA vulnerability in TRACE request processing has been reported in Squid
that can be exploited by malicious people to cause a denial of service.
Solution: Upgrade to version 2.6 STABLE12 or higher.
CVE-2007-1560
Passive Vulnerability Scanner (PVS) Signatures
Helix Server < 11.1.3.1887 DESCRIBE Request LoadTestPassword Field Overflow
PVS ID: 3953 FAMILY: Generic RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a heap overflow.\n\nThe remote host is
running the Helix RealServer streaming media server. This version of Helix is vulnerable to
a flaw in the way that it processes the 'LoadTestPassword' field of a 'DESCRIBE' request.
An attacker exploiting this flaw would only need to be able to send malformed requests to
the Helix Server. Successful exploitation would result in the attacker executing arbitrary
code
Solution: Upgrade to version 11.1.3.1887 or higher.
Family Internet Services 1024