(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote database server is susceptible to multiple attacks.\n\nThe version
of MySQL installed on the remote host is reportedly affected by a denial of service
vulnerability that can lead to a server crash with a specially-crafted password packet. It is
also affected by a privilege escalation vulnerability because 'CREATE TABLE LIKE' does
not require any privileges on the source table, which allows an attacker to create arbitrary
tables using the affected application.
Solution: Upgrade to version 5.0.45 or higher.
CVE-2007-3782
ISC BIND < 9.5.0a6 Multiple Vulnerabilities
PVS ID: 4147 FAMILY: DNS Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of BIND DNS Server prior to 9.4.1-P1. This version of BIND is
vulnerable to a number of flaws that would allow cache poisoning and Denial of Service
(DoS) attacks. An attacker exploiting these flaws would need to be able to manipulate the
vulnerable DNS server to contact a malicious DNS server. Successful exploitation would
lead to cache-poisoning attacks or a loss of availability.
Solution: Upgrade to version 9.5.0a6 or higher.
CVE-2007-2926
Kerio MailServer < 6.4.1 Attachment Filter Unspecified Issue
PVS ID: 4148 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an unspecified vulnerability in its filtering
mechanism.\n\nThe remote host is running Kerio MailServer version 6.4.0 or lower. There
is a flaw in the remote version of this server. The details of the flaw are currently unknown;
however, it is alleged that the flaw would lead to remote compromise.
Solution: Upgrade to version 6.4.1 or higher.
Bandersnatch <
CVE-2007-3993
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4149 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote
server is running Bandersnatch, an open-source PHP application that generates Jabber
usage statistics. This version of Bandersnatch is vulnerable to a flaw in the way that it
parses multiple user-supplied variables. An attacker exploiting these flaws can inject script
and SQL code that would be executed on the server with the permissions of the web server.
Family Internet Services 1077