(PVS) Signatures - Tenable Network Security

Solution: Upgrade or patch according to vendor recommendations.
CVE-2007-3910
LinPHA include/img_view.class.php < 1.3.2 order Parameter SQL Injection
PVS ID: 4150 FAMILY: CGI RISK: HIGH NESSUS ID:25811
Description: Synopsis :\n\nThe remote web server contains a PHP script that is prone to a SQL injection
attack.\n\n The remote host is running LinPHA, a web photo gallery application written in
PHP. The version of LinPHA installed on the remote host fails to sanitize input to the
'order' parameter of the 'new_images.php' script before using it in the 'setSql' function in
'include/img_view.class.php' in a database query. Regardless of PHP's 'magic_quotes_gpc'
setting, an unauthenticated attacker may be able to exploit this issue to manipulate such
queries, leading to disclosure of sensitive information, modification of data or attacks
against the underlying database.
Solution: Upgrade to version 1.3.2 or higher.
CVE-2007-4053
Firefox < 2.0.0.6 Multiple Vulnerabilities
PVS ID: 4151 FAMILY: Web Clients RISK: HIGH NESSUS ID:25820
Description: Synopsis :\n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox allows unescaped URIs to be
passed to external programs, may lead to execution of arbitrary code on the affected host
subject to the user's privileges, and could also allow privilege escalation attacks against
addons that create 'about:blank' windows and populate them in certain ways.
Solution: Upgrade to version 2.0.0.6 or higher.
CVE-2007-3844
Mozilla Thunderbird < 1.5.0.13 Multiple Vulnerabilities
PVS ID: 4152 FAMILY: SMTP Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote
version of Mozilla Thunderbird suffers from a flaw in the way that it handles 'about:blank'
Javascript code. An attacker exploiting this flaw would need to be able to convince a
Thunderbird user to open an email that populated 'about:blank' with malicious Javascript
code. Successful exploitation would result in the attacker executing arbitrary Javascript on
the local machine.
Solution: Upgrade to version 1.5.0.13 or higher.
CVE-2007-3844
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1078