(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote Windows host has a program that is prone to a buffer overflow
attack.\n\nThe version of the SQL Anywhere MobiLink Server installed on the remote host
reportedly is affected by a heap-based buffer overflow when handling strings such as the
username, version and remote ID that are longer than 128 bytes. An unauthenticated
attacker may be able to leverage this issue to execute arbitrary code on the affected system.
Solution: Upgrade to SQL Anywhere 10.0.1 build 3649 or higher.
CVE-2008-0912
Sybase SQL Anywhere Database Version Detection
PVS ID: 4396 FAMILY: Web Clients RISK: INFO NESSUS ID:Not Available
Description: The remote host is a Sybase SQL Anywhere database server. The reported version is: %L
Solution: N/A
CVE Not available
OSSIM Version Detection
PVS ID: 4397 FAMILY: CGI RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the Open Source Security Information Management (OSSIM)
server. This security software is used for managing security data and tasks. The software is
available via the following URI: '%P' and the reported version is OSSIM %L
Solution: N/A
OSSIM <
CVE Not available
PVS ID: 4398 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:31133
Description: Synopsis :\n\nThe remote web server contains a PHP application that is affected by
multiple flaws.\n\nThe remote host is running OSSIM (Open Source Security Information
Management), a suite of security tools managed by a web-based front-end. The version of
OSSIM installed on the remote host fails to sanitize user input to the 'dest' parameter of the
'session/login.php' script before using it to generate dynamic HTML output. An
unauthenticated attacker can exploit this to inject arbitrary HTML and script code into a
user's browser to be executed within the security context of the affected site. In addition,
there is a SQL injection flaw within the 'modifyportform.php' script. An attacker exploiting
this flaw would need the ability to authenticate to the application.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2008-0920
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1147