(PVS) Signatures - Tenable Network Security

ListManager < 9.3b / 9.2c / 8.95d Multiple Vulnerabilities
PVS ID: 4399 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:31134
Description: Synopsis :\n\nThe remote web server is affected by multiple vulnerabilities.\n\nThe remote
host is running ListManager, a web-based commercial mailing list management application
from Lyris. According to its banner, the version of ListManager installed on the remote
host relies on client-side code to validate unspecified form parameters before processing
them. An attacker who is subscribed to a list managed by the affected application can
reportedly leverage this issue to elevate his privileges to list administrator or gain access to
arbitrary mailing lists. In addition, once administrative access has been granted, another
vulnerability in ListManager's administrative interface allows creation of new accounts that
collide with existing accounts, which results in overwriting data in the existing accounts.
Solution: Upgrade to version 9.3b / 9.2c / 8.95d or higher.
CVE-2007-6319
Generic Botnet Client Detection
PVS ID: 4400 FAMILY: Backdoors RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'backdoor'
program.\n\nThe remote host appears to be running a machine that has been compromised
and is being controlled by a botnet. A botnet is a network of compromised computers that
are remotely controlled by a malicious bot administrator. Botnets are commonly used
for\nsending spam\nrunning Denial of Service (DoS) attacks against other
networks\nscanning and compromising new systems\nInstalling sniffers\nInstalling
keyloggers\nIdentify theft \nThe observed request that was sent to the control bot was '%L'
realtime
Solution: Manually inspect the machine for malicious processes. In addition, you may wish to
consider installing security software that detects and blocks this sort of malicious software.
CVE Not available
Generic Botnet Server Detection
PVS ID: 4401 FAMILY: Backdoors RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'backdoor'
program.\n\nThe remote host appears to be running a machine that is being used to control
a botnet. A botnet is a network of compromised computers that are remotely controlled by a
malicious bot administrator. Botnets are commonly used for\nsending spam\nrunning
Denial of Service (DoS) attacks against other networks\nscanning and compromising new
systems\ninstalling sniffers\ninstalling keyloggers\nidentify theft\nThe observed bot client
request was '%P' and the response from the server was '%L'
realtime
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1148