(PVS) Signatures - Tenable Network Security

Lotus Domino < 8.0.1 / 7.0.3 FP1 Multiple Vulnerabilities
PVS ID: 4517 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:32433
Description: Synopsis :\n\nThe remote web server is affected by multiple vulnerabilities.\n\nAccording
to its banner, the version of Lotus Domino on the remote host is older than 8.0.1 / 7.0.3
FP1. The web server component of such versions is reportedly affected by a stack overflow
that can be triggered by means of a specially-crafted 'Accept-Language' request header.
While IBM only says this results in a denial of service, the original researchers claim to
have a working proof-of-concept for Windows that allows arbitrary code execution with
LOCAL SYSTEM privileges. In addition, the web server reportedly has an unspecified
cross-site scripting vulnerability in its servlet engine / Web container.
Solution: Upgrade to version 7.0.3 FixPack1 or 8.0.1
CVE-2008-2240
Barracuda Spam Firewall ldap_test.cgi Cross-Site Scripting Vulnerability
PVS ID: 4518 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:32434
Description: Synopsis :\n\nThe remote web server contains a CGI script that is affected by a cross-site
scripting vulnerability.\n\nAccording to its firmware version, the remote Barracuda Spam
Firewall device fails to filter input to the 'email' parameter of the '/cgi-bin/ldap_test.cgi'
script before using it to generate dynamic content. An unauthenticated remote attacker may
be able to leverage this issue to inject arbitrary HTML or script code into a user's browser
to be executed within the security context of the affected site. For your information, the
remote host is running firmware version: '%L'
Solution: Either configure the device to limit access to the web management application by IP
address or update to firmware release 3.5.11.025 or later.
CVE-2008-2333
Cerberus Helpdesk < Cerberus Helpdesk 4.0 Build 603
PVS ID: 4519 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to UNSPECIFIED remote attack
vectors\n\nThe remote host is running Cerberus Helpdesk version '%L', a web-based
helpdesk suite written in PHP. The installed version of Cerberus Helpdesk on the remote
host is vulnerable to several unspecified vulnerabilities.
Solution: Patch the affected file as described in the forum thread referenced.
CVE-2008-6440
Possible Keylogger software installation detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1180