(PVS) Signatures - Tenable Network Security

Novell iManager < 2.7 SP1 Property Book Pages Security Bypass
PVS ID: 4618 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:33867
Description: Synopsis :\n\nThe remote web server is affected by a security bypass
vulnerability.\n\nNovell iManager is installed on the remote host. The version of iManager
installed reportedly fails to implement sufficient access control checks on 'Property Book
Pages' created with Plug-in Studio before granting delete privileges on them to a user.
Solution: Upgrade to version 2.7 SP1 (iManager 2.7.1) or higher.
CVE-2008-3488
Gallery < 1.5.8 modules.php phpEx Parameter Traversal Local File Inclusion
PVS ID: 4619 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running Gallery, a web-based photo album
application written in PHP. The version of Gallery installed on the remote host is less than
1.5.8. This version of Gallery is vulnerable to a local file inclusion vulnerability. The root
of the flaw is in the 'phpEx' parameter of the '/contrib/phpBB2/modules.php' script. An
attacker exploiting this flaw would send a specially formatted request to the modules.php
application. The request would likely include a directory traversal to some local file on the
server. e.g. '../../../etc/passwd'. Successful exploitation would result in the attacker gaining
'read' access to confidential files. The reported version of Gallery is: \n %L \n
Solution: Upgrade to version 1.5.8 or higher.
CVE Not available
PHP < 4.4.9 Multiple Vulnerabilities
PVS ID: 4620 FAMILY: Web Servers RISK: HIGH NESSUS ID:33849
Description: Synopsis : \n\nThe remote web server uses a version of PHP that is affected by multiple
issues.\n\nAccording to its banner, the version of PHP installed on the remote host is older
than 4.4.9. Such versions address several security issues, including : \n\n - An update of
PCRE to version 7.7.\n - An overflow in memnstr().\n - A crash in imageloadfont when an
invalid font is given.\n - An open_basedir handling issue in the curl extension.\n -
'mbstring.func_overload' set in '.htaccess' becomes global. Note that the release
announcement states this will be the last release for the PHP 4.4 series. The reported
version of PHP is: \n %L
Solution: Upgrade to version 4.4.9 or higher.
CVE-2008-3660
Passive Vulnerability Scanner (PVS) Signatures
Apache Tomcat < 6.0.18 UTF-8 Directory Traversal Arbitrary File Access
Family Internet Services 1210