(PVS) Signatures - Tenable Network Security

Stored Procedures' for Visual Studio from IBM database add-ins (JR28431). - A buffer
overflow condition in the DAS server code. (IZ22188)
Solution: Apply DB2 Version 9.5 Fix Pack 2.
Sharity Detection
CVE-2008-6821
PVS ID: 4639 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the Sharity service for Unix. Sharity is a service that allows
Unix computers to access SMB/CIFS servers.
Solution: N/A
Invision Power Board <
CVE Not available
PVS ID: 4640 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running Invision Board, a CGI suite designed to set up a bulletin board system on the
remote web server. This version of Invision Board is vulnerable to several SQL injection
attacks due to a lack of parsing on the 'act' and 'name' variables of the index.php script.
There is an information disclosure flaw where authentication materials can be retrieved
from 'ipb_stronghold' cookies. There is a vulnerability that allows attackers to hijack
administrative sessions. There is a denial of service vulnerability due to a lack of parsing to
the 'clean_globals()' function. There is a flaw in the 'source/action_admin/languages.php'
where an attacker can inject code that is later executed via an 'eval()' function. Finally,
there is a flaw in the way that the application handles data sent to the 'INFO[base_url]'
parameter of the 'admin.php' script. A remote attacker can invoke arbitrary PHP script code.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
eDirectory < 8.8 SP3 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4641 FAMILY: Generic RISK: HIGH NESSUS ID:34221
Description: Synopsis :\n\nThe remote directory service is affected by multiple vulnerabilities.\n\nThe
remote host is running eDirectory, a directory service software from Novell. The installed
version of Novell eDirectory is affected by multiple issues :\n\n - NDS module is affected
by a heap overflow vulnerability (Bugs 396819 and 396817).\n - Windows installs of
eDirectory are affected by a remote memory corruption vulnerability (Bug 373852).\n -
LDAP module is affected by a buffer overflow vulnerability (Bug 373853).\n - HTTPSTK
is affected by two heap overflow vulnerabilities affecting 'Language' and 'Content Length'
headers in HTTPSTK (Bugs 379882 and 379880).\n - HTTPSTK is also affected by a
cross-site scripting vulnerability (Bug 387429).
Family Internet Services 1216