(PVS) Signatures - Tenable Network Security

Solution: Apply Fix Pack 19 (6.1.0.19) or higher.
CVE-2008-4111
Invision Power Board < 2.3.6 index.php name Parameter SQL Injection
PVS ID: 4686 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a SQL injection attack.\n\nThe remote host
is running Invision Board, a CGI suite designed to set up a bulletin board system on the
remote web server. This version of Invision Board is vulnerable to a SQL injection attack
due to a lack of parsing on the 'name' parameter of the index.php script. An attacker
exploiting this flaw would be able to execute arbitrary commands against the remote
database server. The reported version of Invision was: \n %L
Solution: Upgrade or patch according to vendor recommendations.
CVE-2008-4171
ProFTPD Command Truncation Cross-Site Request Forgery
PVS ID: 4687 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:34265
Description: Synopsis :\n\nThe remote FTP server is prone to a cross-site request forgery attack.\n\nThe
remote host is using ProFTPD, a free FTP server for Unix and Linux. The version of
ProFTPD running on the remote host splits an overly long FTP command into a series of
shorter ones and executes each in turn. If an attacker can trick a ProFTPD administrator
into accessing a specially-formatted HTML link, he may be able to cause arbitrary FTP
commands to be executed in the context of the affected application with the administrator's
privileges.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2006-5815
MyBB < 1.4.1 Multiple Vulnerabilities
PVS ID: 4688 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
MyBB installed on the remote host is vulnerable to a number of vulnerabilities. The
application fails to properly parse and sanitize data sent to the following scripts: global.php,
announcements.php, admin/inc/class_page.php, inc/functions.php,
inc/datahandlers/post.php, inc/class_error.php, polls.php, moderation.php,
inc/class_moderation.php, usercp.php, and attachments.php. The details of these flaws is
currently unknown; however, the vendor has released a fix. The reported version of MyBB
is: \n %L
Solution: Upgrade to version 1.4.2 or higher.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1230