(PVS) Signatures - Tenable Network Security

RISK:
MEDIUM
Description: Synopsis : \n\nThe remote web server uses a version of PHP that is vulnerable to multiple
attack vectors.\n\nAccording to its banner, the version of PHP 5.3.x installed on the remote
host is earlier than 5.3.1. Such versions are potentially affected by multiple issues : \n\n -
Sanity checks are missing in exif processing.\n\n - It is possible to bypass the 'safe_mode'
configuration setting using 'tempnam()'.\n\n - It is possible to bypass the 'open_basedir'
configuration setting using 'posix_mkfifo()'.\n\n - The 'safe_mode_include_dir'
configuration setting may be ignored.\n\n - Calling 'popen()' with an invalid mode can
cause a crash.\n\n - A safe_mode restriction-bypass vulnerability because environment
variables specified for 'proc_open' are passed without checking them.\n\nFor your
information, the observed version of PHP is: \n %L
Solution: Upgrade to PHP version 5.3.1 or later.
CVE-2009-4018
BIND 9 DNSSEC Query Response Remote Cache Poisoning
PVS ID: 5243 FAMILY: DNS Servers
RISK:
MEDIUM
NESSUS ID:42983
Description: Synopsis :\n\nThe remote DNS Server is vulnerable to a remote cache-poisoning
attack.\n\nThe remote DNS Server is running BIND 9 earlier than 9.4.3-P4, 9.5.2-P1, or
9.6.1-P2. Such versions may incorrectly ad records to its cache from the additional section
of responses received during resolution of a recursive client query. This behavior only
occurs when processing client queries with checking disabled (CD) at the same time as
requesting DNSSEC records (DO). For your information, the observed version of BIND 9
is\n%L
Solution: Upgrade to BIND 9.4.3-P4 / 9.5.2-P1 / 9.6.1-P2 or later.
CVE-2009-4022
IBM Solid Database < 6.30.0.37 Remote Denial of Service
PVS ID: 5244 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:42877
Description: Synopsis : \n\nThe remote database server is vulnerable to a denial-of-service
attack.\n\nThe remote host is running IBM SolidDB. The installed version of SolidDB is
earlier than 6.30.0.37. Such versions are potentially affected by a denial-of-service in
'solid.exe' when handling a specially crafted network packet containing an invalid error
code. For your information, the observed version of IBM SolidDB is : \n %L
Solution: Upgrade to IBM SolidDB 6.30.0.37 or later.
CVE-2009-3840
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1399