(PVS) Signatures - Tenable Network Security

CVE Not available
PHP 5.2.x < 5.2.12 Multiple Vulnerabilities
PVS ID: 5281 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:43351
Description: Synopsis : \n\nThe remote web server uses a version of PHP that is vulnerable to multiple
attack vectors.\n\nAccording to its banner, the version of PHP 5.2.x installed on the remote
host is earlier than 5.2.12. Such versions are potentially affected by multiple vulnerabilities
: \n\n - A safe_mode bypass in tempnam(). (CVE-2009-3557)\n\n - An open_basedir
bypass in posix_mkfifo(). (CVE-2009-3558)\n\n - A possible denial-of-service via
temporary file exhaustion caused by a failure to limit the number of file uploads per
request. (CVE-2009-4017)\n\n - An arbitrary code execution vulnerability in the
'session.save_path()' function and the '$_SESSION' data structure. (CVE-2009-4143)\n\n -
A cross-site scripting vulnerability becuase the 'htmlspecialcharacters()' function fails to
properly handle some malformed multibyte character sequences.\n\nFor your information,
the observed version of PHP is: \n %L
Solution: Upgrade to PHP version 5.2.12 or later.
CVE-2009-4143
Serv-U < 9.2.0.1 User Directory Information Disclosure
PVS ID: 5282 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:43369
Description: Synopsis : \n\nThe remote FTP server is affected by an information disclosure
vulnerability.\n\nThe remote FTP server is running Serv-U file Server, an FTP server for
Windows. The installed version is earlier than 9.2.0.1. Such versions are potentially
affected by an information disclosure vulnerability which could allow an attacker to view
directories that are above the user's root directory. For your information, the observed
version of Serv-U is: \n %L
Solution: Upgrade to Serv-U version 9.2.0.1 or later.
CVE-2009-4815
Passive Vulnerability Scanner (PVS) Signatures
Adobe Flash Media Server < 3.0.5 / 3.5.3 Multiple Vulnerabilities (APSB09-018) (RTMP over HTTP)
PVS ID: 5283 FAMILY: Web Servers RISK: HIGH NESSUS ID:43390
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors\n\nThe remote host
is running Adobe Flash Media server. The installed version of Adobe Flash Media server
appears to be earlier than 3.0.5 or 3.5.3. Such versions are potentially affected by multiple
vulnerabilities : \n\n - A resource exhaustion vulnerability that could lead to a denial of
service. (CVE-2009-3791)\n\n - A directory traversal vulnerability that could lead to FMS
loading arbitrary DLLs present on the server. (CVE-2009-3792)\n\nFor your information,
the observed version of Adobe Flash Media Server is: \n %L
Family Internet Services 1411