(PVS) Signatures - Tenable Network Security

Description: The remote host is running a version of PHP which is older than 3.0.17 or 4.0.3. If the
option 'log_errors' is set to 'On' in php.ini, an attacker may use a bug present in this version
to execute arbitrary commands on this host.
Solution: Upgrade your installation of PHP to 3.0.17 or 4.0.3 or higher.
CVE-2000-0967
PHP < 4.2.3 Mail Function Header Spoofing
PVS ID: 1481 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:11444
Description: The remote web server is running a version of PHP which is 4.2.2 or older. This version
has a bug in its mail() function which does not properly sanitize user input. As a result,
users can forge email to make it look like it is coming from a different source that the
server. The remote version of PHP is: \n %L
Solution: Upgrade to PHP 4.2.3 or higher.
CVE-2002-0985
PHP < 4.0.4 php.cgi Shell Access Overflow
PVS ID: 1482 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: The remote host seems to be running PHP as a standby application (php.cgi). Due to
security bugs and performance issues, you should compile it as a module for your web
server.
Solution: Upgrade to version 4.0.4 or higher.
CVE-1999-0058
PHP < 4.1.0 Safe Mode Mail Function Command Execution
PVS ID: 1483 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:12307
Description: The remote host is running PHP 4.0.5. There is a flaw in this version which allows local
users to circumvent the safe mode and gain the UID of the HTTP process.
Solution: Upgrade to PHP 4.1.0
CVE-2001-1246
PHP < 4.3.2 Multiple Function Remote Overflows
PVS ID: 1484 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:11468
Family Internet Services 382