(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host appears to be running eZ or eZphotoshare. It is reported that this software is
vulnerable to a remote denial of service. An attacker may remotely crash eZphotoshare or
eZ by establishing over 80 simultaneous connections to the server.
Solution: No solution is known at this time.
CVE Not available
PHPGroupWare < 0.9.16.003 Wiki Module XSS
PVS ID: 2269 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe
remote host appears to be running PHPGroupWare, a groupware system implemented in
PHP. This version is reported to be vulnerable to a cross-site scripting issue in the Wiki
module. An attacker may steal cookie-based authentication credentials from a legitimate
user by sending a malformed link to this web site.
Solution: Upgrade to PHPGroupWare 0.9.16.003 or higher.
CVE-2004-0875
TYPSoft FTP Server Multiple DoS
PVS ID: 2270 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
appears to be running TYPSoft FTP Server. It is reported that version up to and including
1.11 are prone to multiple vulnerabilities.\n\n - A denial-of-service vulnerability when an
authenticated user issues two 'RETR' request in a row, without actualy downloading the
files.\n\n - A denial-of-service vulnerability when handling data passed to the 'APPE' and
'DELE' commands via the same socket connection.\n\n - A denial-of-service vulnerability
when handling a malformed 'ABORT' command.
Solution: No solution is known at this time.
CVE-2009-4105
Passive Vulnerability Scanner (PVS) Signatures
SAFE TEAM Regulus Staff Accounts Password Hash Disclosure
PVS ID: 2271 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to
retrieve sensitive files or data.\n\nThe remote host seems to be running Regulus, a
web accounting software implemented in PHP. It is reported that every version of
Regulus up to and including 2.2-95 are prone to a staff accounts information
disclosure vulnerability. Any user may query the 'staffile' from the web server and
be served. This file contains information about the staff accounts including
password hashes which are computed using DES 56 bit. Therefore staff users
Family Internet Services 570