(PVS) Signatures - Tenable Network Security

PVS ID: 2292 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a vulnerable version of Apache. It is reported that versions prior to 2.0.51 are prone
to a remote buffer overflow when parsing an URI sent over IPv6. An attacker may use this
vulnerability to execute arbitrary code on the remote host or to deny service to legitimate
users.
Solution: Upgrade to Apache 2.0.51 or higher.
CVE-2004-0786
myServer < 0.7.1 Directory Traversal Arbitrary File Access
PVS ID: 2293 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running myServer 0.7.0 or older. There is a
flaw in the remote version of this software that may allow an attacker to read arbitrary files
on the remote host with the privileges of the web server process using malformed URI.
Solution: Upgrade to version 0.7.1 or higher.
CVE-2004-2516
vBulletin authorize.php x_invoice_num Parameter SQL Injection
PVS ID: 2294 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running a version of vBulletin, a forum application
implemented in PHP, that is vulnerable to a SQL injection issue. It is reported that versions
3.0.0 through to 3.0.3 are prone to this issue. An attacker may steal content from the
underlying database or attack it.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2004-2695
Mozilla / Firefox enablePrivilege Dialog Weakness
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2295 FAMILY: Web Clients RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Script Injection attack.\n\nThe remote host
appears to be running Mozilla or Firefox. It is reported that versions up to and including
0.9.3 of Firefox and up to and including 1.7.2 of Mozilla are prone to a security weakness
in the enablePrivilege dialog that is displayed to authorize signed code execution. An
attacker may display an arbitrary string in the security dialog to entice an user into
executing a malicious script.
Family Internet Services 577