(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to multiple flaws which impact confidentiality,
integrity, and availability.\n\nThe remote host is running an IBM DB/2 Universal Database
Server. It is reported that versions up to 8.2 may be vulnerable to multiple remote
overflows. IBM DB/2 passes database versions over the network. PVS has noted that the
DB/2 version is less than 8.2.
Solution: Upgrade to version 8.2 or higher.
CVE-2005-0417
PHPLinks SQL Injection
PVS ID: 2350 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running PHPLinks. PHPLinks is a PHP application that
gathers 'links'. This version is prone to a bug where an attacker can cause the server to
execute arbitrary script code. Further, the application is reported to be prone to SQL
Injection flaws. An attacker exploiting either of these flaws would be able to run commands
with the privileges of the Web Server.
Solution: No solution is known at this time.
CVE Not available
Jetty Web Server < 4.2.4 Directory Traversal Arbitrary File Access
PVS ID: 2351 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
host is running Jetty prior to version 4.2.4. Jetty is a Java web server that is downloadable
off of the Internet and is currently bundled with some IBM applications. An attacker
exploiting this flaw would only need to be able to request web pages from the Jetty server.
A successful attack would allow the attacker to navigate outside the web directories and
download potentially confidential data.
Solution: Upgrade to version 4.2.4 or higher.
CVE-2004-2478
PHP-Fusion Database Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2352 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: The remote host is running a version of PHP-Fusion that is prone to a SQL injection issue.
In versions prior to and including 4.01, an attacker may be able to manipulate and obtain
potentially confidential data. In addition, there is also a flaw in the way that this version of
PHP-Fusion handles upload code. An attacker exploiting this flaw would be able to upload
malicious code that would then be run by unsuspecting web users. Finally, there is a flaw in
the way that PHP-Fusion handles user-supplied input via the forum_search.php script. An
Family Internet Services 593