(PVS) Signatures - Tenable Network Security

OpenText FirstClass HTTP Daemon Search DoS
PVS ID: 2450 FAMILY: Web Servers RISK: HIGH NESSUS ID:15934
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running OpenText FirstClass, a web based unified messaging system.\nThe
remote version of this software is vulnerable to an unspecified Denial of Service attack that
may allow an attacker to disable this service remotely.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2004-2496
IlohaMail < 0.8.14-RC1 Unspecified Vulnerability
PVS ID: 2451 FAMILY: CGI RISK: HIGH NESSUS ID:15935
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe target is running
at least one instance of IlohaMail version 0.8.13 or earlier.\nThe remote version of this
software is vulnerable to an unspecified vulnerability announced by the vendor.
Solution: Upgrade to IlohaMail version 0.8.14RC1 or higher.
CVE-2004-2500
phpMyAdmin < 2.6.1-pl1 Remote Command Execution
PVS ID: 2452 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an flaw that allows attackers to execute
arbitrary commands.\n\nThe remote host is running phpMyAdmin, an open-source software
written in PHP to handle the administration of MySQL over the Web.\nThe remote version
of this software is vulnerable to arbitrary command execution due to a lack of user-supplied
data sanitization.\nIn addition, the remote host is vulnerable to multiple remote Cross-Site
Scripting (XSS) flaws. An attacker exploiting these flaws would need to be able to
convince a user into clicking on a malicious URL. Upon successful exploitation, the
attacker would be able to steal credentials or execute code within the browser.\nThirdly, the
remote host is vulnerable to a flaw in the way that it handles user-supplied variables that
are used within included files. An attacker exploiting this flaw would pass malicious data to
the server that the server would then include within the executing script code. A successful
exploit would result in the attacker being able to execute arbitrary code on the server.
Solution: Upgrade to phpMyAdmin 2.6.1-pl1 or higher.
CVE-2005-0543
phpDig < 1.8.5 Unspecified Vulnerability
PVS ID: 2453 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:15949
Family Internet Services 622