(PVS) Signatures - Tenable Network Security

Description: The remote host is running SmarterMail. SmarterMail is a web interface to a mail server.
This version of SmarterMail is vulnerable to a Cross-Site Scripting (XSS) vulnerability. An
attacker exploiting this flaw would need to be able to convince a user to click on a
malicious link. A successful attack would give the attacker the ability to run code within
the client browser.
Solution: Upgrade or patch according to vendor recommendations.
XOOPS Detection
CVE Not available
PVS ID: 2580 FAMILY: CGI RISK: INFO NESSUS ID:Not Available
Description: The remote host is running XOOPS, a web-portal software written in PHP.
Solution: Ensure that this application is approved with respect to corporate policies and guidelines.
CVE Not available
Lynx Malformed HTML Tags DoS
PVS ID: 2581 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is using Lynx as a web browser. The version used is vulnerable to a remote
attack wherein malformed HTML can cause Lynx to go into an infinite loop. An attacker
exploiting this flaw would need to be able to convince a user to browse to a malicious
website. Upon a successful attack, Lynx would take up many resources on the client
machine, possibly causing a crash in either Lynx or the operating system. The version of
Lynx is: \n %L
Solution: Upgrade or patch according to vendor recommendations.
CVE-2004-1617
SquirrelMail < 1.4.4 URI Parsing Arbitrary Code Execution
PVS ID: 2582 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running SquirrelMail, a webmail system written in PHP. Versions of SquirrelMail prior to
1.4.4-Stable are vulnerable to a remote buffer overflow within the URI parsing
functionality of SquirrelMail. An attacker exploiting this flaw would only need to be able to
send web requests to the vulnerable system.
Solution: Upgrade to version 1.4.4 or higher.
CVE-2005-0152
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 658