(PVS) Signatures - Tenable Network Security

UBB.threads < 6.5.1.1 editpost.php SQL Injection
PVS ID: 2699 FAMILY: CGI RISK: HIGH NESSUS ID:18098
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL injection attack.\n\nThe remote host
is running a version of UBB.threads that fails to sufficiently sanitize the 'Number'
parameter before using it in SQL queries in the editpost.php script. As a result, a remote
attacker can pass malicious input to database queries, potentially resulting in data exposure,
modification of the query logic, or even data modification or attacks against the database
itself.
Solution: Upgrade to UBB.threads version 6.5.1.1 or higher.
CVE-2005-0726
PlatinumFTP Server < 2.0 Remote Format String DoS
PVS ID: 2700 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:17321
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running PlatinumFTP Server. The remote server is vulnerable to a remote
Denial of Service (DoS) attack. Specifically, a remote user attempting to authenticate 50+
times with a user ID that includes '\\' will cause the server to fail. A successful attack would
render the FTP server useless for valid users.
Solution: Upgrade to version 2.0 or higher.
CVE-2005-0779
Apache Tomcat AJP12 Protocol Remote DoS
PVS ID: 2701 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:17322
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nIt may
be possible to freeze or crash the remote Tomcat web server by sending a specially crafted
HTTP request. An attacker exploiting this flaw would only need to be able to send HTTP
requests to the server. Successful exploitation would result in the web server being made
unavailable to valid users.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0808
PHP-Nuke paBox Module Hidden Parameter XSS
PVS ID: 2702 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:17336
Family Internet Services 693