(PVS) Signatures - Tenable Network Security

punBB < 1.2.5 Multiple SQL Injection and Authentication Bypass Vulnerabilities
PVS ID: 2715 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:17363
Description: Synopsis :\n\nThe remote host is vulnerable to an HTML injection attack.\n\nThe remote
host is running punBB, a web-based bulletin board. This version of punBB ( %L ) is
vulnerable to multiple remote HTML injection attacks. Specifically, failure to correctly
parse the 'email' and 'Jabber' variables of the profile page leads to a condition where
attackers can insert bogus HTTP headers and content into a client browser session. In order
to affect such an attack, the attacker would typically need to be able to entice a remote user
into perusing a malicious URI. A successful attack would lead to a loss of confidential data
(such as authentication or state cookies) or the execution of malicious code within the
browser.
Solution: Upgrade to version 1.2.5 or higher.
CVE-2005-0818
Lysator < 2.0.1 LSH Unspecified Remote DoS
PVS ID: 2716 FAMILY: SSH
RISK:
MEDIUM
NESSUS ID:17352
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running Lysator's LSH, a version of Secure Shell (SSH) that is available for
Unix-like platforms. This version of LSH is reported vulnerable to a Denial of Service
(DoS) attack.
Solution: Upgrade to version 2.0.1 of LSH (when available).
CVE Not available
MailEnable < 1.8.1 mailto Remote Format String Overflow
PVS ID: 2717 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:17364
Description: Synopsis :\n\nThe remote host is vulnerable to a remote 'format string' flaw.\n\nThe remote
host is running a version of MailEnable Professional which is reported to be prone to a
remote format string vulnerability. Specifically, the application fails to properly parse the
SMTP 'mailto:' request. An attacker exploiting this flaw would send a malformed query to
the server which, upon being parsed, would either crash the remote host or possibly execute
arbitrary commands on the remote host.
Solution: Upgrade to version 1.8.1 or higher.
CVE-2005-1015
Looking Glass Network Tool Detection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2718 FAMILY: Policy NESSUS ID:Not Available
Family Internet Services 698