(PVS) Signatures - Tenable Network Security

Hydrogen Server Detection
PVS ID: 2815 FAMILY: Backdoors RISK: HIGH NESSUS ID:18039
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'Backdoor'
program.\n\nThe remote host is running Immunity's Hydrogen server. Hydrogen is a
Backdoor/Trojan application that is often used by penetration-testing teams to backdoor a
system that has been compromised.
Solution: Ensure that the instance of Hydrogen was actually installed by Security Team members
while performing a sanctioned penetration test.
CVE Not available
XAMPP < 1.4.14 Default Installation Multiple HTML Injection
PVS ID: 2816 FAMILY: CGI RISK: HIGH NESSUS ID:18037
Description: The remote host is running the XAMPP web server, a version of Apache that comes
pre-bundled with Perl, MySQL, and PHP. This version of XAMPP is reported to be prone
to remote HTML injection attacks. An attacker, exploiting this flaw, would need to be able
to convince a user to browse to a malicious URI. Successful exploitation would result in the
attacker executing malicious code within the user's browser, possibly leading to theft of
confidential data.
Solution: Upgrade to version 1.4.14 or higher.
CVE-2005-2043
MSN Messenger Malformed GIF Remote Overflow
PVS ID: 2817 FAMILY: Internet Messengers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running Microsoft MSN Messenger. There is a flaw in this version of MSN Messenger that
would allow a remote attacker to potentially execute code on the target host. The flaw is in
the processing of GIF images. An attacker exploiting this flaw would need to be able to
convince a user to view a GIF image (such as an emoticon or icon). Successful exploitation
would lead to arbitrary code being executed on the vulnerable system. The reported version
number is: \n %L \n
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0562
GLD Greylisting Server < 1.5 Detection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2818 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:Not Available
Family Internet Services 726