(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running a version of Kerio MailServer prior to 6.0.10.\n\nThere is a flaw in
the remote version of this server that would allow an attacker to exhaust resources on the
administrative web interface. While the details of the flaw are unknown, it is alledged that
an attacker can launch the attack without any credentials and render the target service
unavailable.
Solution: Upgrade to Kerio MailServer 6.0.10 or higher.
CVE-2005-1063
MaxWebPortal < 1.3.5 Multiple SQL Injection
PVS ID: 2874 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nMaxWebPortal is a web portal that utilizes a backend SQL or MySQL database.
This version of MaxWebPortal is vulnerable to multiple SQL Injection flaws. An attacker
exploiting these flaws would only need to be able to send HTTP queries to the remote
application. A successful attack would give the attacker the ability to read and write
database data as well as potentially execute arbitrary remote commands on the SQL or
MySQL system.
Solution: Upgrade to version 1.3.5 or higher.
CVE-2005-1417
Open Webmail < 2.51 20050430 Shell Escape Arbitrary Command Execution
PVS ID: 2875 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:18190
Description: Synopsis :\n\nThe remote host is vulnerable to an flaw that allows attackers to execute
arbitrary commands.\n\nThe remote host is running Open Webmail, an open-source perl
script that gives remote users a web-based interface to email. This version of Open
Webmail is vulnerable to a content-parsing flaw that would allow a remote attack to run
arbitrary code on the Open Webmail server. Specifically, the application fails to parse out
the '|' character which can be used to append commands to system calls.
Solution: Upgrade to version 2.51 20050430 or higher.
CVE-2006-3233
Passive Vulnerability Scanner (PVS) Signatures
PostgreSQL < 8.0.3 Incorrect Function Declaration
PVS ID: 2876 FAMILY: Database RISK: NONE NESSUS ID:18202
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running PostgreSQL, an open source relational
database. This version is vulnerable to a number of flaws. Specifically, the following
functions are directly accessible to remote
Family Internet Services 743