(PVS) Signatures - Tenable Network Security

users:\ndex_init()\nsnb_en_init()\nsnb_ru_init()\nspell_init()\nsyn_init()\n\nAn attacker
calling these functions can submit queries that lead to compromise of confidential data or
execution of arbitrary code on the remote database server.
Solution: Upgrade to PostgreSQL 8.0.3 or higher.
CVE-2005-1410
Golden FTP < 2.53 USER Traversal File Access
PVS ID: 2877 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:18194
Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
host is running the Golden FTP Server. This version of Golden FTP is vulnerable to a
remote directory traversal flaw. An authenticated attacker can retrieve sensitive files from
outside the FTP server directories by using a '../' type query.
Solution: Upgrade to version 2.53 or higher.
CVE-2005-1484
Mac OS X Multiple Vulnerabilities (Security Update 2005-005)
PVS ID: 2878 FAMILY: Operating System Detection RISK: HIGH NESSUS ID:18189
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is missing Security Update 2005-005. This security\nupdate contains security fixes for the
following application :\n\n- Apache\n- AppKit\n- AppleScript\n- Bluetooth\n- Directory
Services\n- Finder\n- Foundation\n- HelpViewer\n- LDAP\n- libXpm\n- lukemftpd\n-
NetInfo\n- ServerAdmin\n- sudo\n- Terminal\n- VPN
Solution: Apply Security Update 2005-005.
CVE-2005-1343
Invision Board Multiple XSS and SQL Injection
PVS ID: 2879 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:18201
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running Invision Board, a CGI suite designed to set up a
bulletin board system on the remote web server. This version of Invision Board is
vulnerable to a Cross-Site Scripting (XSS) flaw where attackers can supply malicious script
code to the 'act' parameter of the index.php script. An attacker exploiting this flaw would
need to be able to convince a user to browse to a malicious URI. Successful exploitation
would result in the theft of confidential materials (such as authentication cookies). In
addition, the remote application is vulnerable to a remote SQL Injection attack. An attacker
exploiting this flaw would send a malformed query to the application. The query would
include reserved SQL characters and syntax. Successful exploitation would result in the
Family Internet Services 744