(PVS) Signatures - Tenable Network Security

PHP Advanced Transfer Manager < 1.22 Arbitrary File Upload
PVS ID: 2886 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:18207
Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nAccording to its
banner, the version of PHP Advanced Transfer Manager installed on the remote host allows
authenticated users to upload arbitrary files and then run them subject to the privileges of
the web server user.
Solution: Upgrade to PHP Advanced Transfer Manager 1.22 or higher.
CVE-2005-1681
Mozilla Firefox < 1.0.4 Multiple Vulnerabilities
PVS ID: 2887 FAMILY: Web Clients RISK: HIGH NESSUS ID:18243
Description: Synopsis : \n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote host
is using Firefox. This version of Firefox is prone to a remote exploit which stems from the
'install()' method. Specifically, an attacker can pass JavaScript to the 'install()' method
which would then be executed within the client browser. An attacker exploiting this flaw
would only need to be able to entice a user into browsing to a malicious website. Successful
exploitation would result in the client browser executing arbitrary code that could impact
the confidentiality and integrity of the remote machine. The reported browser version (as
seen on the network) is: \n %L
Solution: Upgrade to version 1.0.4 or higher.
CVE-2005-1532
AOL Instant Messenger Font Tag sml Parameter Remote DoS
PVS ID: 2888 FAMILY: Internet Messengers
RISK:
MEDIUM
NESSUS ID:18299
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running AOL Instant Messenger (AIM). Versions 5.9.3702 and lower are
reported to be vulnerable to a remote Denial of Service (DoS) attack. An attacker exploiting
this flaw would only need to be able to initiate a chat, file transfer, or game request to a
vulnerable instance of AOL IM. Successful exploitation would result in the Instant
Messenger client crashing.
Solution: When available, upgrade to a version of AOL IM greater than 5.9.3702.
CVE-2005-1655
Passive Vulnerability Scanner (PVS) Signatures
Apple iTunes < 4.8 MPEG-4 File Handling Overflow
PVS ID: 2889 FAMILY: Web Clients RISK: HIGH NESSUS ID:18214
Family Internet Services 747