(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote web server could potentially allow remote attackers to
manipulate the password database.\n\nThe remote host appears to be running a version of
Apache, an open source web server. This version of Apache is vulnerable to a flaw in the
'htpasswd' utility. This issue is not considered a local flaw, as the program is not run setuid.
An attacker exploiting this flaw would need to find a vulnerable Apache Web server that
was making a call to 'htpasswd' via a CGI script.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
Hummingbird Inetd Multiple Remote Overflows
PVS ID: 2941 FAMILY: FTP Servers RISK: HIGH NESSUS ID:18403
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running Hummingbird Inetd, a commercial INETD server. This version of Inetd is
vulnerable to a remote overflow in the lpd service module. An attacker exploiting this flaw
would be able to execute arbitrary code on the remote system. NOTE: this is only a flaw if
the lpd module is enabled. In addition, the remote ftpd module is vulnerable to a remote
buffer overflow. An attacker exploiting this flaw would be able to execute arbitrary code on
the remote system.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-2599
Invision Board < 2.0.5 Privilege Escalation / SQL Injection
PVS ID: 2942 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:18401
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running Invision Board, a CGI suite designed to set up a
bulletin board system on the remote web server.\nThis version of Invision Board is
vulnerable to a flaw in the way that it handles moving of users from one group to another
group. It is reported that non-admin users can, when deleting a user account, optionally
move the user into an administrative group.\nThis can allow users to elevate their rights to
that of an administrator.\n\nIn addition to this, the remote version of this software is
vulnerable to a SQL injection vulnerability that may allow an attacker to execute arbitrary
SQL statements against the remote host.
Solution: Upgrade to version 2.0.5 or higher.
CVE-2006-0888
Passive Vulnerability Scanner (PVS) Signatures
PeerCast < 0.1212 URL Error Message Format String
PVS ID: 2943 FAMILY: Web Servers RISK: HIGH NESSUS ID:18417
Family Internet Services 763