(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running the Golden FTP Server, an FTP server for the Windows platform. This version
of Golden FTP is vulnerable to a number of different flaws. An attacker exploiting these
flaws would be able to either execute arbitrary code or cause the application to fail.
Solution: Upgrade to version 2.7.0 or higher.
CVE-2005-4553
osTicket < 1.3.1 Multiple Vulnerabilities
PVS ID: 3046 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:18612
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
osTicket installed on the remote host suffers from several vulnerabilities, including:\n\n- A
Local File Include Vulnerability\nThe application fails to sanitize user-supplied input to the
'inc' parameter in the 'view.php' script. After authentication, an attacker can exploit this
flaw to run arbitrary PHP code found in files on the remote host provided PHP's
'register_globals' setting is enabled.\n\n- A SQL Injection Vulnerability\nAn authenticated
attacker can affect SQL queries via POST queries due to a failure of the application to filter
input to the 'ticket' variable in the 'class.ticket.php' code library.
Solution: Upgrade to version 1.3.1 or higher.
CVE-2005-1439
PHPNews < 1.2.6 news.php prevnext Parameter SQL Injection
PVS ID: 3047 FAMILY: CGI RISK: HIGH NESSUS ID:18621
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL Injection attack.\n\nThe remote host
is running PHPNews, an open-source news application written in PHP. The installed
version of PHPNews is prone to a SQL injection attack due to its failure to sanitize
user-supplied input via the 'prevnext' parameter of the 'news.php' script. An attacker can
exploit this flaw to affect database queries, possibly revealing sensitive information,
launching attacks against the underlying database, and more.
Solution: Upgrade to version 1.2.6 or higher.
CVE-2005-2156
Passive Vulnerability Scanner (PVS) Signatures
Courier Mail Server < 0.50.1 SPF Data Lookup Remote DoS
PVS ID: 3048 FAMILY: SMTP Servers RISK: LOW NESSUS ID:18620
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running Courier Mail Server, an open source mail server for Linux and Unix.
The installed version of Courier is prone to a remote denial of service vulnerability
associated with Sender Policy Framework (SPF) data lookups. To exploit this flaw, an
attacker would need to control a DNS server and return malicious SPF records in response
Family Internet Services 778