(PVS) Signatures - Tenable Network Security

Solution: Enable PHP's 'magic_quotes_gpc' setting and disable 'allow_url_fopen'.
CVE-2005-2413
Apache < 2.0.55 HTTP Smuggling Vulnerability
PVS ID: 3112 FAMILY: Web Servers RISK: HIGH NESSUS ID:19296
Description: Synopsis :\n\nThe remote host is vulnerable to a remote SSL flaw.\n\nThe remote host
appears to be running a version of Apache, an open source web server. This version of
Apache is vulnerable to a flaw in the way that it handles mod_ssl CRL verification
callback. In order for an attacker to exploit this flaw the attacker would need to find a
server that was configured to use a malicious certificate revocation list (CRL).
Solution: Upgrade to version 2.0.55 or higher.
CVE-2005-2088
ProFTPD < 1.3.0rc2 Multiple Format Strings
PVS ID: 3113 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:19302
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the
version of ProFTPD installed on the remote host suffers from multiple format string
vulnerabilities, one involving the 'ftpshut' utility and the other in mod_sql's 'SQLShowInfo'
directive. Exploitation of either requires involvement on the part of a site administrator and
can lead to information disclosure, denial of service, and even a compromise of the affected
system. According to the banner, the remote version of ProFTPD is: \n %L
Solution: Upgrade to version 1.3.0rc2 or higher.
CVE-2006-6563
Lotus Domino Server Multiple Information Disclosure Vulnerabilities
PVS ID: 3114 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:19309
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote host is running a version of Lotus Domino Server that is prone to
several information disclosure vulnerabilities. Specifically, users' password hashes and
other data are included in hidden fields in the public address book 'names.nsf' that is
readable by default by all users. Moreover, Domino does not use a 'salt' to compute
password hashes, which makes it easier to crack passwords.
Solution: Upgrade to version 6.5.5, 6.0.6 or higher.
CVE-2005-2428
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 794