(PVS) Signatures - Tenable Network Security

Solution: Manually inspect the machine for malicious processes. In addition, you may wish to
consider installing security software that detects and blocks this sort of malicious software.
CVE Not available
Generic Botnet Client Detection
PVS ID: 3150 FAMILY: IRC Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'backdoor'
program.\n\nThe remote host appears to be running a machine that has been compromised
and is being controlled by a botnet. A botnet is a network of compromised computers that
are remotely controlled by a malicious bot administrator. Botnets are commonly used
for\nsending spam\nrunning Denial of Service (DoS) attacks against other
networks\nscanning and compromising new systems\nInstalling sniffers\nInstalling
keyloggers\nIdentify theft \nThe observed command was '%L'
realtime
Solution: Manually inspect the machine for malicious processes. In addition, you may wish to
consider installing security software that detects and blocks this sort of malicious software.
CVE Not available
MDaemon < 8.1.0 Content Filter Traversal Arbitrary File Overwrite
PVS ID: 3151 FAMILY: Web Servers RISK: HIGH NESSUS ID:19310
Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
host is running Alt-N MDaemon, an SMTP/IMAP server for Windows. According to its
banner, the version of MDaemon on the remote host is prone to a directory traversal flaw
that can be exploited to overwrite files outside the application's quarantine directory
provided MDaemon's attachment quarantine feature is enabled.
Solution: Upgrade to version 8.1.0 or higher.
CVE Not available
PHPList admin/index.php id Parameter SQL Injection
PVS ID: 3152 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running PHPList. PHPList is a PHP application that gathers
handles mailing and customer lists. This version is reported to be prone to a SQL Injection
flaw. An attacker exploiting this flaw would be able to read the database, manipulate the
database, and possibly run commands with the privileges of the web server.
Solution: No solution is known at this time.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 808