(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 2.0.20 or higher.
Zotob Worm Infection
CVE-2005-3420
PVS ID: 3164 FAMILY: Backdoors RISK: HIGH NESSUS ID:19429
Description: Synopsis :\n\nThe remote host has a backdoor installed.\n\nA Microsoft Windows shell is
running on port 8888. This may indicate an infection by the Zotob worm, although other
worms may also create a shell on this host.\n\nThe remote host has been compromised.
Solution: Manually inspect and repair this system.
Zotob Worm Infection
CVE Not available
PVS ID: 3165 FAMILY: FTP Servers RISK: HIGH NESSUS ID:19429
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'backdoor'
program.\n\nThe remote host is infected with the Zotob Worm.
Solution: Manually inspect and repair the remote host.
Zotob Worm Infection
CVE Not available
PVS ID: 3166 FAMILY: FTP Servers RISK: HIGH NESSUS ID:19429
Description: Synopsis :\n\nThe remote host has been compromised and is running a 'backdoor'
program.\n\nThe remote host is infected with the Zotob Worm.
Solution: Manually inspect and repair the remote host.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Discuz File Extension Validation Weakness Arbitrary File Upload
PVS ID: 3167 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote host
is running Discuz, a web-based message board. This version of Discuz is vulnerable to a
flaw that would allow remote attackers to upload arbitrary files to the web server. The
attacker could then execute the uploaded file (with the permission of the web server) or
convince other Discuz users to download and/or execute the code. An attacker exploiting
this flaw would be able to gain access to confidential data, potentially impact the
availability of the server, and tarnish the integrity of the server.
Family Internet Services 812