(PVS) Signatures - Tenable Network Security

Phorum < 5.0.18 register.php XSS
PVS ID: 3203 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:19584
Description: Synopsis :\n\nThe remote host is vulnerable to a cross-site scripting (XSS) attack.\n\nThe
remote version of Phorum contains a script called 'register.php' that is vulnerable to a
cross-site scripting attack. An attacker may exploit this problem to steal the authentication
credentials of third party users.
Solution: Upgrade to version 5.0.18 or higher.
CVE-2005-2836
PBLang Bulletin Board < 4.66z Multiple Vulnerabilities
PVS ID: 3204 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running PBLang, a bulletin board system written in PHP. This version of PBLang is
reported to be vulnerable to a number of remote overflows. While the details of the
vulnerabilities are unknown at this time, it is alleged that a remote attacker would be able to
execute commands with 'Administrative' privileges.
Solution: Upgrade to version 4.66z or higher.
CVE Not available
OpenSSH < 4.2p1 GSSAPI Authentication Credential Escalation
PVS ID: 3205 FAMILY: SSH
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running a version of OpenSSH which is
vulnerable to a flaw in the way that it handles GSSAPI authentication. Specifically, if
GSSAPI is enabled and 'GSSAPIDelegateCredentials' is enabled, an attacker may gain
access to GSSAPI credentials.
Solution: Upgrade to version 4.2p1 or higher.
CVE-2005-2798
Squid sslConnectTimeout Function Remote DoS
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 3206 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote Squid caching proxy, according to its version number, is vulnerable to an attack
where the attacker can cause the Squid proxy to stop servicing valid service requests. The
flaw is within the 'sslConnectTimeout' function and stems from the functions inability to
Family Internet Services 823