(PVS) Signatures - Tenable Network Security

Description: The remote host is running the Opera Mail Client. This version of Opera is reported to be
vulnerable to multiple remote attack vectors. An attacker exploiting this flaw would need to
be able to convince an Opera mail user to open a malicious email or attachment. Successful
exploitation would result in arbitrary code being executed.
Solution: Upgrade to version 8.50 or higher.
CVE-2005-3041
Opera < 8.50 Upload Flaw
PVS ID: 3233 FAMILY: Web Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a 'file upload' flaw.\n\nThe remote host is
using a version of Opera that is vulnerable to an unspecified file upload vulnerability. An
attacker exploiting this flaw would need to be able to convince a user to browse to a
malicious URI. Successful exploitation would result in the attacker executing arbitrary code
on the target machine.
Solution: Upgrade to version 8.50 or higher.
CVE-2005-3041
PHP Advanced Transfer Manager <
PVS ID: 3234 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:19768
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
PHP Advanced Transfer Manager on the remote host suffers from multiple information
disclosure and cross-site scripting flaws. For example, by calling the text or HTML viewer
directly, an unauthenticated attacker can view arbitrary files, possibly even from remote
hosts, provided PHP's 'register_globals' setting is enabled. As another example, an attacker
can issue a request for '/PATH/users/username' and retrieve sensitive user credentials. In
addition, selected PHP settings on the remote host can be disclosed by accessing the
'test.php' script directly.
Solution: Disable PHP's 'register_globals' setting and remove the 'test.php' script.
CVE Not available
PunBB < 1.2.8 Multiple Vulnerabilities
PVS ID: 3235 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:19775
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
PunBB installed on the remote host suffers from several flaws.\n\nA File Inclusion
Vulnerability - The application fails to validate the 'language' parameter when a user
updates their profile and uses that throughout the application to require PHP code in order
to display messages. An attacker with an account on the affected application may be able to
Family Internet Services 831