(PVS) Signatures - Tenable Network Security

CVE-2005-3251
PunBB < 1.2.9 search.php old_searches Parameter SQL Injection
PVS ID: 3260 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:20013
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
PunBB installed on the remote host fails to sanitize user-supplied input to the 'old_searches'
parameter of the 'search.php' script before using it in database queries. Provided PHP's
'register_globals' setting is enabled, an attacker may be able to exploit this issue to delete
arbitrary data or launch attacks against the underlying database.
Solution: Upgrade to version 1.2.9 or higher.
CVE-2005-3518
Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow
PVS ID: 3261 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when
processing malformed NNTP headers. An attacker exploiting this flaw would need to be
able to convince the local Lynx user to browse a malicious NNTP server. Successful
exploitation will result in the attacker running arbitrary code on the local system.
Solution: Upgrade to version 2.8.6 dev14 or higher.
CVE-2005-3120
PHP < 5.0.5 Multiple Vulnerabilities
PVS ID: 3262 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of PHP that is older than 5.0.5. This version has a number of bugs that
allow attackers to execute or retrieve arbitrary files outside of the web root directory. An
attacker exploiting these flaws would only need to send a malformed HTTP request to the
vulnerable system. Successful exploitation would result in the loss of confidential data or a
breach of system integrity.
Solution: Upgrade to version 5.0.5 or higher.
CVE Not available
Xerver < 4.20 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 3263 FAMILY: Web Servers NESSUS ID:20062
Family Internet Services 839