(PVS) Signatures - Tenable Network Security

CVE-2005-2755
ClamAV < 0.87.1 Content-parsing Buffer Overflow
PVS ID: 3281 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running ClamAV, an open-source antivirus solution for Unix-like systems. This version of
ClamAV is reported vulnerable to a flaw where the parsing of a malicious file will cause
the clamav process to execute arbitrary code. An attacker exploiting this flaw would only
need to be able to craft and send a malformed email to a ClamAV server. Successful
exploitation results in the server executing arbitrary code or crashing.
Solution: Upgrade to version 0.87.1 or higher.
CVE-2005-3501
Acme thttpd < 2.24 CGI Test Script Symlink Arbitrary File Overwrite
PVS ID: 3282 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a local flaw in the way that it creates
temporary files.\n\nThe remote host is running a vulnerable version of Acme thttpd. It is
reported that versions prior to 2.24 are prone to a local flaw where temporary files can be
used by local users to escalate their privileges on the machine. Specifically, attackers can
use the insecure temp files to overwrite critical web content or configuration files.
Solution: Upgrade to version 2.24 or higher.
CVE-2005-3124
PHPList < 2.10.3 Multiple Vulnerabilities
PVS ID: 3283 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running PHPList. PHPList is a PHP application that gathers handles mailing and
customer lists. This version is reported to be prone to a SQL Injection flaw. An attacker
exploiting this flaw would be able to read the database, manipulate the database, and
possibly run commands with the privileges of the web server. The SQL injection attack
vector requires administrative access. There is also a directory traversal flaw where an
attacker can send a malformed HTTP query and retrieve files outside of the webroot
directories. Finally, the remote application is vulnerable to multiple HTML injection and
Cross-Site Scripting (XSS) flaws.
Solution: Upgrade to version 2.10.3 or higher.
CVE-2005-3557
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 845