(PVS) Signatures - Tenable Network Security

CVE-2006-1485
Horde < 3.1.1 Help Viewer Code Execution
PVS ID: 3490 FAMILY: CGI RISK: HIGH NESSUS ID:21164
Description: The remote web server contains a PHP application that allows execution of arbitrary PHP
code. The version of Horde installed on the remote host fails to sanitize user-supplied input
before using it in the Help viewer to evaluate code. An unauthenticated attacker could
exploit this flaw to execute arbitrary command on the remote host subject to the privileges
of the web server user ID.
Solution: Upgrade to version 3.1.1 or higher.
CVE-2006-1491
MPlayer Crafted Media File Integer Overflow
PVS ID: 3491 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an integer overflow\n\nThe remote host is
using a version of MPlayer, a multimedia video and audio application. This version of
MPlayer is vulnerable to an integer overflow due to a lack of content parsing. An attacker
exploiting this flaw would need to craft a malicious media file and then convince a local
user to download and play the file within MPlayer. Successful exploitation would result in
arbitrary code being executed locally.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2006-1502
OneOrZero Helpdesk < 1.6.5.3 index.php id Parameter SQL Injection
PVS ID: 3492 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL Injection attack.\n\nThe remote host
is running OneOrZero, an open-source helpdesk application. This version of OneOrZero is
vulnerable to a SQL Injection flaw. An attacker exploiting this flaw would be able to
execute arbitrary SQL commands on the backend SQL server. This can lead to loss of
confidentiality, integrity and availability.
Solution: Upgrade to version 1.6.5.3 or higher.
CVE-2006-1501
ZoneAlarm < 6.1.744.001 VSMON.exe Path Subversion Local Privilege Escalation
PVS ID: 3493 FAMILY: Generic
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:21165
Family Internet Services 900