27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

MyBB < 1.1.1 Multiple Script Variable Overwrite<br />

<strong>PVS</strong> ID: 3519 FAMILY: CGI RISK: HIGH NESSUS ID:21239<br />

Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote<br />

version of MyBB does not properly initialize global variables in the 'global.php' and<br />

'inc/init.php' scripts. An unauthenticated attacker can leverage this issue to overwrite global<br />

variables through GET and POST requests and launch other attacks against the affected<br />

application.<br />

Solution: Upgrade to verison 1.1.1 or higher.<br />

CVE-2006-1912<br />

Coppermine Photo Gallery < 1.4.5 index.php file Parameter Local File Inclusion<br />

<strong>PVS</strong> ID: 3520 FAMILY: CGI RISK: HIGH NESSUS ID:21240<br />

Description: Synopsis :\n\nThe remote web server contains a PHP script that is affected by a local file<br />

include issue.\n\nThe version of Coppermine Gallery installed on the remote host fails to<br />

properly sanitize input to the 'file' parameter of the 'index.php' script before using it in a<br />

PHP 'include_once()' function. Provided PHP's 'register_globals' setting is enabled, an<br />

unauthenticated attacker may be able to exploit this issue to view arbitrary files or to<br />

execute arbitrary PHP code on the remote host, subject to the privileges of the web server<br />

user ID.<br />

Solution: Upgrade to version 1.4.5 or higher.<br />

CVE-2006-1909<br />

Help Center Live < 2.1.0 osTicket Multiple SQL Injection<br />

<strong>PVS</strong> ID: 3521 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a SQL Injection attack.\n\nThe remote web<br />

server is running Help Center Live, a help desk application written in PHP. The remote<br />

version of this software is vulnerable to a SQL Injection flaw. An attacker exploiting this<br />

flaw would send malformed HTTP requests to the web application that would, upon being<br />

parsed, execute arbitrary commands on the database server.<br />

Solution: Upgrade to version 2.1.0 or higher.<br />

CVE-2006-2039<br />

DeleGate < 8.11.6 Invalid DNS Response DoS<br />

<strong>PVS</strong> ID: 3522 FAMILY: DNS Servers<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:21293<br />

Family Internet Services 908

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!