(PVS) Signatures - Tenable Network Security

CVE Not available
Geeklog FCKeditor < 1.4.0sr4 Arbitrary File Upload
PVS ID: 3677 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:21780
Description: Synopsis :\n\nThe remote web server contains a PHP application that is affected by an
arbitrary file upload vulnerability.\n\nThe remote host is running Geeklog, an open-source
weblog powered by PHP and MySQL. The version of Geeklog installed on the remote host
includes an older version of FCKeditor that is enabled by default and allows an
unauthenticated attacker to upload arbitrary files containing PHP code, and then to execute
them subject to the privileges of the web server user ID.
Solution: Upgrade to Geeklog 1.4.0sr4 or higher.
CVE-2006-3362
phpFormGenerator Arbitrary File Upload
PVS ID: 3678 FAMILY: CGI RISK: HIGH NESSUS ID:21918
Description: Synopsis :\n\nThe remote host is vulnerable to a Script Injection attack.\n\nThe remote host
is running phpFormGenerator, a PHP-based tool for generating web forms. The version of
phpFormGenerator installed on the remote host allows an unauthenticated attacker to create
forms supporting arbitrary file uploads. This issue can then be leveraged to upload a file
with arbitrary code and execute it subject to the privileges of the web server user ID.
Solution: No solution is known at this time.
CVE Not available
CommuniGate Pro < 5.1c2 POP3 Overflow
PVS ID: 3679 FAMILY: Web Servers RISK: HIGH NESSUS ID:20827
Description: Synopsis :\n\nThe remote mail server is prone to multiple attack vectors.\n\nAccording to
its banner, the version of CommuniGate Pro running on the remote host will crash when
certain mail clients try to open an empty mailbox. Remote code execution may even be
possible.
Solution: Upgrade to version 5.1c2 or higher.
CVE-2006-0468
Zope < 2.9.4 docutils Information Disclosure
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 3680 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available
Family Internet Services 950