(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a 'File Inclusion' flaw.\n\nThe remote host is
running phpCOIN version 1.2.2 or older. This version of phpCOIN is vulnerable to a
remote 'file include' flaw. An attacker exploiting this flaw would be able to execute PHP
script code on the remote web server with the permissions of the web server process.
Successful exploitation would lead to partial loss of confidentiality, integrity, and
availability.
Solution: Upgrade to version 1.2.4 or higher.
CVE-2006-4424
CubeCart < 3.0.13 Multiple Vulnerabilities
PVS ID: 3736 FAMILY: CGI RISK: HIGH NESSUS ID:22296
Description: The remote web server contains a PHP application that suffers from multiple
vulnerabilities. The version of CubeCart installed on the remote host fails to properly
sanitize user-supplied input to the 'gateway' parameter before using it in the
'includes/content/gateway.inc.php' script to include PHP code. An unauthenticated remote
attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP
code on the remote host, subject to the privileges of the web server user ID. In addition, the
application fails to initialize the 'searchArray' and 'links' array variables, which could be
leveraged to launch SQL injection and cross-site scripting attacks respectively against the
affected installation as long as PHP's 'register_globals' setting is enabled.
Solution: Upgrade to version 3.0.13 or higher.
CVE-2006-4526
Mailman < 2.1.9rc1 Spoofed Log Entry Injection
PVS ID: 3737 FAMILY: CGI RISK: LOW NESSUS ID:22307
Description: Synopsis :\n\nThe remote web server contains a Python application that is affected by a log
spoofing vulnerability.\n\nThe version of Mailman installed on the remote host fails to
sanitize user-supplied input before writing it to the application's 'error' log. An
unauthenticated remote attacker can leverage this flaw to spoof log messages. In addition,
the application is reportedly affected by a denial of service issue involving headers that do
not conform to RFC 2231 as well as several cross-site scripting vulnerabilities.
Solution: Upgrade to version 2.1.9rc1 or higher.
CVE-2006-4624
Passive Vulnerability Scanner (PVS) Signatures
Ipswitch IMail Server RCPT String Remote Overflow
PVS ID: 3738 FAMILY: SMTP Servers RISK: HIGH NESSUS ID:Not Available
Family Internet Services 965