Detections
Analytics
Debian DSA-897-1 : phpsysinfo - programming errors
medium Nessus Plugin ID 22763
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2005-0870 Maksymilian Arciemowicz discovered several cross site scripting problems, of which not all were fixed in DSA 724.
- CVE-2005-3347 Christopher Kunz discovered that local variables get overwritten unconditionally and are trusted later, which could lead to the inclusion of arbitrary files.
- CVE-2005-3348 Christopher Kunz discovered that user-supplied input is used unsanitised, causing a HTTP Response splitting problem.
Solution
Upgrade the phpsysinfo package.For the old stable distribution (woody) these problems have been fixed in version 2.0-3woody3.
For the stable distribution (sarge) these problems have been fixed in version 2.3-4sarge1.
See Also
Plugin Details
Severity: Medium
ID: 22763
File Name: debian_DSA-897.nasl
Version: 1.15
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/14/2006
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:phpsysinfo, cpe:/o:debian:debian_linux:3.0, cpe:/o:debian:debian_linux:3.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Patch Publication Date: 11/15/2005