(PVS) Signatures - Tenable Network Security

arbitrary code execution (CVE-2008-1584).\n - There is a URL handling issue in
QuickTime's handling of 'file:' URLs that may allow launching of arbitrary applications
(CVE-2008-1585).
Solution: Either use QuickTime's Software Update preference to upgrade to the latest version or
manually upgrade to QuickTime 7.5 or later.
CVE-2008-1585
OpenOffice < 2.4.1 rtl_allocateMemory Integer Overflow
PVS ID: 4538 FAMILY: Generic RISK: HIGH NESSUS ID:33129
Description: Synopsis :\n\nThe remote Windows host has a program affected by an integer overflow
vulnerability.\n\nThe version of OpenOffice installed on the remote host reportedly
contains an integer overflow vulnerability in 'rtl_allocateMemory()', a custom memory
allocation function used by the application. If an attacker can trick a user on the affected
system, he can leverage this issue to execute arbitrary code subject to his privileges.
Solution: Upgrade to OpenOffice version 2.4.1 or later.
CVE-2008-2152
Gordano Messaging Suite Version Detection
PVS ID: 4539 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the Gordano Messaging Suite version: \n %L
Solution: N/A
CVE Not available
Gallery < 2.2.4 Multiple Vulnerabilities
PVS ID: 4540 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is Missing a critical security patch or upgrade\n\nThe
remote host is running Gallery, a web-based photo album application written in PHP. The
version of Gallery installed on the remote host is less than 2.2.5. The vendor has reported
multiple security flaws in this version. The software is prone to a cross-site scripting flaw
which could allow an attacker to execute arbitrary script code within client browsers. The
software is prone to an information disclosure flaw within the 'album-select' module and
the 'embed.php' script which would allow an attacker to gain access to confidential data.
The software is prone to a privilege escalation flaw which would allow users the ability to
gain access to confidential files or processes. Finally, the software is vulnerable to a
security bypass flaw which would allow an attacker the ability to view confidential data.
Solution: Upgrade to version 2.2.3 or newer
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1186