(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host passes information across the network in an insecure
manner.\n\nThe remote server is managed by a Java JConsole. Further, the server is
configured to accept plaintext credentials. This can be dangerous if an attacker can gain
access to network traffic. The plaintext authentication string observed was:\n%P\n
Solution: Require remote clients to use an encrypted session.
CVE Not available
WordPress < 2.6 press-this.php XSS
PVS ID: 4587 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe
version of WordPress installed on the remote host is vulnerable to a cross-site scripting
flaw due to the way that it parses user-supplied data to the 'press-this.php' script. An
attacker exploiting this flaw would need to be able to convince a WordPress user to open a
malicious URI. Successful exploitation would result in attacker code being run in the
browser.
Solution: Upgrade to version 2.6 or higher.
CVE Not available
Firefox < 2.0.0.16 / 3.0.1 Multiple Vulnerabilities
PVS ID: 4588 FAMILY: Web Clients RISK: HIGH NESSUS ID:33505
Description: Synopsis :\n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox is affected by various security
issues :\n\n - By creating a very large number of references to a common CSS object, an
attacker can overflow the CSS reference counter, causing a crash when the browser
attempts to free the CSS object while still in use and allowing for arbitrary code execution
(MFSA 2008-34).\n - If Firefox is not already running, passing it a command-line URI with
pipe ('|') symbols will open multiple tabs, which could be used to launch 'chrome:i' URIs
from the command-line or to pass URIs to Firefox that would normally be handled by a
vector application (MFSA 2008-35).
Solution: Upgrade to version 2.0.0.16 / 3.0.1 or higher.
CVE-2008-2933
Blackberry Enterprise Server Version Detection
PVS ID: 4589 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available
Description: The remote host is running Blackberry Enterprise Server version: \n %L
Solution: N/A
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1200