(PVS) Signatures - Tenable Network Security

PVS ID: 4741 FAMILY: Web Clients RISK: INFO NESSUS ID:Not Available
Description: The remote web browser has enabled an ActiveX / Java program that operates within the
browser. The software, System Requirements Lab (SRL), is used to benchmark the
capabilities of the client machine.
Solution: Ensure that you are running the latest version of SRL.
CVE Not available
Bugzilla quips.cgi Unspecified Crafted Variable Security Bypass
PVS ID: 4742 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe security controls on the remote host can be bypassed.\n\nThe remote
host is running Bugzilla, a bug-tracking software with a web interface. The version of
Bugzilla on the remote host suffers from a flaw where an authenticated user can bypass
security controls and modify quips. The reported version of Bugzilla is: \n %L \n
Solution: Upgrade to version 2.20.7, 2.22.6, 3.0.6 or higher.
CVE-2008-6098
MySQL Enterprise Server 5.0 < 5.0.70 Privilege Bypass
PVS ID: 4743 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:34727
Description: Synopsis : \n\nThe remote database server is susceptible to a privilege bypass
attack.\n\nThe version of MySQL Enterprise Server 5.0 installed on the remote host is
earlier than 5.0.70. In such versions, it is possible for a local user to circumvent privileges
through the creation of MyISAM tables employing the 'DATA DIRECTORY' and 'INDEX
DIRECTORY' options to overwrite existing table files in the application's data directory.
Note that this issue was supposed to have been addressed in version 5.0.60, but the fix was
incomplete. The reported version of MySQL server is: \n %L
Solution: Upgrade to version 5.0.70 or higher.
CVE-2008-4098
Passive Vulnerability Scanner (PVS) Signatures
ClamAV < 0.94.1 get_unicode_name() Function Off-by-One Buffer Overflow
PVS ID: 4744 FAMILY: Web Clients RISK: HIGH NESSUS ID:34729
Description: Synopsis : \n\nThe remote antivirus service is affected by a buffer overflow vulnerability.
\n\nAccording to its version, the clamd antivirus daemon on the remote host is earlier than
0.94.1. Such versions have an off-by-one heap overflow vulnerability in the code
responsible for parsing VBA project files, specifically in the 'get_unicode_name()' function
of 'libclamav/vba_extract.c', when a specific 'name' buffer is passed to it. Using a specially
crafted VBA project file embedded in an OLE2 Office document, a remote attacker can
Family Internet Services 1246