(PVS) Signatures - Tenable Network Security

PVS ID: 4750 FAMILY: Generic RISK: INFO NESSUS ID:34756
Description: Synopsis :\n\nA database service is listening on the remote host.\n\n The remote host is
running Yosemite Backup, a commercial backup solution for Windows, Linux and Novell
NetWare and targeting small-to-medium sized businesses.
Solution: N/A
CVE Not available
Firefox < 2.0.0.18 Multiple Vulnerabilities
PVS ID: 4751 FAMILY: Web Clients RISK: HIGH NESSUS ID:34766
Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox is earlier than 2.0.0.18. Such
versions are potentially affected by the following security issues : \n\n - Locally saved '.url'
shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)\n
- The canvas element can be used in conjunction with an HTTP redirect to bypass
same-origin restrictions and gain access to the content in arbitrary images from other
domains. (MFSA 2008-48)\n - Arbitrary code execution is possible via Flash Player
dynamic module unloading. (MFSA 2008-49)\n - By tampering with the
window.__proto__.__proto__ object, one can cause the browser to place a lock on a
non-native object, leading to a crash and possible code execution. (MFSA 2008-50)\n -
There are several stability bugs in the browser engine that may lead to crashes with
evidence of memory corruption. (MFSA 2008-52)\n - The browser's session restore feature
can be used to violate the same-origin policy and run JavaScript in the context of another
site. (MFSA 2008-53)\n - There is a buffer overflow that can be triggered by sending a
specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)\n - Crashes
and remote code execution in nsFrameManager are possible by modifying certain
properties of a file input element before it has finished initializing. (MFSA 2008-55)\n -
The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed.
(MFSA 2008-56)\n - The '-moz-binding' CSS property can be used to bypass security
checks that validate codebase principals. (MFSA 2008-57)\n - There is an error in the
method used to parse the default namespace in an E4X document caused by quote
characters in the namespace not being properly escaped. (MFSA 2008-58)\n\nThe reported
version of Firefox is: \n %L
Solution: Upgrade to version 2.0.0.18 or higher.
CVE-2008-5024
Firefox 3.x < 3.0.4 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4752 FAMILY: Web Clients RISK: HIGH NESSUS ID:34767
Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox 3.0 is earlier than 3.0.4. Such
versions are potentially affected by the following security issues : \n\n - Locally saved '.url'
shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)\n
- By tampering with the window.__proto__.__proto__ object, one can cause the browser to
Family Internet Services 1249