(PVS) Signatures - Tenable Network Security

CVE-2004-2761
SSL Certificate Signed Using Weak Hashing Algorithm
PVS ID: 4804 FAMILY: Generic RISK: LOW NESSUS ID:35291
Description: Synopsis :\n\nThe SSL certificate has been signed using a weak hash algorithm -
MD4\n\nThe remote service uses an SSL certificate that has been signed using a
cryptographically weak hashing algorithm - MD4. These algorithms are known to be
vulnerable to collision attacks. In theory, a determined attacker may be able to leverage this
weakness to generate another certificate with the same digital signature, which could allow
him to masquerade as the affected service.
Solution: Contact the Certificate Authority to have the certificate reissued.
CVE-2004-2761
SSL Certificate Signed Using Weak Hashing Algorithm
PVS ID: 4805 FAMILY: Generic RISK: LOW NESSUS ID:35291
Description: Synopsis :\n\nThe SSL certificate has been signed using a weak hash algorithm -
MD2\n\nThe remote service uses an SSL certificate that has been signed using a
cryptographically weak hashing algorithm - MD2. These algorithms are known to be
vulnerable to collision attacks. In theory, a determined attacker may be able to leverage this
weakness to generate another certificate with the same digital signature, which could allow
him to masquerade as the affected service.
Solution: Contact the Certificate Authority to have the certificate reissued.
CVE-2004-2761
Passive Vulnerability Scanner (PVS) Signatures
Mozilla Thunderbird < 2.0.0.19 Multiple Vulnerabilities
PVS ID: 4806 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:35287
Description: Synopsis : \n\nThe remote Windows host contains a mail client that is affected by multiple
vulnerabilities.\n\nThe installed version of Thunderbird is earlier than 2.0.0.19. Such
versions are potentially affected by the following security issues : \n\n - There are several
stability bugs in the browser engine that may lead to crashes with evidence of memory
corruption. (MFSA 2008-60)\n\n - XBL bindings can be used to read data from other
domains. (MFSA 2008-61)\n\n - Sensitive data may be disclosed in an XHR response when
an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource
in a different domain. (MFSA 2008-64)\n\n - A website may be able to access a limited
amount of data from a different domain by loading a same-domain JavaScript URL that
redirects to an off-domain target resource containing data that is not parsable as JavaScript.
(MFSA 2008-65)\n\n - Errors arise when parsing URLs with leading whitespace and
control characters. (MFSA 2008-66)\n\n - An escaped null byte is ignored by the CSS
parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)\n\n -
XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)\n\nThe reported
Family Internet Services 1268