(PVS) Signatures - Tenable Network Security

CVE-2008-5911
Google Chrome < 1.0.154.46 Multiple Vulnerabilities
PVS ID: 4920 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:35558
Description: Synopsis : \n\nThe remote host contains a web browser that is affected by multiple
vulnerabilities.\n\nThe version of Google Chrome installed on the remote host is earlier
than 1.0.154.46. Such versions are reportedly affected by several issues : \n\n - Cross-site
scripting vulnerabilities in the Adobe Reader Plugin itself could be leveraged using a PDF
document to run scripts on arbitrary sites via Google Chrome. (CVE-2007-0048 and
CVE-2007-0045)\n\n - A cross-domain security bypass vulnerability that could allow an
attacker to bypass the same-origin policy and gain access to potentially sensitive
information. (CVE-2009-0276)\n\nThe reported version of Google Chrome is: \n %L
Solution: Upgrade to version 1.0.154.46 or higher.
CVE-2009-0411
Bugzilla < 3.2.1/3.3.2 Multiple Vulnerabilities
PVS ID: 4921 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors\n\nThe remote
Bugzilla software is vulnerable to several flaws. First, valid users can post content in
HTML or JavaScript. Given this, other users viewing the content may have malicious code
executed within their browser. Second, the 'process_bug.cgi' script is vulnerable to a
cross-site request forgery (CSRF) flaw. An attacker exploiting this flaw would need to be
able to entice a valid user into clicking a link or opening a malicious HTML email.
Successful exploitation would result in the attacker executing commands with the
permissions of the valid user account. The reported version of Bugzilla is: \n %L \n
Solution: Upgrade to version 3.2.1, 3.3.2 or higher.
CVE-2009-0485
Firefox < 3.0.6 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4922 FAMILY: Web Clients RISK: HIGH NESSUS ID:35581
Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox is earlier than 3.0.6. Such
versions are potentially affected by the following security issues : \n\n - There are several
stability bugs in the browser engine that may lead to crashes with evidence of memory
corruption. (MFSA 2009-01)\n\n - A chrome XBL method can be used in conjunction with
'window.eval' to execute arbitrary JavaScript within the context of another website,
violating the same origin policy. (MFSA 2009-02)\n\n - A form input control's type could
be changed during the restoration of a closed tab to the path of a local file whose location
was known to the attacker. (MFSA 2009-03)\n\n - An attacker may be able to inject
Family Internet Services 1298