(PVS) Signatures - Tenable Network Security

arbitrary code into a chrome document and then execute it with chrome privileges if he can
trick a user into downloading a malicious HTML file and a .desktop shortcut file. (MFSA
2009-04)\n\n - Cookies marked HTTPOnly are readable by JavaScript via the
'XMLHttpRequest.getResponseHeader' and 'XMLHttpRequest.getAllResponseHeaders'
APIs. (MFSA 2009-05)\n\n - The 'Cache-Control: no-store' and 'Cache-Control: no-cache'
HTTP directives for HTTPS pages are ignored by Firefox 3, which could lead to exposure
of sensitive information. (MFSA 2009-06).\n\nThe reported version of Firefox is: \n %L
Solution: Upgrade to version 3.0.6 or higher.
CVE-2009-0358
Squid < 2.7.STABLE6 / 3.0.STABLE13 / 3.1.0.5 HTTP Version Numbers DoS
PVS ID: 4923 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:35620
Description: Synopsis : \n\nThe remote proxy server is susceptible to a denial of service attack.\n\nThe
version of the Squid proxy caching server installed on the remote host may abort when
parsing requests with an invalid HTTP version. A remote attacker may be able to leverage
this issue to crash the application, thereby denying service to legitimate users.\n\nNote that
successful exploitation of this issue requires that Squid was not built with the 'NODEBUG'
define.\nThe reported version of Squid is: \n %L
Solution: Either apply the appropriate patches referenced in the project's advisory above or upgrade
to version 2.7.STABLE6 / 3.0.STABLE13 / 3.1.0.5 or higher.
CVE-2009-0478
Moodle < 1.9.4 / 1.8.8 / 1.7.7 / 1.6.9 Multiple Vulnerabilities
PVS ID: 4924 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
Moodle installed on the remote host is vulnerable to a number of flaws. First, the server is
vulnerable to a cross-site scripting (XSS) flaw. An attacker exploiting this flaw would be
able to execute arbitrary code within the browser of unsuspecting users. The remote host is
vulnerable to a cross-site request forgery (CSRF) flaw that could allow remote users to
execute commands on the behalf of logged in users. Finally, there are several 'information
disclosure' flaws that may allow an attacker the ability to gain access to confidential data.
The reported version of Moodle is: \n %L \n
Solution: Upgrade to version 1.6.9, 1.7.7, 1.8.8, 1.9.4 or higher.
CVE Not available
Openfire < 3.6.3 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4925 FAMILY: CGI NESSUS ID:35628
Family Internet Services 1299