(PVS) Signatures - Tenable Network Security

Description: The remote web server is hosting .pptx files. These are Microsoft Office 2007
document files. As an example, consider the following file %P\nThe webmaster
should make sure that they do not contain confidential data.
Solution: N/A
CVE Not available
Firefox < 3.0.7 Multiple Vulnerabilities
PVS ID: 4950 FAMILY: Web Clients RISK: HIGH NESSUS ID:35778
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe installed
version of Firefox is earlier than 3.0.7. Such versions are potentially affected by the
following security issues : \n\n - By exploiting stability bugs in the browser engine, it might
be possible for an attacker to execute arbitrary code on the remote system under certain
conditions. (MFSA 2009-07)\n\n - A vulnerability in Mozilla's garbage collection process
could be exploited to run arbitrary code on the remote system. (MFSA 2009-08)\n\n - It
may be possible for a website to read arbitrary XML data from another domain by using
nsIRDFService and a cross-domain redirect. (MFSA 2009-09)\n\n - Vulnerabilities in the
PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote
system. (MFSA 2009-10)\n\n - Certain invisible characters are decoded before being
displayed on the location bar. An attacker may be able to exploit this flaw to spoof the
location bar and display a link to a malicious URL. (MFSA 2009-11).\n\nThe reported
version of Firefox is: \n %L
Solution: Upgrade to version 3.0.7 or higher.
CVE-2009-0777
ZABBIX < 1.6.3 Web Interface locales.php extlang[] Remote Code Execution
PVS ID: 4951 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:35787
Description: Synopsis : \n\nThe remote host contains a PHP application that is prone to a remote
command execution attack.\n\nThe remote host is running a version of the ZABBIX web
interface that is affected by a remote code execution vulnerability. The vulnerability exists
in the 'extlang[]' parameter of the 'locales.php' script. Provided PHP's 'magic_quotes_gpc'
setting is disabled, an unauthenticated remote attacker can exploit this to execute arbitrary
code on the remote host subject to the privileges of the web server user ID. Note that this
version of the ZABBIX web interface is also likely affected by a local file inclusion
vulnerability and a cross-site request forgery vulnerability. The reported version of
ZABBIX is: \n %L \n
Solution: Upgrade to version 1.6.3 or higher.
CVE Not available
FileZilla < 0.9.31 SSL/TLS Packet Overflow DoS
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1307