(PVS) Signatures - Tenable Network Security

(CVE-2009-1467)\n\n - A cross site-scripting vulnerability exists because the applciation
fails to properly sanitize RSS feeds. An attacker can exploit this flaw through the
'cleanHTML()' function of the 'html/webmail/server/inc/rss/rss.php' script.
(CVE-2009-1467)\n\n - An input validation flaw in the 'Forgot Password' function on the
login page. (CVE-2009-1469)\n\nAn attacker could exploit these flaws to steal sensitive
information, upload files, or possibly execute arbitrary code subject to the privileges of the
affected application.\n\nFor your information, the version of IceWarp installed is : \n %L
Solution: Upgrading to IceWarp Merak WebMail Server version 9.4.2 or later reportedly resolves the
issues.
CVE-2009-1469
Google Chrome < 1.0.154.64 Multiple Vulnerabilities
PVS ID: 5020 FAMILY: Web Clients RISK: HIGH NESSUS ID:38699
Description: Synopsis : \n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nThe version of Google Chrome installed on the remote host is earlier than
1.0.154.64. Such versions are reportedly affected by multiple vulnerabilities : \n\n - A
failure to properly validate input from a renderer (tab) process could allow an attacker to
crash the browser and possibly run arbitrary code with the privileges of the logged on user.
(CVE-2009-1441)\n\n - A failure to check the result of integer multiplication when
computing image sizes could allow a specially-crafted image or canvas to cause a tab to
crash and possibly allow an attacker to execute arbitrary code inside the (sandboxed)
renderer process. (CVE-2009-1442)\n\nFor your information, the exact browser version is:
\n %L
Solution: Upgrade to Google Chrome 1.0.154.64 or newer.
CVE-2009-1442
AVG Scanning Engine UPX Parsing Denial of Service Vulnerability
PVS ID: 5021 FAMILY: Web Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a flaw which allows malcode to be
passed\n\nAVG Anti-Virus is installed on the remote Windows host. The version of AVG
Anti-Virus installed on the remote host is affected by a flaw wherein remote attackers can
bypass the scanning engine by sending specially formatted 'rar' and 'zip' archive files. An
attacker, exploiting this flaw, would only need the ability to send email to valid recipients
on the target server. Successful exploitation would result in the attacker being able to pass
malware through the AVG server. For your information, the reported version, build, and
license key is: \n %L \n
Solution: Upgrade to AVG 8.5 323 or later.
CVE-2009-1784
A-A-S Server Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1329