(PVS) Signatures - Tenable Network Security

RISK:
MEDIUM
Description: Synopsis : \n\nThe remote web server is affected by multiple vulnerabilities.\n\nThe
version of Apache Tomcat installed on the remote host is affected by a multiple
vulnerabilities : \n\n - A username enumeration vulnerability exists when FORM based
authentication with either the MemoryRealm, DataSourceRealm, or JDBCRealm is used.
(CVE-2009-0580)\n\n - A denial of service exists if Tomcat receives a request with invalid
headers via the Java AJP connector. (CVE-2009-0033)\n\n - A remote
information-disclosure vulnerability exists in the 'RequestDispatcher' can be exploited to
gain access to content in the 'WEB-INF' directory. (CVE-2008-5515)\n\n - It is possible for
a web application to replace the XML parser used by Tomcat to process 'web.xml',
'context.xml', and 'tld' files.\n\nFor your information, the reported version of Apache
Tomcat is : \n %L
Solution: Upgrade to Apache Tomcat 4.1.40 / 5.5.28 / 6.0.20
CVE-2009-0783
LogMeIn 'cfgadvanced.html' HTTP Header Injection
PVS ID: 5045 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is affected by a HTTP header injection
vulnerability.\n\nThe remote host is a LogMeIn server awaiting remote connections. The
installed version of LogMeIn is 4.0.784 or earlier. Such versions are reportedly affected by
a HTTP header injection vulnerability. An attacker could exploit this in order to launch
various attacks including cross-site scripting, and cross-site request forgery. For your
information, the installed version is: \n %L
Solution: Disable this service if it is not needed.
CVE Not available
Safari < 4.0 Multiple Vulnerabilities
PVS ID: 5046 FAMILY: Web Clients RISK: HIGH NESSUS ID:39339
Description: Synopsis : \n\nThe remote host contains a web browser that is affected by several
issues.\n\nThe version of Safari installed on the remote host is earlier than 4.0. Such
versions are potentially affected by numerous issues in the following components : \n\n -
CFNetwork\n\n - CoreGraphics\n\n - ImageIO\n\n - International Components for
Unicode\n\n - libxml\n\n - Safari\n\n - Safari Windows Installer\n\n - WebKit\n\nFor your
information, the reported version of Safari is : \n %L
Solution: Upgrade to Safari 4.0 or later.
CVE-2009-1718
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1337