27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Solution: Upgrade to Bugzilla 3.2.4/3.4 RC1<br />

CVE Not available<br />

WordPress < 2.8.1 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 5096 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote web server is running a PHP application that is vulnerable to<br />

multiple attack vectors.\n\nThe remote host is running a version of WordPress earlier than<br />

2.8.1. Such versions are reportedly affected by multiple vulnerabilities : \n\n - A username<br />

enumeration weakness caused by the application displaying different responses to login<br />

requests depending on the existence of the supplied username. (CVE-2009-2334)\n\n - A<br />

security-bypass vulnerability in the 'wp-admin/admin.php' script when it is called with the<br />

'pages' parameter set to a plug-in configuration page. An authenticated attacker could<br />

exploit this to gain access to configuration scripts. (CVE-2009-2335)\n\nThe reported<br />

version of WordPress is: \n %L<br />

Solution: Upgrade to WordPress 2.8.1/WordPress MU 2.8.1 or later.<br />

CVE-2009-2336<br />

MediaWiki 1.14.0/1.15.0 Cross-Site Scripting Vulnerability<br />

<strong>PVS</strong> ID: 5097 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote web server is running a PHP application that is affected by a<br />

cross-site scripting vulnerability.\n\nThe remote web server is running MediaWiki 1.14.0 or<br />

1.15.0. These versions reportedly fail to properly supply user-supplied input to the 'ip'<br />

parameter of the 'Special: Blocks' page. An attacker could exploit this flaw to launch<br />

cross-site scripting attacks. The reported version of MediaWiki is: \n %L<br />

Solution: Upgrade to MediaWiki 1.14.1/1.15.1 or later.<br />

CVE-2009-4589<br />

eDirectory < 8.8 SP5 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 5098 FAMILY: Generic<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host<br />

is running eDirectory, a directory service from Novell. The installed version is earlier than<br />

8.8 SP5. Such versions are reportedly affected by multiple vulnerabilities : \n\n - An HTTP<br />

request containing a specially crafted 'Accept-Language' header can trigger a stack-based<br />

buffer-overflow. This issue affects the iMonitor service. (Bug 484007/446342)\n\n - A<br />

denial of service vulnerability exists when multiple wild-cards are used in RDN. (Bug<br />

458504)\n\n - A malformed bind LDAP packet can cause eDir to crash. (Bug<br />

Family Internet Services 1352

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!