(PVS) Signatures - Tenable Network Security

to crash the browser or potentially execute arbitrary code by using a flash object that
presents a slow script dialog. (MFSA 2009-35)\n\n - Glyph rendering libraries are affected
by multiple heap/integer overflows. (MFSA 2009-36)\n\n - A vulnerability involving SVG
element could be exploited to crash the browser or execute arbitrary code on the remote
system. (MFSA 2009-37)\n\n - A vulnerability in 'setTimeout' could allow unsafe access to
the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary
JavaScript with chrome privileges. (MFSA 2009-39)\n\n - It may be possible for JavaScript
from one website to bypass cross-origin wrapper, and unsafely access properties of an
object from another website. (MFSA 2009-40)
Solution: Upgrade to Firefox 3.0.12 or later.
CVE-2009-2472
Joomla! < 1.5.13 Multiple Vulnerabilities
PVS ID: 5102 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors\n\nThe installed
version of Joomla! is earlier than 1.5.13. Such versions are reportedly affected by multiple
vulnerabilities :\n\n - A flaw which affects the TinyMCE editor would allow a remote
attack to upload and execute arbitrary files\n\n - A failure to parse user-supplied input to
'JEXEC' would allow a remote attacker to glean internal path information
Solution: Upgrade to Joomla! 1.5.13 or later.
CVE Not available
RaidenHTTPD workspace.php ulang Parameter Local File Inclusion
PVS ID: 5103 FAMILY: Web Servers RISK: HIGH NESSUS ID:29728
Description: Synopsis :\n\nThe remote web server contains a PHP script that is susceptible to a local file
include attack.\n\nThe remote host is running RaidenHTTPD, a web server for Windows.
The version of RaidenHTTPD installed on the remote host fails to sanitize user-supplied
input to the 'ulang' parameter in scripts '/raidenhttpd-admin/workspace.php' and
'/raidenhttpd-admin/menu.php' before using it to include PHP code. Provided the server's
WebAdmin feature has been enabled, an unauthenticated remote attacker can leverage this
issue to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to
the privileges under which the server operates, which is SYSTEM by default.
Solution: Upgrade to RaidenHTTPD Server 2.0.27 or later.
CVE-2007-6453
CommuniGate Pro POP3 < 5.1c2 Buffer Overflow
PVS ID: 5104 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Family Internet Services 1354