(PVS) Signatures - Tenable Network Security

CVE-2009-2417
ViewVC < 1.0.9 Multiple Vulnerabilities
PVS ID: 5131 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running ViewVC, a web-based interface for CVS and Subversion. The installed version
of ViewVC is earlier than 1.0.9. Such versions are potentially affected by multiple issues :
\n\n - A cross-site scripting vulnerability in the 'view' parameter.\n\n - An unspecified
vulnerability that may allow attackers to print illegal parameter names and values.\n\nFor
your information, the reported version of ViewVC is: \n %L
Solution: Upgrade to ViewVC 1.0.9 or later.
CVE Not available
Sun Java System Access Manager 7.1 < Patch 2 Multiple Vulnerabilities
PVS ID: 5132 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:35618
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of Sun Java System Access Manager 7.1 earlier than Patch 2. Such
versions are potentially affected by multiple issues : \n\n - A vulnerability may allow
unauthorized access to resources by revealing passwords to remote users who have
privileges to access the administration console. (1-66-242166-1)\n\n - A sub-realm
administrator may be able to escalate their privileges and access the root realm as an
administrator. (1-66-249106-1)\n\n - A username-enumeration weakness could allow an
attacker to determine valid user-names. (1-66-242026-1)\n\nFor your information, the
installed version of Sun Java System Access Manager is: \n %L \nIAVT Reference :
2009-T-0007\nSTIG Finding Severity : Category II
Solution: Upgrade to Sun Java System Access Manager 7.1 Patch 2. This may require different
patches depending on your installation type.
CVE-2009-0348
Passive Vulnerability Scanner (PVS) Signatures
Sun Java System Access Manager 7.1 < Patch 3 Multiple Vulnerabilities
PVS ID: 5133 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of Sun Java System Access Manager 7.1 earlier than Patch 3. Such
versions are potentially affected by multiple issues :\n\n - A vulnerability related to the
CDCServlet component may result in policy advice being presented to the wrong client.
(1-66-25968-1)\n\n - The software amy disclose clear text passwords in debug files when
the debug flag is enabled. A local unprivileged user could gain unauthorized access to user
identities.\n\n - A vulnerability may exist when the server processes specially crafted XML
Family Internet Services 1363