27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Typically such an attack would result in a denial of service condition or arbitrary code<br />

execution. An attacker could also trigger this issue from a rogue Subversion server on a<br />

Subversion client in response to a checkout or update request. For your information, the<br />

reported version of SVN is: \n %L<br />

Solution: Upgrade to SVN 1.5.7/1.6.4 or later.<br />

CVE-2009-2411<br />

Google Chrome < 2.0.172.43 Remote Code Execution<br />

<strong>PVS</strong> ID: 5141 FAMILY: Web Clients RISK: HIGH NESSUS ID:40778<br />

Description: Synopsis : \n\nThe remote host contains a web browser that is vulnerable to a remote code<br />

execution attack.\n\nThe version of Google Chrome installed on the remote host is earlier<br />

than 2.0.172.43. Such versions have a flaw in the V8 Javascript engine which could<br />

potentially allow specially-crafted Javascript on a eb page to read unauthorize memory,<br />

bypassing security checks. An attacker could exploit this to run arbitrary code within the<br />

Chrome sand-box. For your information, the reported version of Google Chrome is: \n %L<br />

Solution: Upgrade to Google Chrome 2.0.172.43 or later.<br />

CVE-2009-2935<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

IBM WebSphere Application Server 7.0 < Fix Pack 5 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 5142 FAMILY: Web Servers RISK: HIGH NESSUS ID:40823<br />

Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack<br />

vectors.\n\nIBM WebSphere Application Server 7.0 before Fix Pack<br />

5 appears to be running on the remote host. Such versions are<br />

reportedly affected by multiple vulnerabilities.\n\n - Invoking an<br />

MBean that does not have type key-property results in a<br />

NullPointerException. (PK78743)\n\n - Deployment fails to properly<br />

handle password in webservices client modules. (PK79275)\n\n -<br />

IBM-portlet-ext.xmi is not reading correctly the portlet serving<br />

enable parameter. (PK89385)\n\n - An attacker may be able to obtain<br />

sensitive information, caused by an error during the migration from<br />

WebSphere Application Server 6.1 to 7.0 when tracing is enabled.<br />

(PK80337)\n\n - Deploying new applications on WebSphere<br />

Application Server for z/OS prior to 1.8 can result in the application<br />

being saved on the file system with insecure permissions.<br />

(PK83308)\n\n - A security-bypass vulnerability due to a design<br />

error in the Single Sign-on with SPENEGO implementation. When<br />

setting the custom property<br />

'ws.webcontainer.invokefilterscompatibility' to true, an attacker can<br />

bypass the SSO authentication on security URLs. (PK77465)\n\n A<br />

security-bypass vulnerability due to an unspecified error when<br />

configured with CSIv2 <strong>Security</strong> is configured with Identity<br />

Assertion. (PK83097)\n\nFor your information, the reported version<br />

Family Internet Services 1366

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!