(PVS) Signatures - Tenable Network Security

to create a URL which contains look-alike characters. (CVE-2009-2199)\n\n - A heap
buffer overflow exists in the handling of AAC or MP3 files. (CVE-2009-2206)\n\n -
Spotlight finds and allows access to deleted messages in Mail folders on the device.
(CVE-2009-2207)\n\n - The iPhone OS allows users to specify a 'Require Passcode' setting
that may be greater than the 'Maximum Inactivity time lock' setting from Microsoft
Exchange servers. (CVE-2009-2794)\n\n - A heap buffer overflow exists in Recovery
Mode command parsing. (CVE-2009-2795)\n\n - When a character in a password is
deleted, and the deletion is undone, the character is briefly made visible.
(CVE-2009-2796)\n\n - Safari includes the user name and password from the original URL
in the referer header. (CVE-2009-2797)\n\n - A null pointer dereference issue exists in the
handling of SMS arrival notifications. (CVE-2009-2815)\n\nFor your information, the
observed banner was: \n %L
Solution: Upgrade to Apple iPhone OS 3.1
CVE-2009-2815
Mozilla Firefox < 3.0.14 / 3.5.3 Multiple Vulnerabilities
PVS ID: 5161 FAMILY: Web Clients RISK: HIGH NESSUS ID:40930
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe installed
version of Mozilla Firefox is earlier than 3.0.14 / 3.5.3. Such versions are potentially
affected by multiple issues : \n\n - Multiple memory corruption vulnerabilities in the
browser engine. (MFSA 2009-47)\n\n - When security modules are added or removed via
pkcs11.addmodule or pkcs11.deletemodule, the resulting dialogue was not sufficiently
informative which could lead an attacker to entice a victim to install a malicious PKCS11
module. Note that Firefox 3.5.x releases are not affected. (MFSA 2009-38)\n\n - The
columns of a XUL tree element could be manipulated in a particular way which would
leave a pointer owned by the column pointing to freed memory. (MFSA 2009-49)\n\n - The
default Windows font used to render the locationbar and other text fields was improperly
displaying certain Unicode characters with tall line-height. (MFSA 2009-50)\n\n - The
'BrowserFeedWriter' could be leveraged to run JavaScript code from web content with
elevated privileges. (MFSA 2009-51)\n\nFor your information, the installed version of
Firefox is: \n %L
Solution: Upgrade to Mozilla Firefox 3.5.3/3.0.14 or later.
CVE-2009-3079
Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities
PVS ID: 5162 FAMILY: Generic RISK: HIGH NESSUS ID:40946
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running a version of Mac OS X 10.6 that is older than version 10.6.1. Mac OS X 10.6.1
contains security fixes for the following product : \n\n - Flash Player plug-in\n\nFor your
information, the reported version of Mac OS X is: \n %L
Solution: Upgrade to Mac OS X 10.6.1 or later.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1372