(PVS) Signatures - Tenable Network Security

RISK:
MEDIUM
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running Pidgin < 2.6.1. Such versions are potentially affected by multiple issues : \n\n -
A denial-of-service vulnerability because it fails to properly handle malformed links sent
via the Yahoo Instant Messenger protocol. (CVE-2009-3025)\n\n - A man-in-the-middle
vulnerability exists because the application does not require the TLS/SSL preference to be
enabled when connecting to older Jabber servers. (CVE-2009-3026)\n\nFor your
information, the reported version of Pidgin is: \n %L
Solution: Upgrade to Pidgin 2.6.1 or later.
CVE-2009-3026
Bugzilla < 3.0.9/3.2.5/3.4.2 Multiple Vulnerabilities
PVS ID: 5169 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running Bugzilla, a bug-tracking software with a web interface. The version of Bugzilla
on the remote host is potentially affected by multiple flaws : \n\n - A SQL injection
vulnerability in the 'Bug.search' WebService function. (CVE-2009-3125)\n\n - A SQL
injection vulnerability in the 'Bug.create WebService function. (CVE-2009-3165)\n\n -
When a user reset their password and then logged in immediately afterward, their password
would appear in the URL of their browser. (CVE-2009-3166)\n\nFor your information, the
installed version of Bugzilla is: \n %L
Solution: Upgrade to Bugzilla 3.0.9, 3.2.5, or 3.4.2.
CVE-2009-3166
PostgreSQL Multiple Vulnerabilities
PVS ID: 5170 FAMILY: Database
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:40947
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running PostgreSQL, a database application. The version of PostgreSQL is potentially
affected by multiple issues : \n\n - Authenticated non-superusers can shut down the
backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present
there.\n\n - A privilege escalation issue allows some actions to be performed with superuser
privileges instead of table owner privileges. This is related to the fix for CVE-2007-6600
which failed to include protection against misuse of 'RESET SESSION
AUTHORIZATION'.\n\n - If PostgreSQL is configured with LDAP authentication, and
your LDAP configuration allows anonymous binds, it is possible for a user to authenticate
themselves with an empty password.\n\nFor your information, the installed version of
PostgreSQL is: \n %L
Solution: Upgrade to PostgreSQL 8.0.22, 8.1.18, 8.2.14, 8.3.8, or 8.4.1.
Family Internet Services 1375