27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

version of nginx is: \n %L<br />

Solution: Upgrade to nginx 0.5.38, 0.6.39, 0.7.62, or 0.8.15.<br />

CVE-2009-2629<br />

Debian devscripts 'uscan' Input Validation Vulnerability<br />

<strong>PVS</strong> ID: 5175 FAMILY: Web Clients RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote host is vulnerable to a remote code execution<br />

attack.\n\nThe remote host is running a version of devscripts uscan that is<br />

potentially affected by a code execution vulnerability. The application runs Perl<br />

code downloaded from potentially untrusted sources to implement its URL and<br />

version mangling functionality. An attacker could exploit this flaw to execute<br />

arbitrary code on the remote host. For your information, the reported version of<br />

devscripts uscan is: \n %L<br />

Solution: Upgrade to devscripts uscan 2.9.6 / 2.10.35<br />

CVE-2009-2946<br />

Google Chrome < 3.0.195.21 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 5176 FAMILY: Web Clients<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:41000<br />

Description: Synopsis : \n\nThe remote host contains a web browser that is vulnerable to multiple attack<br />

vectors.\n\nThe version of Google Chrome installed on the remote host is earlier than<br />

3.0.195.21. Such versions are potentially affected by multiple issues : \n\n - Google<br />

Chrome's inbuilt RSS/ATOM reader renders untrusted JavaScript in an RSS/ATOM feed.<br />

(#21238)\n\n - It may be possible to bypass the same origin policy via the<br />

getSVGDocument() function (#21338)\n\nFor your information, the reported version of<br />

Google Chrome is: \n %L<br />

Solution: Upgrade to Google Chrome 3.0.195.21 or later.<br />

CVE-2009-3264<br />

Best Practical Request Tracker 'Custom Field' HTML Injection Vulnerability<br />

<strong>PVS</strong> ID: 5177 FAMILY: CGI<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote host is running a web application that is affected by a<br />

HTML-injection vulnerability.\n\nThe remote host is running Best Practical Solutions RT,<br />

an enterprise-grade ticketing system. The version detected is potentially affected by an<br />

HTML-injection vulnerability caused by the application failing to properly sanitize<br />

user-supplied input to 'Custom Field' values. Note that this issue only exists if the<br />

installation is using Custom Fields. For your information, the reported version of RT is : \n<br />

%L<br />

Family Internet Services 1377

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!