(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote
Windows host contains a version of Adobe AIR player that is earlier than 1.5.3. Such
versions are reportedly affected by multiple vulnerabilities : \n\n - A vulnerability in the
parsing of JPEG data that could potentially lead to code execution. (CVE-2009-3794)\n\n -
A data injection vulnerability that could potentially lead to code execution.
(CVE-2009-3796)\n\n - A memory corruption vulnerability that could potentially lead to
code execution. (CVE-2009-3797)\n\n - A memory corruption vulnerability that could
potentially lead to code execution. (CVE-2009-3798)\n\n - An integer overflow
vulnerability that could potentially lead to code execution. (CVE-2009-3799)\n\n - Multiple
crash vulnerabilities that could potentially lead to code execution. (CVE-2009-3800)\n\n -
A Windows-only local file name access vulnerability in the Flash Player ActiveX control
that could potentially lead to information disclosure. (CVE-2009-3951)\n\nFor you
information, the observed version of Adobe AIR is: \n %L
Solution: Upgrade to Adobe AIR 1.5.3 or later.
CVE-2009-3951
Moodle < 1.8.11 / 1.9.7 Multiple Vulnerabilities
PVS ID: 5257 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
Moodle installed on the remote host is potentially vulnerable to multiple flaws.\n\n -
Multiple cross-site request forger issues. (MSA-09-0022)\n\n - User account disclosure in
LAMS module. (MSA-09-0023)\n\n - Insufficient access control may allow unauthorized
users to view glossary entries. (MSA-09-0024)\n\n - Invalid application access control in
MNET interface could allow execution of any MNET function from all registered remote
servers. (MSA-09-0026)\n\n - Login information can be sent unsecured even when a site is
configured to use SSL for logins. (MSA-09-0027)\n\n - A SQL injection issue in the
SCORM module. (MSA-09-0031)\n\nFor your information, the observed version of
Moodle is: \n %L
Solution: Upgrade to Moodle version 1.8.11, 1.9.7, or later.
CVE-2009-4305
TestLink < 1.8.5 Multiple Vulnerabilities
PVS ID: 5258 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:43101
Description: Synopsis : \n\nThe remote web server is vulnerable to multiple attack vectors.\n\nThe
remote web server is hosting TestLink, a PHP-based testing suite. The installed version of
TestLink is earlier than 1.8.5. Such versions are potentially affected by multiple
vulnerabilities.\n\n - A cross-site scripting vulnerability in the 'req' parameter of the
'login.php' script which does not require credentials to exploit.\n\n - Cross-site scripting
vulnerabilities in the 'key' parameter of the '/lib/general/staticPage.php script, the
'tableName' parameter of the '/lib/attachments/attachmentupload.php' script, and the
'startDate', 'endDate', and 'logLevel' parameters of the '/lib/events/eventviewer.php' script. -
Family Internet Services 1403