(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host is vulnerable to a man-in-the-middle attack.\n\nThe remote
mail server is running a version of Sendmail earlier than 8.14.4. Such versions are
potentially affected by a flaw that my allow an attacker to spoof SSL certificates by using a
NULL character in certain certificate fields. For your information, the observed version of
Sendmail is: \n %L \nIAVA Reference : 2010-A-0002\nSTIG Finding Severity : Category I
Solution: Upgrade to Sendmail 8.14.4 or later.
CVE-2009-4565
Dada Mail < 4.0.2 List Membership Requirement Bypass
PVS ID: 5294 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server is hosting an application that is affected by a security
bypass vulnerability.\n\nThe remote web server is hosting Dada Mail, a web-based mailing
list application. The installed version is earlier than 4.0.2. Such versions, when using the
'Dada Bridge' plugin, are potentially affected by a security bypass vulnerability because the
application does not verify that the sender of an email is a member of a list. An attacker
could exploit this flaw to spam the email list. For your information, the observed version of
Dada Mail is: \n %L
Solution: Upgrade to Dada Mail 4.0.2 or later.
CVE Not available
Novell iManager < 2.7 SP3 eDirectory Plugin Buffer Overflow Vulnerability
PVS ID: 5295 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server is affected by a buffer overflow
vulnerability.\n\nNovell iManager is installed on the remote host. The version of iManager
is earlier than 2.7 SP3 and is therefore potentially affected by a buffer overflow
vulnerability in the eDirectory plugin. A remote attacker, exploiting this flaw, could
potentially execute arbitrary code. For your information, the observed version of Novell
iManager is: \n %L
Solution: Upgrade to Novell iManager 2.7 SP3 (iManager 2.7.3).
CVE-2009-4486
Liferay Portal 'p_p_id' Parameter HTML Injection
PVS ID: 5296 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server is hosting an application that is vulnerable to a
HTML-injection attack.\n\nThe remote web server is running Liferay Portal, a Java-based
web portal. The installed version is earlier than 5.3.0. Such versions are potentially affected
by an HTML injection vulnerability because the application fails to properly sanitize
Family Internet Services 1415