(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote web server is hosting an application that is vulnerable to
multiple attack vectors.\n\nThe remote web server is hosting a version of Bugzilla that is
earlier than 3.0.11, 3.2.6, 3.4.5, or 3.5.3. Such versions are potentially affected by multiple
vulnerabilities : \n\n - Bugzilla allows web browsers to serve the contents of files in the
'CVS/', 'contrib/', 'docs/en/xml', and 't/' directories as well as the 'old-params.txt' file.\n\n -
When moving a bug from one product to another, an intermediate web page is displayed
letting you select the groups the bug should be restricted to in the new product. Because of
a regression in Bugzilla 3.4.x involving groups, a private bug could temporarily become a
public.\n\nFor your information, the observed version of Bugzilla is: \n %L
Solution: Upgrade to Bugzilla 3.0.11, 3.2.6, 3.4.5, 3.5.3, or later.
CVE-2009-3989
Squid 3.0STABLE23 / 3.1.0.16 Remote DoS
PVS ID: 5332 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:44384
Description: Synopsis : \n\nThe remote host is vulnerable to a Denial of Service (Dos)
attack.\n\nAccording to its banner, the version of Squid proxy caching server installed on
the remote host is 2.x or 3.x earlier than 3.0.STABLE23 or 3.1.0.16. Such versions
reportedly use incorrect data validation when processing specially crafted DNS packets. An
attacker, exploiting this flaw, could cause a short term denial of service. For your
information, the observed version of Squid is: \n %L
Solution: Either upgrade to Squid version 3.0.STABLE23 or 3.1.0.16 or later, or apply the patch
referenced in the project's advisory above.
CVE-2010-0308
MySQL 6.0 < 6.0.9 CREATE TABLE Security Bypass
PVS ID: 5333 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to security bypass attack.\n\nThe version of
MySQL 6.0 installed on the remote host is earlier than 6.0.9, and thus potentially affected
by a security bypass vulnerability. The application allwos an attacker to bypass certain
checks when creating a table with ceratin 'DATA DIRECTORY' and 'INDEX
DIRECTORY' options that are within the MySQL home data directory. For you
information, the observed version of MySQL is: \n %L
Solution: Upgrade to MySQL Community Server version 6.0.9 or later.
CVE-2008-7247
Passive Vulnerability Scanner (PVS) Signatures
OTRS Core System Multiple Unspecified SQL Injection Vulnerabilities
PVS ID: 5334 FAMILY: CGI NESSUS ID:Not Available
Family Internet Services 1427