(PVS) Signatures - Tenable Network Security

CVE-2010-1349
Mozilla Firefox < 3.6.2 Multiple Vulnerabilities.
PVS ID: 5485 FAMILY: Web Clients RISK: HIGH NESSUS ID:45133
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host is running a version of Mozilla Firefox 3.6.x earlier than
3.6.2. Such versions are potentially affected by multiple security issues : \n\n - The WOFF
decoder contains an integer overflow in a font decrompression routine. (MFSA
2010-08)\n\n - Deleted image frames are reused when handling 'multipart/x-mixed-replace'
images. (MFSA 2010-09)\n\n - The 'window.location' object is made a normal overridable
object. (MFSA 2010-10)\n\n - Multiple crashes can result in arbitrary code execution.
(MFSA 2010-11)\n\n - A cross-site scripting issue when using 'addEventListener' and
'setTimeout' on a wrapped object. (MFSA 2010-12)\n\n - Documents fail to call certain
security checks when attempting to preload images. (MFSA 2010-13)\n\n - It is possible to
corrupt a user's XUL cache. (MFSA 2010-14)\n\n - The asynchronous Authorization
Prompt is not always attached to the correct window. (MFSA 2010-15)\n\n - Multiple
crashes cna result in arbitrary code execution. (MFSA 2010-16)\n\n - An error exists in the
way '' elements are inserted into a XUL tree ''. (MFSA 2010-18)\n\n -
An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA
2010-19)\n\n - A browser applet can be used to turn a simple mouse click into a
drag-and-drop action, potentially resulting in the unintended loading of resources in a user's
browser. (MFSA 2010-20)\n\n - Session renegotiations are not handled properly, which can
be exploited to insert arbitrary plaintext by a man-in-the-middle. (MFSA 2010-22)\n\n -
When an image points to a resource that redirects to a 'mailto: ' URL, the external mail
handler application is launched. (MFSA 2010-23)\n\n - XML documents fail to call certain
security checks when loading new content. (MFSA 2010-24)\n\nFor your information, the
observed version of Firefox is: \n %L
Solution: Upgrade to Mozilla Firefox 3.6.2 or later.
CVE-2010-1028
Serv-U < 9.4.0.0 Multiple Vulnerabilities
PVS ID: 5486 FAMILY: FTP Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:45140
Description: Synopsis : \n\nThe remote FTP server is vulnerable to multiple attack vectors.\n\nThe
remote host is running Serv-U File Server, an FTP server for Windows. According to its
banner, the installed version of Serv-U is earlier than 9.4.0.0, and is therefore potentially
affected by the following issues : \n\n - When importing users, restricted administrators
could create user accounts outside their home directory.\n\n - When exporting users,
restricted administrators could see a user's full path for home directory, virtual paths, and
directory access rules.\n\n - A restricted domain administrator could create a user or group
that was not locked in the user's home directory.\n\n - A denial of service issue when
handling a large number of concurrent HTTP requests.\n\nFor your information, the
observed version of Serv-U is: \n %L
Solution: Upgrade to Serv-U version 9.4.0.0 or later.
Family Internet Services 1465