(PVS) Signatures - Tenable Network Security

CVE-2010-0393
MyBB < 1.4.12 Multiple Vulnerabilities
PVS ID: 5513 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server is running a PHP application that is vulnerable to
multiple attack vectors.\n\nThe remote web server is running a version of MyBB earlier
than 1.4.12. Such versions are potentially affected by multiple issues : \n\n - There is a
weakness in the mechanism for generating random passwords. (Bug 843)\n\n - It is possible
to inject arbitrary headers into email sent to MyBB users.\n\n - An unspecified XSRF issue
exists in the usercp2.php script. (Bug 852)\n\nFor your information, the observed version of
MyBB is: \n %L
Solution: Upgrade to MyBB 1.4.12 or later.
CVE Not available
Memcached < 1.4.3 No Newline Memory Consumption DoS
PVS ID: 5514 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:45579
Description: Synopsis : \n\nThe remote host is vulnerable to a denial of service attack.\n\nThe remote
host is running memcached, a distributed memory object caching system. The installed
version of memcached is earlier than 1.4.3. Such versions are potentially affected by a
denial of service vulnerability because the application continues to read in new data,
reallocating its input buffer until a newline character is received which could lead to
excessive memory consumption. An attacker, exploiting this flaw, could crash the affected
service.\nFor your information, the observed version of memcached is: \n %L
Solution: Upgrade to memcached 1.4.3 or later.
CVE-2010-1152
Altiris Deployment Solution < 6.9 SP4 DBManager DoS (SYM10-007)
PVS ID: 5515 FAMILY: Generic
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:45592
Description: Synopsis : \n\nThe remote Windows host has a deployment server that is affected by a
denial of service vulnerability.\n\nThe version of Altiris Deployment Solution installed on
the remote host is earlier than 6.9 SP4. Such versions are reportedly affected by a denial of
service vulnerability. The DBManager component has a user-after-free error when
processing specially crafted 'CreateSession' and 'PXEManagerSignOn' requests. A remote
attacker could exploit this to crash the DBManager service.\nFor your information, the
observed version of Altiris Deployment Solution is: \n %L
Solution: Upgrade to Altiris Deployment Solution Server 6.9 SP4 or later.
Family Internet Services 1476