(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host contains an application that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of iTunes is %L.\n\nVersions of
iTunes older than 9.2 are potentially affected by multiple vulnerabilities :\n\n - A heap
buffer overflow in the handling of images with an embedded ColorSync profile may lead to
an application crash or arbitrary code execution. (CVE-2009-1726)\n\n - Multiple integer
overflows in ImageIO's handling of TIFF files may lead to an application crash or arbitrary
code execution. (CVE-2010-1411)\n\n - Multiple vulnerabilities in WebKit may have a
variety of effects, including arbitrary code execution. (CVE-2010-0544, CVE-2010-1119,
CVE-2010-1387, CVE-2010-1390, CVE-2010-1392, CVE-2010-1393, CVE-2010-1395,
CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400,
CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405,
CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1414,
CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419,
CVE-2010-1421, CVE-2010-1422, CVE-2010-1749, CVE-2010-1758, CVE-2010-1759,
CVE-2010-1761, CVE-2010-1763, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771,
CVE-2010-1774)
Solution: Upgrade to iTune 9.2 or later.
CVE-2010-1774
CUPS < 1.4.4 Multiple Vulnerabilities
PVS ID: 5574 FAMILY: Web Servers RISK: HIGH NESSUS ID:47683
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running CUPS, an open source print server. For your information, the observed version
of CUPS is %L.\n\nVersions of CUPS earlier than 1.4.4 are potentially affected by multiple
vulnerabilities.\n\n - The texttops filter does not check the results of memory allocations.
(STR #3715)\n\n - A use-after-free vulnerability in the abstract file-descriptor handling
interface. Note that this is related to an incomplete patch for CVE-2009-3553. (STR
#3490)\n\n - In certain instances, the web interface can disclose the contents of memory.
(STR #3577)\n\n - CUPS can overwrite files as root in directories not owned or writeable
by non-root users. (STR #3510)\n\n - An infinite loop can occur when CUPS is not
compiled with HAVE_GSSAPI. (STR #3518)
Solution: Upgrade to CUPS 1.4.4 or later.
CVE-2010-2432
Moodle < 1.8.13 / 1.9.9 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5575 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote web
server hosts Moodle, an open-source course management system. For your information, the
observed version of Moodle is %L.\n\nVersions of Moodle prior to 1.8.13 or 1.9.9 are
potentially affected by multiple vulnerabilities :\n\n - A persistent cross-site scripting
vulnerability in the MNET access control interface. (MSA-10-0010)\n\n - A cross-site
scripting vulnerability in blog/index.php. (MSA-10-0011)\n\n - The KSES text cleaning
Family Internet Services 1495