(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote web server is hosting an application that is vulnerable to multiple
attack vectors.\n\nThe remote web server is hosting Bugzilla, a web-based bug tracking
application. For your information, the observed version of Bugzilla is %L.\n\nVersions of
Bugzilla 3.2.x earlier than 3.2.8, 3.4.x earlier than 3.4.8, 3.6.x earlier than 3.6.2, and 3.7.x
earlier than 3.7.3 are potentially affected by multiple vulnerabilities :\n\n - It is possible to
(at least partially) determine the membership of any group using the Search interface.
(CVE-2010-2756).\n\n - It is possible to use the 'sudo' feature without sending a
notification to the user being impersonated. (CVE-2010-2757)\n\n - The 'Reports' and
'Duplicates' pages let you guess the name of products you can't see, due to the error
message that is thrown. (CVE-2010-2758)\n\n - For installations using PostgreSQL,
specifying "bug X" or "Attachment X" in a comment can deny access to the bug if X is
larger than the maximum 32-bit signed integer size. (CVE-2010-2759)
Solution: Upgrade to Bugzilla 3.2.8, 3.4.8, 3.6.2, 3.7.3, or later.
CVE-2010-2759
QuickTime < 7.6.7 QuickTimeStreaming.qtx SMIL File Debug Logging Overflow (Windows)
PVS ID: 5628 FAMILY: Web Clients RISK: HIGH NESSUS ID:48323
Description: Synopsis :\n\nThe remote host contains an application that is affected by a stack overflow
vulnerability.\n\nFor your information, the observed version of QuickTime is
%L.\n\nVersions of QuickTime earlier than 7.6.7 are potentially affected by a stack
overflow in the application's error logging when debug logging is enabled. If an attacker
can trick a user on the host into viewing a specially crafted movie file, he may be able to
cause an application crash or even execute arbitrary code subject to the user's privileges.
Note that this issue only affects QuickTime on Windows.
Solution: Upgrade to QuickTime 7.6.7 or later.
CVE-2010-1799
SquirrelMail < 1.4.21 Multiple Vulnerabilities
PVS ID: 5629 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server if vulnerable to a denial-of-service attack.\n\nThe
remote host is running SquirrelMail, a web-based email client. For your information, the
observed version of SquirrelMail is %L.\n\nVersions of SquirrelMail earlier than 1.4.21 are
potentially affected by a denial-of-service vulnerability. By submitting a random login with
8-bit characters in the password, it is possible to cause SquirrelMail to create a preferences
file even if the login is not valid. An attacker, exploiting this flaw, could create enough files
to cause the server to run out of disk space.
Solution: Upgrade to SquirrelMail 1.4.21 or later.
CVE-2010-2813
Zoiper < 2.24 SIP INVITE Request Remote DoS
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1514