(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of Google Chrome is
%L.\n\nVersions of Google chrome earlier than 6.0.472.59 are potentially affected by
multiple vulnerabilities :\n\n - A use-after-free error exists when using document APIs
during parse. (Bug 50250)\n\n - A use-after-free error exists in SVG styles. (Bug
50712)\n\n - A use-after-free error exists with nested SVG elements. (Bug 51252)\n\n - A
possible browser assert exists in cursor handling. (Bug 51709)\n\n - A race condition exists
in console handling. (Bug 51919)\n\n - An unlikely browser crash exists in pop-up
blocking. (Bug 53176)\n\n - Bug 45400 is incorrectly fixed on Mac. (Bug 53361)\n\n - A
memory corruption error exists in Geolocation. (Bug 53394)\n\n - A memory corruption
issue exists in Khmer handling. Note that this only affects Chrome for Linux. (Bug
53930)\n\n - An error exists because Chrome fails to prompt for extension history access.
(Bug 54006)
Solution: Upgrade to Google Chrome 6.0.472.59 or later.
CVE-2010-3417
QuickTime < 7.6.8 Multiple Vulnerabilities (Windows)
PVS ID: 5665 FAMILY: Web Clients RISK: HIGH NESSUS ID:49260
Description: Synopsis :\n\nThe remote host contains an application that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of QuickTime is %L.\n\nVersions
of QuickTime earlier than 7.6.8 are potentially affected by multiple vulnerabilities :\n\nAn
input validation issue in the QTPlugin.ocx ActiveX control could allow an attacker to force
the application to jump to a location in memory controlled by the attacker through the
optional '_Marshaled_pUnk' parameter and in turn to execute remote code under the
context of the user running the web browser. (CVE-2010-1818)\n\n - QuickTime Picture
Viewer uses a fixed path to look for specific files or libraries, such as 'cfnetwork.dll' and
'corefoundation.dll', and this path includes directories that may not be trusted or under user
control. If an attacker places a maliciously crafted DLL in the same directory as an image
file, opening the image file with QuickTime Picture Viewer will cause the malicious DLL
to be loaded. (CVE-2010-1819)
Solution: Upgrade to QuickTime 7.6.8 or later.
CVE-2010-1819
Squid 3.1.6 DNS Replay Denial of Service
PVS ID: 5666 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:48433
Description: Synopsis :\n\nThe remote proxy server is vulnerable to a denial-of-service attack.\n\nFor
your information, the observed version of Squid is %L.\n\nSquid 3.1.6 is potentially
affected by a denial of service vulnerability that is caused by an assertion failure when
contacting IPv4-only DNS resolvers.
Solution: Upgrade to Squid 3.1.7 or later.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1528