(PVS) Signatures - Tenable Network Security

BIND 9.4-ESV < 9.4-ESV-R4 / 9.6.2 < 9.6.2-P3, 9.6-ESV < 9.6-ESV-R3 / 9.7.x < 9.7.2-P3 Multiple
Vulnerabilities
PVS ID: 5718 FAMILY: DNS Servers
RISK:
MEDIUM
NESSUS ID:50976
Description: Synopsis :\n\nThe remote DNS server is vulnerable to multiple attack vectors.\n\nThe
remote host is running BIND, and open source name server. For your information, the
observed version of BIND is %L.\n\nVersions of BIND 9.4-ESV < 9.4-ESV-R4, 9.6.2 <
9.6.2-P3, 9.6-ESV < 9.6-ESV < R3, and 9.7.x < 9.7.2-P3 are potentially affected by
multiple vulnerabilities :\n\n - Failure to clear existing RRSIG records when a NO DATA
is negatively cached could cause subsequent lookups to crash named.
(CVE-2010-3613)\n\n - Named, when acting as a DNSSEC validating resolver, could
incorrectly mark zone data as insecure when the zone being queried is undergoing a key
algorithm rollover. (CVE-2010-3614)\n\n - Using 'allow-query' in the 'options' or 'view'
statements to restrict access to authorize zones has no effect. (CVE-2010-3615)
Solution: Upgrade to BIND 9.4-ESV-R4, 9.6.2-P3, 9.6-ESV-R3, 9.7.2-P3, or later.
CVE-2010-3615
Google Chrome < 8.0.552.215 Multiple Vulnerabilities
PVS ID: 5719 FAMILY: Web Clients RISK: HIGH NESSUS ID:50977
Description: Synopsis :\n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of Google Chrome is
%L.\n\nVersions of Google Chrome earlier than 8.0.552.215 are potentially affected by
multiple vulnerabilities :\n\n - It may be possible to bypass the pop-up blocker. (17655)\n\n
- A cross-origin video theft vulnerability exists related to canvas. (55747) - An unspecified
crash exists when handling HTML5 databases. (56237) - Excessive file dialogs could lead
to a browser crash. (58329) - A use after free error exists in history handling. (59554) - It
may be possible to crash the browser when performing http proxy authentication. (61701) -
An out-of-bounds read regression exists in the WebM video support. (61653)\n\n - It may
be possible to crash the browser due to bad indexing with malformed video. (62127)\n\n -
A memory corruption issue exists relating t malicious privileged extension. (62168)\n\n - A
use-after-free error exists in the mouse dragging event handling. (63051)\n\n - A double
free error exists in XPath handling. (63444)
Solution: Upgrade to Google Chrome 8.0.552.215 or later.
CVE-2010-4494
OpenSSL < 0.9.8q / 1.0.0c Multiple Vulnerabilities
PVS ID: 5720 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:51892
Description: Synopsis :\n\nThe remote web server is vulnerable to multiple attack vectors.\n\nFor your
information, the observed version of OpenSSL is %L.\n\nVersions of OpenSSL earlier than
0.9.8q and 1.0.0c are potentially affected by multiple vulnerabilities :\n\n - It may be
Family Internet Services 1547