(PVS) Signatures - Tenable Network Security

possible to downgrade the ciphersuite to a weaker version by modifying the stored session
cache cipher suite.\n\n - An error exists in the J-PAKE implementation which could lead to
successful validation by someone with no knowledge of the shared secret.\nIAVA
Reference : 2011-A-0160\nIAVB Reference : 2012-B-0038\nSTIG Finding Severity :
Category I
Solution: Upgrade to OpenSSL 0.9.8q, 1.0.0c, or later.
CVE-2010-4252
Stuxnet Traffic Detection
PVS ID: 5721 FAMILY: Backdoors RISK: INFO NESSUS ID:Not Available
Description: The remote host is passing RPC traffic which is requesting an RPC UUID which is
synonymous with the Stuxnet trojan. This may indicate that either the host is infected with
Stuxnet or the host is scanning for Stuxnet-infected machines.
Solution: Ensure that the system is not infected. If it is not infected, ensure that the system is
authorized to be running security scans on the network.
CVE Not available
ClamAV < 0.96.5 Multiple Vulnerabilities
PVS ID: 5722 FAMILY: Web Clients RISK: HIGH NESSUS ID:51125
Description: Synopsis :\n\nThe remote host is running an anti-virus application that is vulnerable to
multiple attack vectors.\n\nThe reported version of ClamAV on the remote host is %L.
Versions of ClamAV earlier than 0.96.5 are potentially affected by multiple vulnerabilities
:\n\n - Multiple error exists in the PDF processing functions in 'libclamav/pdf.c' which may
lead to application crashes. (Bugs 2358, 2380, 2396)\n\n - An off-by-one error exists in the
handling of icons such that a crafted icon may be used to cause an integer overflow. (Bug
2344)
Solution: Upgrade to ClamAV 0.96.5 or later.
CVE-2010-4479
JavaScript eval() Usage on Web Server
PVS ID: 5723 FAMILY: Policy RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or
application\n\nThe remote web server utilizes JavaScript on it's pages. The use of the
JavaScript 'eval()' function is considered very dangerous. The Javascript in question is %P.
Solution: Remove calls to 'eval()' from javascript source code
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1548