(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host is affected by an information disclosure
vulnerability.\n\nFor your information, the observed version of OpenSSH installed on the
remote host is : \n %L \n\nOpenSSH 5.6 and 5.7 contain an information disclosure
vulnerability which may cause the contents of the stack to be copied into an SSH
certificate, which is visible to a remote attacer. This information may lead to further
attacks.
Solution: Upgrade to OpenSSH version 5.8 or later.
CVE-2011-0539
WordPress < 3.0.5 Multiple Vulnerabilities
PVS ID: 5785 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:51939
Description: Synopsis : \n\nThe remote web server is hosting a web application that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of WordPress is : \n
%L \n\nVersions of WordPress earlier than 3.0.5 are potentially affected by multiple
vulnerabilities : \n\n - The application is prone to multiple cross-site scripting
vulnerabilities. An attacker can exploit these issues through the 'title' field of the
'Quick/Bulk Edit' section and the 'tags meta box' section. An attacker would require Author
or Contributor privileges to take advantage of this.\n\n - The application is prone to an
information-disclosure vulnerability. An attacker can exploit this issue through the media
uploader, disclosing posts. This information may assist in further attacks. An attacker
would require Author privileges to take advantage of this.
Solution: Upgrade to WordPress 3.0.5 or later.
CVE-2011-0701
Apache Tomcat 5.5.x < 5.5.30 Multiple Vulnerabilities
PVS ID: 5786 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:47749
Description: Synopsis : \n\nThe remote web server is vulnerable to multiple attack vectors.\n\nFor your
information, the observed version of Apache Tomcat installed on the remote host is : \n %L
\n\nVersions of Tomcat 5.x earlier than 5.5.30 are potentially affected by multiple
vulnerabilities : \n\n - The 'WWW-Authenticate' HTTP header for BASIC and DIGEST
authentcation may expose the local host name or IP address of the machine running
Tomcat. (CVE-2010-1157)\n\n - Several flaws in the handling of the 'Tansfer-Encoding'
header could prevent the recycling of buffer. (CVE-2010-2227)\n\n - When running under a
SecurityManager, it is possible for web applications to be granted read/write permissions to
any area on the file system. (CVE-2010-3718)
Solution: Upgrade to Apache Tomcat 5.5.30 or later.
CVE-2010-3718
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1568