(PVS) Signatures - Tenable Network Security

Solution: Configure your web server or application to use the 'HttpOnly' tag.
CVE Not available
Web Server CSS Hosted on 3rd-party Server
PVS ID: 5800 FAMILY: Policy RISK: INFO NESSUS ID:Not Available
Description: The remote web server utilizes Cascading Style Sheets (CSS) on it's pages. Further, the
web server seems to be using CSS from an external source. This can be a risk in that script
code can be embedded within the CSS which would potentially execute within the user
browser. The source of the CSS is: \n %L \n\nThe CSS is embedded within the following
web document: \n%P
Solution: Ensure that loading client-side CSS from a 3rd party is authorized with respect to policies
and guidelines.
CVE Not available
Web Site Cross-Domain Policy File Detection
PVS ID: 5801 FAMILY: Policy RISK: INFO NESSUS ID:32318
Description: The remote web server contains a 'crossdomain.xml' file. This is a simple XML file used by
Adobe's Flash Player to allow access to data that resides outside the exact web domain from
which a Flash movie file originated. The source of the XML file is: \n %L \n\nThe file can
be found at : %P
Solution: Review the contents of the policy file carefully. Improper policies, especially an
unrestricted one with just '*', could allow for cross-site request forgery and cross-site
scripting attacks against the web server.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Asterisk main/udptl.c Buffer Overflows (AST-2011-002)
PVS ID: 5802 FAMILY: Generic RISK: HIGH NESSUS ID:52157
Description: Synopsis : \n\nThe remote VoIP server is affected by multiple buffer overflow
vulnerabilities.\n\nFor your information, the observed version of Asterisk is : \n %L
\n\nThe version of Asterisk running on the remote host may be vulnerable to heap- and
stack-buffer overflow attacks with specially crafted UDPTL packets.\n\nSuccessful
exploitation requires T.38 support to be enabled on the target, which is not the default, and
can allow execution of arbitrary code in the context of the Asterisk server or an application
crash.
Solution: Upgrade to Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, 1.8.2.4, or later or Asterisk Business
Edition C.3.6.3 or later.\nAlternatively, disable T.38 support by setting 't38pt_udptl' to 'no'
in sip.conf and ensuring that the chan_ooh323 module is not loaded.
Family Internet Services 1573