(PVS) Signatures - Tenable Network Security

Solution: Ensure that confidential data is encrypted while in transit
CVE Not available
Social Security Number Cleartext Transmission (Client)
PVS ID: 5822 FAMILY: Data Leakage RISK: HIGH NESSUS ID:Not Available
Description: The remote client sent a plaintext message which seems to contain a Social Security
Number. Examine the following for possible confidential data : %L
realtimeonly
Solution: Ensure that confidential data is encrypted while in transit
CVE Not available
Google Chrome < 10.0.648.134 Code Execution Vulnerability
PVS ID: 5823 FAMILY: Web Clients RISK: HIGH NESSUS ID:52713
Description: Synopsis :\n\nThe remote host contains a web browser that is affected by a code execution
vulnerability.\n\nFor your information, the observed version of Google Chrome is
%L.\n\nVersions of Google Chrome earlier than 10.0.648.134 contain a vulnerable version
of Adobe Flash Player. remote attacker could exploit this by tricking a user into viewing
unspecified, malicious SWF content, resulting in arbitrary code execution. Note that this
issue is currently being exploited in the wild.
Solution: Upgrade to Google Chrome 10.0.648.134 or later.
CVE-2011-0609
PHP 5.3 < 5.3.6 String To Double Conversion DoS
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5824 FAMILY: Web Servers RISK: HIGH NESSUS ID:52717
Description: Synopsis : \n\nThe remote web server uses a version of PHP that is affected by a denial of
service vulnerability.\n\nFor your information, the version of PHP installed on the remote
host is : \n %L \n\nVersions of PHP 5.3 earlier than 5.3.6 are potentially affected by
multiple vulnerabilities : \n\n - An error exists in the function '_zip_name_locate()' in the
file 'ext/zip/lib/zip_name_locate.c' which allows a NULL pointer to be dereferenced when
processing an empty archive. (CVE-2011-0421)\n\n - A variable casting error exists in the
Exif extension's C function 'exif_process_IFD_TAG()' in the file 'ext/exif/exif.c' could
allow arbitrary code execution. (CVE-2011-0708)\n\n - An integer overflow vulnerability
exists in the implementation of the PHP function 'shmop_read' in the file
'ext/shmop/shmop.c'. (CVE-2011-1092)\n\n - An error exists in the file 'phar/phar_object.c'
n which calls to 'zend_throw_exception_ex()' pass data as a string format parameter which
could lead to information disclosure or memory corruption when handling PHP archives.
(CVE-2011-1153)\n\n - A buffer overflow error exists in the C function
'xbuf_format_converter' in the file 'main/snprintf.c' when the PHP configuration setting for
Family Internet Services 1581