(PVS) Signatures - Tenable Network Security

CVE-2011-1302
Flash Player < 10.2.159.1 Unspecified Memory Corruption (APSB11-07)
PVS ID: 5892 FAMILY: Web Clients RISK: HIGH NESSUS ID:53472
Description: Synopsis : \n\nThe remote host contains a browser plug-in that is affected by a memory
corruption vulnerability.\n\nThe remote host has Adobe Flash Player installed. For your
information, the observed version of Adobe Flash Player is : \n %L .\n\nVersions of Flash
Player earlier than 10.2.159.1 are potentially affected by a memory corruption
vulnerability. By tricking a user on the affected system into opening a specially crafted
document with Flash content, such as a SWF file embedded in a Microsoft Word
document, and attacker can potentially leverage this issue to execute arbitrary code
remotely on the system subject to the user's privileges.\n\nNote that there are reports that
this issue is being exploited in the wild as of April 2011.
Solution: Upgrade to Flash Player 10.2.159.1 or later.
CVE-2011-0611
Joomla! 1.6 < 1.6.2 Multiple Vulnerabilities
PVS ID: 5893 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server has an application that is vulnerable to multiple
attack vectors.\n\nThe remote web server is hosting Joomla!, a content management system
written in PHP. For your information, the observed version of Joomla! is : \n %L
.\n\nVersions of Joomla 1.6 earlier than 1.6.2 are potentially affected by multiple
vulnerabilities : \n\n - Multiple inadequate error checking issues could lead to information
disclosure. (20110402, 20110403)\n\n - Unescaped values in the administrative modal
windows causes potential cross-site scripting vulnerabilities. (20110404)\n\n - Multiple
inadequate filtering issues could lead to cross-site scripting attacks. (20110405,
20110406)\n\n - Inadequate permissions checking could allow unauthorised access.
(20110407)\n\n - Unescaped values in a query could lead to a SQL injection vulnerability.
(20110408)\n\n - Inadequate protection could lead to a clickjacking vulnerability.
(20110409)
Solution: Upgrade to Joomla! 1.6.2 or later.
CVE Not available
iTunes < 10.2.2 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5894 FAMILY: Web Clients RISK: HIGH NESSUS ID:53489
Description: Synopsis :\n\nThe remote host contains an application that is vulnerable to multiple attack
vectors.\n\nThe remote host has iTunes installed, a popular media player for Windows and
Mac OS. For your information, the observed version of iTunes is %L.\n\nVersions of
iTunes earlier than 10.2.2 are potentially affected by several issues :\n\n - An integer
Family Internet Services 1601