(PVS) Signatures - Tenable Network Security

RISK:
MEDIUM
Description: Synopsis :\n\nThe remote database server is vulnerable to multiple attack vectors.\n\nFor
your information, the version of PostgreSQL installed on the remote host is:\n %L
\n\nVersions of PostgreSQL 8.3.x earlier than 8.3.18 are potentially affected by the
following vulnerabilities :\n\n - Permissions on a function called by a trigger are not
properly checked. (CVE-2012-0866)\n\n - SSL certificate name checks are truncated to 32
characters, allowing connection spoofing under some circumstances when using third party
certificates. (CVE-2012-0867)\n\n - Line breaks in object names can be exploited to
execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)
Solution: Upgrade to PostgreSQL 8.3.18 or later.
CVE-2012-0868
PostgreSQL < 9.1.3 / 9.0.7 / 8.4.11 Multiple Vulnerabilities
PVS ID: 6337 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote database server is vulnerable to multiple attack vectors.\n\nFor
your information, the version of PostgreSQL installed on the remote host is:\n %L
\n\nVersions of PostgreSQL earlier than 9.1.3, 9.0.7, 8.4.11 and are potentially affected by
the following vulnerabilities :\n\n - Permissions on a function called by a trigger are not
properly checked. (CVE-2012-0866)\n\n - SSL certificate name checks are truncated to 32
characters, allowing connection spoofing under some circumstances when using third party
certificates. (CVE-2012-0867)\n\n - Line breaks in object names can be exploited to
execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)
Solution: Upgrade to PostgreSQL 8.4.11, 9.0.7, 9.1.3, or later.
CVE-2012-0868
Dropbear SSH Server Channel Concurrency Use-after-free Remote Code Execution
PVS ID: 6338 FAMILY: SSH RISK: HIGH NESSUS ID:58183
Description: Synopsis :\n\nThe remote ssh service is affected by a remote code execution
vulnerability.\n\nDropbear, an SSH server, is installed on the remote host. For your
information, the observed version of Dropbear is:\n %L \n\nVersions of Dropbear SSH
before 2012.55 contain a flaw that might allow an attacker to run arbitrary code on the
remote host with root privileges if they are authenticated using a public key and command
restriction is enforced.
Solution: Upgrade to Dropbear SSH 2012.55 or later.
CVE-2012-0920
Evernote Client Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1732