(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host is running the Opera web browser. For your
information, the observed version of Opera is : \n %L \n\nVersions of Opera earlier than
11.62 are potentially affected by multiple vulnerabilities :\n\n - Small windows can be used
to trick users in to executing downloads. (Issue 1010)\n\n - Overlapping content can trick
users into executing downloads. (Issue 1011)\n\n - History.state can leak the state data from
cross domain pages. (Issue 1012)\n\n - Web page dialogs can be used to display the wrong
address in the address field. (Issue 1013)\n\n - Carefully timed reloads and redirects can
spoof the address field. (Issue 1014)
Solution: Upgrade to Opera 11.62 or later.
CVE Not available
OpenSSL 0.9.8 < 0.9.8u / 1.0.0 < 1.0.0h Multiple Vulnerabilities
PVS ID: 6400 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:58565
Description: Synopsis :\n\nThe remote web server is affected by multiple vulnerabilities.\n\nFor your
information, the observed version of OpenSSL is : \n %L \n\nOpenSSL versions earlier
than 0.9.8u and 1.0.0h are potentially affected by multiple vulnerabilities :\n\n - A NULL
pointer dereference flaw exists in mime_param_cmp. A specially crafted S/MIME input
header could cause an application to crash during S/MIME message verification or
decryption. (CVE-2012-1165)\n\n - A weakness in the OpenSSL CMS and PKCS 7 code
can be exploited using Bleichenbacher's attack on PKCS 1 v1.5 RSA padding. Note that
only users of CMS, PKCS 7, or S/MIME decryption operations are affected.
Solution: Upgrade to OpenSSL 0.9.8u, 1.0.0h, or later.
CVE-2012-1165
Apache Traffic Server < 3.0.4 / 3.1.3 Buffer Overflow Vulnerability
PVS ID: 6401 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote caching server is affected by a heap-based buffer overflow
vulnerability.\n\nApache Traffic Server, an open source caching server, is installed on the
remote host. For your information, the observed version of Apache Traffic Server installed
on the remote host is :\n %L \n\n Versions of Apache Traffic Server earlier than 3.0.4 or
3.1.x earlier than 3.1.3 are potentially affected by a heap-based buffer overflow
vulnerability when handling malicious HTTP host headers. By exploiting this flaw, a
remote, unauthenticated attacker could execute arbitrary code on the remote host subject to
the privileges of the user running the affected service.
Solution: Upgrade to Apache Traffic Server 3.0.4, 3.1.3, or later.
CVE-2012-0256
Passive Vulnerability Scanner (PVS) Signatures
Google Chrome < 18.0.1025.142 Multiple Vulnerabilities
Family Internet Services 1749