(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote web server is affected by a remote denial of service
vulnerabily.\n\nFor your information, the observed version of Apache Tomcat installed on
the remote host is : \n %L \n\nVersions of Tomcat 7.0.x earlier than 7.0.28 are potentially
affected by a remote denial of service vulnerability:\n\n - A flaw exists within the
parseHeaders() function that could allow for a crafted header to cause a remote denial of
service (CVE-2012-2733)\n\n - An error exists related to the 'NIO' connector when HTTPS
and 'sendfile' are enabled that can force the application into an infinite loop.
(CVE-2012-4534)
Solution: Upgrade to Apache Tomcat 7.0.28 or later.
CVE-2012-4534
Apache Tomcat 7.0.x < 7.0.30 DIGEST Authentication Multiple Security Weaknesses
PVS ID: 6624 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:62988
Description: Synopsis :\n\nThe remote web server is affected by multiple security weaknesses.\n\nFor
your information, the observed version of Apache Tomcat installed on the remote host is :
\n %L \n\nVersions of Tomcat 7.0.x earlier than 7.0.30 are potentially affected by the
following vulnerabilities:\n\n - Replay-countermeasure functionality in HTTP Digest
Access Authentication tracks cnonce values instead of nonce values, which makes it easier
for attackers to bypass access restrictions by sniffing the network for valid requests.
(CVE-2012-5885)\n\n - HTTP Digest Access Authentication implementation caches
information about the authenticated user, which could potentially allow an attacker to
bypass authentication via session ID. (CVE-2012-5886)\n\n - HTTP Digest Access
Authentication implementation does not properly check for stale nonce values with
enforcement of proper credentials, which allows an attacker to bypass restrictions by
sniffing requests. (CVE-2012-5887)
Solution: Upgrade to Apache Tomcat 7.0.30 or later.
Mozilla Firefox 16.x <
CVE-2012-5887
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 6625 FAMILY: Web Clients RISK: HIGH NESSUS ID:62998
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 16.x are potentially affected by the following security issues :\n\n -
Several memory safety bugs exist in the browser engine used in Mozilla-based products
that could be exploited to execute arbitrary code. (CVE-2012-5842, CVE-2012-5843)\n\n -
An error exists in the method 'image::RasterImage::DrawFrameTo' related to GIF images
that could allow a heap-based buffer overflow, leading to arbitrary code execution.
(CVE-2012-4202)\n\n - An error exists related to SVG text and CSS properties that could
lead to application crashes. (CVE-2012-5836)\n\n - A bookmarked, malicious 'javascript:'
URL could allow execution of local executables. (CVE-2012-4203)\n\n - The JavaScript
function 'str_unescape' could allow arbitrary code execution. (CVE-2012-4204)\n\n -
Family Internet Services 1818