(PVS) Signatures - Tenable Network Security

CVE-2012-5276, CVE-2012-5277, CVE-2012-5280)\n\n - An unspecified security bypass
issue exists that can lead to arbitrary code execution. (CVE-2012-5278)\n\n - An
unspecified issue exists that can lead to memory corruption and arbitrary code execution.
(CVE-2012-5279)
Solution: Upgrade to Flash Player 10.3.183.43 / 11.5.502.110 or later.
CVE-2012-5280
Apache Tomcat 6.0.x < 6.0.36 Multiple Vulnerabilities
PVS ID: 6657 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:62987
Description: Synopsis :\n\nThe remote web server is affected by multiple vunerabilities.\n\nFor your
information, the observed version of Apache Tomcat 6.0 installed on the remote host is : \n
%L \n\nVersions earlier than Apache Tomcat 6.0.36 are potentially affected by multiple
vulnerabilities :\n\n - A flaw exists within the parseHeaders() function that could allow for
a crafted header to cause a remote denial of service. (CVE-2012-2733)\n\n - An error exists
related to FORM authentication that can allow security bypass if 'j_security_check' is
appended to the request. (CVE-2012-3546)\n\n - An error exists in the file
'filters/CsrfPreventionFilter.java' that can allow cross-site request forgery (CSRF) attacks to
bypass the filtering. This can allow access to protected resources without a session
identifier. (CVE-2012-4431)\n\n - An error exists related to the 'NIO' connector when
HTTPS and 'sendfile' are enabled that can force the application into an infinite loop.
(CVE-2012-4534)\n\n - Replay-countermeasure functionality in HTTP Digest Access
Authentication tracks cnonce values instead of nonce values, which makes it easier for
attackers to bypass access restrictions by sniffing the network for valid requests.
(CVE-2012-5885)\n\n - HTTP Digest Access Authentication implementation caches
information about the authenticated user, which could potentially allow an attacker to
bypass authentication via session ID. (CVE-2012-5886)\n\n - HTTP Digest Access
Authentication implementation does not properly check for stale nonce values with
enforcement of proper credentials, which allows an attacker to bypass restrictions by
sniffing requests. (CVE-2012-5887)
Solution: Upgrade to Apache Tomcat 6.0.36 or later.
CVE-2012-5887
VLC Media Player < 2.0.5 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 6658 FAMILY: Web Clients RISK: HIGH NESSUS ID:63381
Description: Synopsis :\n\nThe remote host contains an application that is affected by multiple
vulnerabilities\n\nThe remote host contains VLC player, a multi-media application. For
your information, the observed version of VLC is : \n %L .\n\nVersions of VLC media
player earlier than 2.0.5 are potentially affected by the following vulnerabilities :\n\n - An
error exists in the file 'modules/codec/subsdec.c' ('libsubsdec_plugin.dll') that does not
properly validate input and can allow a buffer overflow. Opening a specially crafted file
can result in the execution of arbitrary code. Note that the subtitles feature must be enabled
Family Internet Services 1829