(PVS) Signatures - Tenable Network Security

PVS ID: 1320 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a version of the Mozilla browser that may contain a buffer overflow vulnerability.
An integer overflow vulnerability has been reported for the Netscape/Mozilla POP3 mail
handler routines. Reportedly, insufficient checks are performed on some server supplied
values. An attacker may exploit this vulnerability through an attacker-controlled POP3
server. By issuing a very large integer value that is used by the Netscape/Mozilla POP3
mail handler, it may be possible to cause an integer overflow condition and allocate a
buffer that is too small. Successful exploitation of this vulnerability may allow an attacker
to obtain control over the execution of the vulnerable Mozilla process.
Solution: Upgrade to the latest version of Mozilla.
CVE Not available
Mozilla Browser Large HTTP Header Handling Overflow
PVS ID: 1321 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a version of the Mozilla browser that may contain a buffer overflow vulnerability.
The condition occurs when HTTP responses of excessive length are received from remote
servers.
Solution: Upgrade to Mozilla 1.0.1, 1.1 or higher.
CVE Not available
Mozilla JAR File Decompression Heap Overflow
PVS ID: 1322 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a heap overflow.\n\nThe remote host is
running a version of the Mozilla browser that may contain a heap corruption vulnerability.
A vulnerability has been discovered in the JAR URI handler used by Netscape and Mozilla.
By constructing a malformed JAR file containing invalid file length information, it is
possible to cause heap corruption in a vulnerable browser. When a client attempts to
decompress a malicious JAR file, invalid values will be used to allocate buffer space for the
inflated data. As there are no checks to prevent this, an overrun condition in the heap may
occur if excessive data is decompressed.
Solution: Upgrade to the latest version of Mozilla.
CVE-2002-1308
Mozilla Browser 'onclick' Property Cross Domain Violation
PVS ID: 1323 FAMILY: SMTP Clients
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Family Internet Services 339