The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0880 advisory.

  - TLS: MITM attacks via session renegotiation (CVE-2009-3555)

  - krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) (CVE-2010-1321)

  - OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004) (CVE-2010-3541,     CVE-2010-3573)

  - OpenJDK DNS server IP address information leak (6957564) (CVE-2010-3548)

  - OpenJDK HttpURLConnection request splitting (6952017) (CVE-2010-3549)

  - JDK unspecified vulnerability in Java Web Start component (CVE-2010-3550, CVE-2010-3558)

  - OpenJDK local network address disclosure (6952603) (CVE-2010-3551)

  - OpenJDK Swing unsafe reflection usage (6622002) (CVE-2010-3553)

  - JDK unspecified vulnerability in Deployment component (CVE-2010-3555, CVE-2010-4422, CVE-2010-4447,     CVE-2010-4452, CVE-2010-4463, CVE-2010-4466, CVE-2010-4467, CVE-2010-4475)

  - JDK unspecified vulnerability in 2D component (CVE-2010-3556, CVE-2010-3571)

  - OpenJDK Swing mutable static (6938813) (CVE-2010-3557)

  - JDK unspecified vulnerability in Networking component (CVE-2010-3560)

  - OpenJDK IndexColorModel double-free (6925710) (CVE-2010-3562)

  - OpenJDK: unspecified vulnerability in Deployment component (CVE-2010-3563)

  - OpenJDK JPEG writeImage remote code execution (6963023) (CVE-2010-3565)

  - OpenJDK ICC Profile remote code execution (6963489) (CVE-2010-3566)

  - OpenJDK Deserialization Race condition (6559775) (CVE-2010-3568)

  - OpenJDK Serialization inconsistencies (6966692) (CVE-2010-3569)

  - JDK unspecified vulnerability in Sound component (CVE-2010-3572, CVE-2010-4454, CVE-2010-4462,     CVE-2010-4473)

  - OpenJDK HttpURLConnection incomplete TRACE permission check (6981426) (CVE-2010-3574)

  - OpenJDK DNS cache poisoning by untrusted applets (6981922) (CVE-2010-4448)

  - OpenJDK Swing timer-based security manager bypass  (6907662) (CVE-2010-4465)

  - JDK unspecified vulnerability in JDBC component (CVE-2010-4468)

  - OpenJDK Java2D font-related system property leak (6985453) (CVE-2010-4471)

  - JDK Double.parseDouble Denial-Of-Service (CVE-2010-4476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

SunOS 5.10: wanboot patch.
Date this patch was last updated by Sun : Jun/18/10

SunOS 5.10_x86: ssh and openssl patch.
Date this patch was last updated by Sun : Jun/18/10

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. mod_ssl: A partial fix for the TLS renegotiation prefix injection attack by rejecting any client-initiated renegotiations. mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent when request headers indicate a request body is incoming; not a case of HTTP_INTERNAL_SERVER_ERROR. mod_isapi: Do not unload an isapi .dll module until the request processing is completed, avoiding orphaned callback pointers. [This is the most serious flaw, but does not affect Linux systems]

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote NewStart CGSL host, running version MAIN 6.06, has openssl packages installed that are affected by multiple vulnerabilities:

  - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances     where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection     were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other     places in the script where the file names of certificates being hashed were possibly passed to a command     executed through the shell. This script is distributed by some operating systems in a manner where it is     automatically executed. On such operating systems, an attacker could execute arbitrary commands with the     privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the     OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in     OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

  - The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat     Extension packets, which allows remote attackers to obtain sensitive information from process memory via     crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to     d1_both.c and t1_lib.c, aka the Heartbleed bug. (CVE-2014-0160)

  - OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service     (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled     error condition. (CVE-2006-2937)

  - OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial     of service (CPU consumption) via parasitic public keys with large (1) public exponent or (2) public     modulus values in X.509 certificates that require extra time to process when using RSA signature     verification. (CVE-2006-2940)

  - Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before     0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of     ciphers. (CVE-2006-3738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.15. It is, therefore, potentially affected by multiple vulnerabilities :

  - A TLS renegotiation prefix injection attack is possible.     (CVE-2009-3555)

  - The 'mod_proxy_ajp' module returns the wrong status code     if it encounters an error which causes the back-end     server to be put into an error state. (CVE-2010-0408)

  - The 'mod_isapi' attempts to unload the 'ISAPI.dll' when     it encounters various error states which could leave     call-backs in an undefined state. (CVE-2010-0425)

  - A flaw in the core sub-request process code can lead to     sensitive information from a request being handled by     the wrong thread if a multi-threaded environment is     used. (CVE-2010-0434)

  - Added 'mod_reqtimeout' module to mitigate Slowloris     attacks. (CVE-2007-6750)

The remote host is running a version of SeaMonkey earlier than 2.0.4.  Such versions are potentially affected by multiple security issues : 

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-16)

  - A select event handler for XUL tree items can be called after the item is deleted. (MFSA 2010-17)

  - An error exists in the way '<option>' elements are inserted into a XUL tree '<optgroup>'. (MFSA 2010-18)

  - An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA 2010-19)

  - A browser applet can be used to turn a simple mouse click into a drag-and-drop action, potentially resulting in the unintended loading of resources in a user's browser. (MFSA 2010-20)

  Session renegotiations are not handled properly, which can be exploited to insert arbitrary plaintext by a man-in-the-middle. (MFSA 2010-22)

  - When an image points to a resource that redirects to a 'mailto: ' URL, the external mail handler application is launched. (MFSA 2010-23)

  - XML documents fail to call certain security checks when loading new content. (MFSA 2010-24)

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.15.  Such versions are potentially affected by multiple vulnerabilities : 

  - A TLS renegotiation prefix attack is possible. (CVE-2009-3555)

  - The 'mod_proxy_ajp' module returns the wrong status code if it encounters an error which causes the back-end server to be put into an error state. (CVE-2010-0408)

  - The 'mod_isapi' module attempts to unload the 'ISAPI.DLL' when it encounters various error states which could leave call-backs in an undefined state. (CVE-2010-0425)

  - A flaw in the core sub-request process code can lead to sensitive information from a request being handled by the wrong thread if a multi-threaded environment is used. (CVE-2010-0434)

Versions of Mozilla Thunderbird prior to 3.0.4 are affected by the following vulnerabilities :

 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-16)
 - A select event handler for XUL tree items can be called after the item is deleted. (MFSA 2010-17)
 - An error exists in the way '<option>' elements are inserted into a XUL tree '<optgroup>'. (MFSA 2010-18)
 - Session renegotiations are not handled properly, which can be exploited to insert arbitrary plaintext by a man-in-the-middle. (MFSA 2010-22)
 - XML documents fail to call certain security checks when loading new content. (MFSA 2010-24)

The remote host is running a version of Mozilla Firefox earlier than 3.5.9.  Such versions are potentially affected by multiple security issues : 

 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-16)
 - A select event handler for XUL tree items can be called after the item is deleted. (MFSA 2010-17)
 - An error exists in the way '<option>' elements are inserted into a XUL tree '<optgroup>'. (MFSA 2010-18)
 - An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA 2010-19)
 - A browser applet can be used to turn a simple mouse click into a drag-and-drop action, potentially resulting in the unintended loading of resources in a user's browser. (MFSA 2010-20)
 Session renegotiations are not handled properly, which can be exploited to insert arbitrary plaintext by a man-in-the-middle. (MFSA 2010-22)
 - When an image points to a resource that redirects to a 'mailto: ' URL, the external mail handler application is launched. (MFSA 2010-23)
 - XML documents fail to call certain security checks when laoding new content. (MFSA 2010-24)

According to its banner, the remote host is running a version of OpenSSL older than 0.9.8m.  Such versions potentially have the following vulnerabilities : 

  - Session renegotiations are not handled properly, which could be exploited to insert arbitrary plaintext by a man-in-the-middle. (CVE-2009-3555)

  - The library does not check for a NULL return value from calls to the bn_wexpand() function, which has unspecified impact. (CVE-2009-3245)

ID	Name	Product	Family	Published	Updated	Severity
63983	RHEL 5 : Red Hat Network Satellite server IBM Java Runtime (RHSA-2011:0880)	Nessus	Red Hat Local Security Checks	1/24/2013	4/21/2024	critical
107577	Solaris 10 (sparc) : 145102-01	Nessus	Solaris Local Security Checks	3/12/2018	10/23/2025	medium
108025	Solaris 10 (x86) : 141525-10	Nessus	Solaris Local Security Checks	3/12/2018	10/22/2025	medium
45007	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : httpd (SSA:2010-067-01)	Nessus	Slackware Local Security Checks	3/9/2010	1/14/2021	critical
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	3/4/2016	5/25/2022	high
266257	NewStart CGSL MAIN 6.06 : openssl Multiple Vulnerabilities (NS-SA-2025-0211)	Nessus	NewStart CGSL Local Security Checks	9/30/2025	10/1/2025	high
45004	Apache 2.2.x < 2.2.15 Multiple Vulnerabilities	Nessus	Web Servers	10/20/2010	11/15/2018	critical
5495	SeaMonkey < 2.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/31/2010	3/6/2019	medium
5356	Apache < 2.2.15 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	3/8/2010	3/6/2019	critical
5496	Mozilla Thunderbird < 3.0.4 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	3/31/2010	3/6/2019	medium
5494	Mozilla Firefox < 3.5.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/31/2010	3/6/2019	medium
5358	OpenSSL < 0.9.8m Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	3/9/2010	3/6/2019	medium

Detections

Analytics

Plugins Search

critical

medium

medium

critical

high

high

critical

medium

critical

medium

medium

medium