[VOTES] Vote details for older clusters related to content decisions

To: cve-editorial-board-list@lists.mitre.org
Subject: [VOTES] Vote details for older clusters related to content decisions
From: "Steven M. Christey" <coley@linus.mitre.org>
Date: Wed, 12 Jan 2000 20:11:12 -0500 (EST)
Delivery-Date: Wed Jan 12 20:14:02 2000
Sender: owner-cve-editorial-board-list@lists.mitre.org
This OLD-CD meta-cluster includes voting details for all the older
clusters which were used to illustrate content decisions, back in July
and August 1999.

Not surprisingly, these clusters have a large number of candidates
that are still active and being held back by unresolved content
decisions.  These will be revisited in the coming months.

SA-OTHER
SA-LITTLE
SA-ATTACK
SA-HIST
NT-REGISTRY
DATA
CFMISC
NOVULN
PRIVACY
NETCONF
CDEC
DESIGN
NTCONFIG
PASS
MULT2
MULT


- Steve


--------------------- CLUSTER SA-OTHER ---------------------

SA-OTHER (8 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/29
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Other SA candidates


Voters:
  Wall ACCEPT(5) NOOP(3)
  Northcutt REJECT(8)


<PROPOSED> --> 8
REJECT --> 8

=================================
Candidate: CAN-1999-0640
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The Gopher service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0640 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0644
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The NNTP news service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0644 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0648
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The X25 service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0648 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0649
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The FSP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0649 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0650
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The netstat service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0650 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0652
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A database service is running, e.g. a SQL server, Oracle, or mySQL.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0652 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0656
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The ugidd service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0656 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0658
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

DCOM is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0658 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt




--------------------- CLUSTER SA-LITTLE ---------------------

SA-LITTLE (5 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/29
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Presence of "little" services that are rarely necessary


Voters:
  Wall ACCEPT(3) NOOP(2)
  Northcutt ACCEPT(1) REJECT(4)


<PROPOSED> --> 5
ACCEPT --> 1
REJECT --> 4

=================================
Candidate: CAN-1999-0635
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The echo service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0635 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Northcutt

Comments:
 Northcutt> The method to my madness is echo is the common denom in the dos attack


=================================
Candidate: CAN-1999-0636
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The discard service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0636 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0637
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The systat service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0637 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0638
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The daytime service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0638 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0639
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The chargen service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0639 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt




--------------------- CLUSTER SA-ATTACK ---------------------

SA-ATTACK (10 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/29
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Presence of services that are common attack points


Voters:
  Wall ACCEPT(9) REJECT(1)
  Northcutt REJECT(10)


<PROPOSED> --> 10
REJECT --> 10

=================================
Candidate: CAN-1999-0615
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The SNMP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0615 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0620
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A component service related to NIS is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0620 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0630
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The NT Alerter and Messenger services are running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0630 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0633
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The HTTP/WWW service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0633 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0641
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The UUCP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0641 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0645
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The IRC service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0645 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0646
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The LDAP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0646 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0651
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The rsh/rlogin service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0651 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0653
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A component service related to NIS+ is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0653 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0659
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A Windows NT Primary Domain Controller (PDC) or Backup Domain
Controller (BDC) is present.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0659 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Wall, Northcutt

Comments:
 Wall> Don't consider this a service or a problem.




--------------------- CLUSTER SA-HIST ---------------------

SA-HIST (13 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/29
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Presence of services with a history of problems


Voters:
  Wall ACCEPT(12) NOOP(1)
  Northcutt REJECT(13)


<PROPOSED> --> 13
REJECT --> 13

=================================
Candidate: CAN-1999-0614
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The FTP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0614 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0616
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The TFTP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0616 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0617
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The SMTP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0617 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0619
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The Telnet service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0619 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0621
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A component service related to NETBIOS is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0621 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0622
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A component service related to DNS service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0622 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0623
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The X Windows service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0623 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0631
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The NFS service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0631 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0632
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The RPC portmapper service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0632 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0634
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The SSH service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0634 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0642
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

A POP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0642 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0643
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

The IMAP service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0643 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0657
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990804
Assigned: 19990607
Category: SA

WinGate is being used.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0657 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt




--------------------- CLUSTER NT-REGISTRY ---------------------

NT-REGISTRY (6 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/28
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

CF problems related to NT registry settings


Voters:
  Wall ACCEPT(6)
  Northcutt RECAST(6)


<PROPOSED> --> 6
RECAST --> 6

=================================
Candidate: CAN-1999-0580
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

The HKEY_LOCAL_MACHINE key in a Windows NT system has inappropriate,
system-critical permissions.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0580 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.


=================================
Candidate: CAN-1999-0581
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

The HKEY_CLASSES_ROOT key in a Windows NT system has inappropriate,
system-critical permissions.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0581 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.


=================================
Candidate: CAN-1999-0589
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A system-critical Windows NT registry key has inappropriate
permissions.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0589 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.


=================================
Candidate: CAN-1999-0611
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A system-critical Windows NT registry key has an inappropriate value.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0611 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.


=================================
Candidate: CAN-1999-0664
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990803
Category: CF

An application-critical Windows NT registry key has inappropriate
permissions.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0664 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.


=================================
Candidate: CAN-1999-0665
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990803
Category: CF

An application-critical Windows NT registry key has an inappropriate
value.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0665 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we can define appropriate, take a look at the nt security .pdf
 Northcutt> and see if you can't see a way to phrase specific keys in a way that
 Northcutt> defines inappropriate.




--------------------- CLUSTER DATA ---------------------

DATA (10 candidates)
--------------------
Proposed: 8/3
Scheduled Proposed: 7/28
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

CF problems related to data access


Voters:
  Wall ACCEPT(10)
  Northcutt ACCEPT(3) RECAST(6) REJECT(1)


<MODIFIED> --> 1
<PROPOSED> --> 9
ACCEPT --> 3
RECAST --> 6
REJECT --> 1

=================================
Candidate: CAN-1999-0509
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

Perl, sh, csh, or other shell interpreters are accessible on a WWW
site.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0509 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0520
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A system-critical NETBIOS/SMB share has inappropriate access control.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0520 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we need to enumerate the shares and or the access control


=================================
Candidate: CAN-1999-0522
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF
Reference: CERT:CA-96.10

The permissions for a system-critical NIS+ table (e.g. passwd) are
inappropriate.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0522 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> Why not say world readable, this is what you do further down in the
 Northcutt> file (world exportable in CAN-1999-0554)


=================================
Candidate: CAN-1999-0527
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

The permissions for system-critical data in an anonymous FTP account
are inappropriate.  For example, the root directory is writeable by
world, a real password file is obtainable, or executable commands such
as "ls" can be overwritten.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0527 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Northcutt

Comments:
 Northcutt> That that starts to get specific :)


=================================
Candidate: CAN-1999-0554
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

NFS exports system-critical data to the world, e.g. / or a password
file.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0554 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0559
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A system-critical Unix file or directory has inappropriate
permissions.

CONTENT-DECISIONS: CF-DATA,LOA

INFERRED ACTION: CAN-1999-0559 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> Writable other than by root/bin/wheelgroup?


=================================
Candidate: CAN-1999-0560
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A system-critical Windows NT file or directory has inappropriate
permissions.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0560 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> I think we should specify these


=================================
Candidate: CAN-1999-0569
Published:
Final-Decision:
Interim-Decision:
Modified: 19991130-01
Proposed: 19990803
Assigned: 19990607
Category: CF

A URL for a WWW directory allows auto-indexing, which provides a list
of all files in that directory if it does not contain an index.html
file.

Modifications:
  Mention missing index.html

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0569 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt

Comments:
 Northcutt> I do this intentionally somethings in high content directories


=================================
Candidate: CAN-1999-0587
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

A WWW server is not running in a restricted file system, e.g. through
a chroot, thus allowing access to system-critical data.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0587 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> While I would accept this for Unix, I am not sure this applies to NT,
 Northcutt> VMS, palm pilots, or commodore 64


=================================
Candidate: CAN-1999-0591
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990803
Assigned: 19990607
Category: CF

An event log in Windows NT has inappropriate access permissions.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0591 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Northcutt

Comments:
 Northcutt> splain Lucy, splain




--------------------- CLUSTER CFMISC ---------------------

CFMISC (18 candidates)
--------------------
Proposed: 7/28
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Miscellaneous CF problems


Voters:
  Shostack ACCEPT(5) RECAST(6) REJECT(6)
  Northcutt ACCEPT(6) NOOP(3) REJECT(8)


<PROPOSED> --> 17
ACCEPT --> 3
RECAST --> 4
REJECT --> 10

=================================
Candidate: CAN-1999-0497
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

Anonymous FTP is enabled

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0497 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Shostack
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0512
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

Mail relay is enabled, allowing abuse by spammers.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0512 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Northcutt, Shostack


=================================
Candidate: CAN-1999-0515
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

An unrestricted remote trust relationship for Unix systems has been
set up, e.g. by using a + sign in /etc/hosts.equiv.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0515 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Shostack

Comments:
 Shostack> Overly broad


=================================
Candidate: CAN-1999-0530
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A system is operating in "promiscuous" mode which allows it to perform
packet sniffing.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0530 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Shostack


=================================
Candidate: CAN-1999-0531
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

An SMTP service supports EXPN, VRFY, HELP, ESMTP, and/or EHLO.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0531 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   RECAST(1) Shostack
   REJECT(1) Northcutt

Comments:
 Shostack> I think expn != vrfy, help, esmtp.


=================================
Candidate: CAN-1999-0539
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A trust relationship exists between two Unix hosts.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0539 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Northcutt, Shostack

Comments:
 Northcutt> Too non specific


=================================
Candidate: CAN-1999-0547
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

An SSH server allows authentication through the .rhosts file.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0547 MOREVOTES (1 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Shostack
   NOOP(1) Northcutt


=================================
Candidate: CAN-1999-0548
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A superfluous NFS server is running, but it is not importing or exporting
any file systems.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0548 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Shostack
   REJECT(1) Northcutt


=================================
Candidate: CAN-1999-0555
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Unix account with a name other than "root" has UID 0, i.e. root
privileges.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0555 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Northcutt, Shostack

Comments:
 Northcutt> This is very bogus


=================================
Candidate: CAN-1999-0556
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

Two or more Unix accounts have the same UID.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0556 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Northcutt, Shostack


=================================
Candidate: CAN-1999-0561
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

IIS has the #exec function enabled for Server Side Include (SSI) files.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0561 RECAST (1 recast, 0 accept, 0 review) HAS_CDS

Current Votes:
   NOOP(1) Northcutt
   RECAST(1) Shostack


=================================
Candidate: CAN-1999-0564
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

An attacker can force a printer to print arbitrary documents (e.g. if
the printer doesn't require a password) or to become disabled.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0564 MOREVOTES (1 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Shostack
   NOOP(1) Northcutt


=================================
Candidate: CAN-1999-0565
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Sendmail alias allows input to be piped to a program.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0565 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   RECAST(1) Shostack

Comments:
 Shostack> Is this a default alias?  Is my .procmailrc an instance of this?


=================================
Candidate: CAN-1999-0568
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

rpc.admind in Solaris is not running in a secure mode.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0568 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   RECAST(1) Shostack

Comments:
 Shostack> are there secure modes?


=================================
Candidate: CAN-1999-0583
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

There is a one-way or two-way trust relationship between Windows NT
domains.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0583 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Northcutt, Shostack


=================================
Candidate: CAN-1999-0586
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A network service is running on a nonstandard port.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0586 REJECT (1 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   RECAST(1) Shostack
   REJECT(1) Northcutt

Comments:
 Shostack> Might be acceptable if clearer; is that a standard service on a
 Shostack> non-standard port, or any service on an unassigned port?


=================================
Candidate: CAN-1999-0590
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A system does not present an appropriate legal message or warning to a
user who is accessing it.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0590 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   RECAST(1) Shostack




--------------------- CLUSTER NOVULN ---------------------

NOVULN (19 candidates)
--------------------
Proposed: 7/28
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Problems that may be regarded as "not a vulnerability"


Voters:
  Wall ACCEPT(5) NOOP(5) REJECT(9)
  Northcutt ACCEPT(6) NOOP(6) REJECT(7)


<PROPOSED> --> 19
ACCEPT --> 3
NOOP --> 3
REJECT --> 13

=================================
Candidate: CAN-1999-0119
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF

Windows NT 4.0 beta allows users to read and delete shares.

INFERRED ACTION: CAN-1999-0119 REJECT (1 reject, 0 accept, 0 review)

Current Votes:
   NOOP(1) Northcutt
   REJECT(1) Wall

Comments:
 Wall> Reject based on beta copy.


=================================
Candidate: CAN-1999-0361
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Jan29,1999

NetWare version of LaserFiche stores usernames and passwords
unencrypted, and allows administrative changes without logging.

INFERRED ACTION: CAN-1999-0361 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0364
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Feb04,1999

Microsoft Access 97 stores a database password as plaintext in a
foreign mdb, allowing access to data.

INFERRED ACTION: CAN-1999-0364 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0397
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: L0PHT:Jan21,1999
Reference: BUGTRAQ:Jan21,1999

The demo version of the Quakenbush NT Password Appraiser sends
passwords across the network in plaintext.

INFERRED ACTION: CAN-1999-0397 REJECT (1 reject, 1 accept, 0 review)

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Wall

Comments:
 Wall> Reject based on beta copy.


=================================
Candidate: CAN-1999-0403
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Feb4,1999
Reference: XF:cyrix-hang

A bug in Cyrix CPU's on Linux allows local users to perform a denial
of service.

INFERRED ACTION: CAN-1999-0403 MOREVOTES (1 accept, 0 ack, 0 review)

Current Votes:
   ACCEPT(1) Northcutt
   NOOP(1) Wall


=================================
Candidate: CAN-1999-0453
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF

An attacker can identify a CISCO device by sending a SYN packet to
port 1999, which is for the Cisco Dicsovery Protocol (CDP).

INFERRED ACTION: CAN-1999-0453 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0454
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF

A remote attacker can sometimes identify the operating system of a
host based on how it reacts to some IP or ICMP packets, using a tool
such as nmap or queso.

INFERRED ACTION: CAN-1999-0454 REJECT (1 reject, 0 accept, 0 review)

Current Votes:
   NOOP(1) Wall
   REJECT(1) Northcutt

Comments:
 Northcutt> Nmap and queso are the tip of the iceberg and not the most advanced
 Northcutt> ways to accomplish this.  To pursue making the world signature free
 Northcutt> is as much a vulnerability as having signatures, nay more.


=================================
Candidate: CAN-1999-0459
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: XF:linux-milo-halt

Local users can perform a denial of service in Alpha Linux, using MILO
to force a reboot.

INFERRED ACTION: CAN-1999-0459 REJECT (1 reject, 0 accept, 0 review)

Current Votes:
   NOOP(1) Northcutt
   REJECT(1) Wall

Comments:
 Wall> Reject based on beta copy.


=================================
Candidate: CAN-1999-0465
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: XF:http-img-overflow

Remote attackers can crash Lynx and Internet Explorer using an IMG tag
with a large width parameter.

INFERRED ACTION: CAN-1999-0465 REJECT (1 reject, 1 accept, 0 review)

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Wall

Comments:
 Wall> Reject based on client-side DoS


=================================
Candidate: CAN-1999-0570
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

Windows NT is not using a password filter utility, e.g. PASSFILT.DLL.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0570 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Wall

Comments:
 Northcutt> Here we are crossing into the best practices arena again.  However since
 Northcutt> passfilt does establish a measurable standard and since we aren't the
 Northcutt> ones defining the stanard, simply saying it should be employed I will
 Northcutt> vote for this.


=================================
Candidate: CAN-1999-0584
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Windows NT file system is not NTFS.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0584 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Northcutt

Comments:
 Wall> NTFS partition provides the security.  This could be re-worded
 Wall> to "A Windows NT file system is FAT" since it is either NTFS or FAT
 Wall> and FAT is less secure.


=================================
Candidate: CAN-1999-0592
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

The Logon box of a Windows NT system displays the name of the last
user who logged in.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0592 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Wall, Northcutt

Comments:
 Wall> Information gathering, not vulnerability
 Northcutt> Ah a C2 weenie must have snuck this in, this can be a good thing
 Northcutt> not just vulnerability


=================================
Candidate: CAN-1999-0593
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A user is allowed to shut down a Windows NT system without logging in.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0593 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt

Comments:
 Wall> Still a denial of service.
 Northcutt> May well be appropriate


=================================
Candidate: CAN-1999-0594
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Windows NT system does not restrict access to removable media drives
such as a floppy disk drive or CDROM drive.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0594 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt

Comments:
 Wall> Perhaps it can be re-worded to "removable media drives
 Wall> such as a floppy disk drive or CDROM drive can be accessed (shared) in a
 Wall> Windows NT system."
 Northcutt> - what good is my NT w/o its floppy


=================================
Candidate: CAN-1999-0595
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: MSKB:Q182086

A Windows NT system does not clear the system page file during
shutdown, which might allow sensitive information to be recorded.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0595 MOREVOTES (1 accept, 1 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   NOOP(1) Northcutt


=================================
Candidate: CAN-1999-0596
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Windows NT log file has an inappropriate maximum size or retention
period.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0596 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Wall, Northcutt

Comments:
 Northcutt> define appropriate


=================================
Candidate: CAN-1999-0597
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

A Windows NT account policy does not forcibly disconnect remote users
from the server when their logon hours expire.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0597 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   REJECT(1) Wall


=================================
Candidate: CAN-1999-0603
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF

In Windows NT, an inappropriate user is a member of a group,
e.g. Administrator, Backup Operators, Domain Admins, Domain Guests,
Power Users, Print Operators, Replicators, System Operators, etc.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0603 REJECT (2 reject, 0 accept, 0 review) HAS_CDS

Current Votes:
   REJECT(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0654
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SA

The OS/2 or POSIX subsystem in NT is enabled.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0654 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Northcutt

Comments:
 Wall> These subsystems could still allow a process to persist across logins.




--------------------- CLUSTER PRIVACY ---------------------

PRIVACY (9 candidates)
--------------------
Proposed: 7/28
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Problems related to privacy


Voters:
  Wall ACCEPT(2) NOOP(7)
  Christey REJECT(1)
  Northcutt NOOP(9)


<PROPOSED> --> 9
ACCEPT --> 1
NOOP --> 7
REJECT --> 1

=================================
Candidate: CAN-1999-0031
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: CERT:CA-97.20.javascript

JavaScript allows remote attackers to monitor a user's web
activities.

INFERRED ACTION: CAN-1999-0031 MOREVOTES (1 accept, 1 ack, 0 review)

Current Votes:
   ACCEPT(1) Wall
   NOOP(1) Northcutt


=================================
Candidate: CAN-1999-0469
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:19990409 IE 5.0 security vulnerabilities - %01 bug again
Reference: XF:ie-window-spoof

Internet Explorer 5.0 allows window spoofing, allowing a remote
attacker to spoof a legitimate web site and capture information from
the client.

INFERRED ACTION: CAN-1999-0469 SMC_REJECT (1 reject, 1 accept, 0 review)

Current Votes:
   ACCEPT(1) Wall
   NOOP(1) Northcutt
   REJECT(1) Christey

Comments:
 Wall> Reference: Microsoft Security Bulletin MS99-012
 Christey> DUPE CAN-1999-0488


=================================
Candidate: CAN-1999-0604
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the WebStore 1.0 shopping cart
CGI program "web_store.cgi" could disclose private information.

INFERRED ACTION: CAN-1999-0604 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0605
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the Order Form 1.0 shopping cart
CGI program could disclose private information.

INFERRED ACTION: CAN-1999-0605 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0606
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the EZMall 2000 shopping cart
CGI program "mall2000.cgi" could disclose private information.

INFERRED ACTION: CAN-1999-0606 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0607
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the QuikStore shopping cart
CGI program "quikstore.cgi" could disclose private information.

INFERRED ACTION: CAN-1999-0607 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0608
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the PDG Shopping Cart CGI program
"shopper.cgi" could disclose private information.

INFERRED ACTION: CAN-1999-0608 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0609
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the SoftCart CGI program
"SoftCart.exe" could disclose private information.

INFERRED ACTION: CAN-1999-0609 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0610
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990728
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:19990420 Shopping Carts exposing CC data

An incorrect configuration of the Webcart CGI program
could disclose private information.

INFERRED ACTION: CAN-1999-0610 MOREVOTES (0 accept, 0 ack, 0 review)

Current Votes:
   NOOP(2) Wall, Northcutt




--------------------- CLUSTER NETCONF ---------------------

NETCONF (12 candidates)
--------------------
Proposed: 7/26
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Network configuration problems


Voters:
  Frech MODIFY(8) REVIEWING(4)
  Northcutt ACCEPT(3) NOOP(1) RECAST(1) REJECT(7)


<PROPOSED> --> 12
MODIFY --> 2
RECAST --> 1
REJECT --> 7
REVIEWING --> 2

=================================
Candidate: CAN-1999-0510
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A router or firewall allows source routed packets from arbitrary
hosts.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0510 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   MODIFY(1) Frech

Comments:
 Frech> XF:source-routing


=================================
Candidate: CAN-1999-0511
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

IP forwarding is enabled on a machine which is not a router or
firewall.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0511 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   MODIFY(1) Frech

Comments:
 Frech> XF:ip-forwarding


=================================
Candidate: CAN-1999-0523
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

ICMP echo (ping) is allowed from arbitrary hosts.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0523 REJECT (1 reject, 0 accept, 1 review) HAS_CDS

Current Votes:
   REJECT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Northcutt> (Though I sympathize with this one :)


=================================
Candidate: CAN-1999-0524
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

ICMP information such as netmask and timestamp is allowed from
arbitrary hosts.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0524 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   REJECT(1) Northcutt

Comments:
 Frech> XF:icmp-timestamp
 Frech> XF:icmp-netmask


=================================
Candidate: CAN-1999-0525
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

IP traceroute is allowed from arbitrary hosts.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0525 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   REJECT(1) Northcutt

Comments:
 Frech> XF:traceroute


=================================
Candidate: CAN-1999-0528
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A router or firewall forwards external packets that claim to come from
inside the network that the router/firewall is in front of.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0528 MOREVOTES (1 accept, 0 ack, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Frech> possibly XF:nisd-dns-fwd-check


=================================
Candidate: CAN-1999-0529
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A router or firewall forwards packets that claim to come from IANA
reserved or private addresses, e.g. 10.x.x.x, 127.x.x.x, 217.x.x.x,
etc.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0529 REJECT (1 reject, 0 accept, 1 review) HAS_CDS

Current Votes:
   REJECT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Northcutt> I have seen ISPs "assign" private addresses within their domain


=================================
Candidate: CAN-1999-0532
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A DNS server allows zone transfers.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0532 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   REJECT(1) Northcutt

Comments:
 Northcutt> (With split DNS implementations this is quite appropriate)
 Frech> XF:dns-zonexfer


=================================
Candidate: CAN-1999-0533
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A DNS server allows inverse queries.

CONTENT-DECISIONS: CF-DATA

INFERRED ACTION: CAN-1999-0533 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   REJECT(1) Northcutt

Comments:
 Northcutt> (rule of thumb)
 Frech> XF:dns-iquery


=================================
Candidate: CAN-1999-0550
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A router's routing tables can be obtained from arbitrary hosts.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0550 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   RECAST(1) Northcutt

Comments:
 Northcutt> Don't you mean obtained by arbitrary hosts
 Frech> XF:routed
 Frech> XF:decod-rip-entry
 Frech> XF:rip


=================================
Candidate: CAN-1999-0571
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF
Reference: BUGTRAQ:Feb5,1999

A router allows arbitrary hosts to connect to its configuration
service, or related services such as telnet.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0571 MOREVOTES (0 accept, 0 ack, 1 review) HAS_CDS

Current Votes:
   NOOP(1) Northcutt
   REVIEWING(1) Frech


=================================
Candidate: CAN-1999-0588
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A filter in a router or firewall allows unusual fragmented packets.

CONTENT-DECISIONS: CF-NETCONFIG

INFERRED ACTION: CAN-1999-0588 REJECT (1 reject, 1 accept, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   REJECT(1) Northcutt

Comments:
 Northcutt> I want to vote to accept this one, but unusual is a shade broad.
 Frech> XF:nt-rras
 Frech> XF:cisco-fragmented-attacks
 Frech> XF:ip-frag




--------------------- CLUSTER CDEC ---------------------

CDEC (15 candidates)
--------------------
Proposed: 7/26
Scheduled Interim Decision: 8/23
Scheduled Final Decision: 8/27

Candidates affected by current content decision debates


Voters:
  Frech ACCEPT(2) MODIFY(6) RECAST(1) REJECT(1)
  Wall ACCEPT(5) MODIFY(1) NOOP(4)
  Christey REVIEWING(5)


<FINAL> --> 5
<PROPOSED> --> 10
ACCEPT --> 1
MODIFY --> 2
RECAST --> 1
REJECT --> 1
REVIEWING --> 5

=================================
Candidate: CAN-1999-0015
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: CERT:CA-97.28.Teardrop_Land
Reference: XF:teardrop

Teardrop IP denial of service.

CONTENT-DECISIONS: LOA

INFERRED ACTION: CAN-1999-0015 SMC_REVIEW (2 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   MODIFY(1) Frech
   REVIEWING(1) Christey

Comments:
 Frech> XF: teardrop-mod
 Christey> Not sure how many separate "instances" of Teardrop there are.
 Christey> See: CAN-1999-0015, CAN-1999-0104, CAN-1999-0257, CAN-1999-0258


=================================
Candidate: CAN-1999-0098
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: XF:smtp-helo-bo

Buffer overflow in SMTP HELO command in Sendmail allows a remote
attacker to hide activities.

INFERRED ACTION: CAN-1999-0098 SMC_REVIEW (1 accept, 1 review)

Current Votes:
   MODIFY(1) Frech
   NOOP(1) Wall
   REVIEWING(1) Christey

Comments:
 Frech> (Accept XF reference.)
 Frech> Our references do not mention hiding activities. This issue can crash the
 Frech> SMTP server or execute arbitrary byte-code. Is there another reference
 Frech> available?
 Christey> Should this be merged with CAN-1999-0284, which is Sendmail
 Christey> with SMTP HELO?


=================================
Candidate: CAN-1999-0104
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: CERT:CA-97.28.Teardrop_Land
Reference: XF:teardrop-mod

A later variation on the Teardrop IP denial of service attack,
a.k.a. Teardrop-2

INFERRED ACTION: CAN-1999-0104 SMC_REVIEW (2 accept, 1 review)

Current Votes:
   ACCEPT(2) Wall, Frech
   REVIEWING(1) Christey

Comments:
 Wall> Another reference is Microsoft Knowledge Base Q179129.
 Christey> Not sure how many separate "instances" of Teardrop there are.
 Christey> See: CAN-1999-0015, CAN-1999-0104, CAN-1999-0257, CAN-1999-0258


=================================
Candidate: CAN-1999-0186
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: SUN:00178
Reference: XF:snmp-backdoor-access

In Solaris, an SNMP subagent has a default community string that allows remote
attackers to execute arbitrary commands as root, or modify system
parameters.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0186 MOREVOTES (1 accept, 1 ack, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   NOOP(1) Wall

Comments:
 Frech> Change XF:snmp-backdoor-access to XF:sol-hidden-commstr
 Frech> Add ISS:Hidden Community String in SNMP Implementation


=================================
Candidate: CAN-1999-0254
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: ISS:Hidden SNMP community in HP OpenView
Reference: XF:hpov-hidden-snmp-comm

A hidden SNMP community string in HP OpenView allows remote attackers
to modify MIB tables and obtain sensitive information.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0254 MOREVOTES (1 accept, 2 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Frech
   NOOP(1) Wall


=================================
Candidate: CAN-1999-0257
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF

Nestea variation of teardrop IP fragmentation denial of service.

INFERRED ACTION: CAN-1999-0257 SMC_REVIEW (2 accept, 1 review)

Current Votes:
   ACCEPT(1) Wall
   MODIFY(1) Frech
   REVIEWING(1) Christey

Comments:
 Frech> XF:nestea-linux-dos
 Christey> Not sure how many separate "instances" of Teardrop
 Christey> and its ilk.  Also see comments on CAN-1999-0001.
 Christey>
 Christey> See: CAN-1999-0015, CAN-1999-0104, CAN-1999-0257, CAN-1999-0258
 Christey>
 Christey> Is CAN-1999-0001 the same as CVE-1999-0052?  That one is related
 Christey> to nestea (CAN-1999-0257) and probably the one described in
 Christey> BUGTRAQ:19981023 nestea v2 against freebsd 3.0-Release
 Christey> The patch for nestea is in ip_input.c around line 750.
 Christey> The patches for CAN-1999-0001 are in lines 388&446.  So,
 Christey> CAN-1999-0001 is different from CAN-1999-0257 and CVE-1999-0052.
 Christey> The FreeBSD patch for CVE-1999-0052 is in line 750.
 Christey> So, CAN-1999-0257 and CVE-1999-0052 may be the same, though
 Christey> CVE-1999-0052 should be RECAST since this bug affects Linux
 Christey> and other OSes besides FreeBSD.
 Christey>
 Christey> Also see BUGTRAQ:19990909 CISCO and nestea.
 Christey>
 Christey> Finally, note that there is no fundamental difference between
 Christey> nestea and nestea2/nestea-v2; they are different ports that
 Christey> exploit the same problem.


=================================
Candidate: CAN-1999-0258
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF

Bonk variation of teardrop IP fragmentation denial of service.

INFERRED ACTION: CAN-1999-0258 SMC_REVIEW (2 accept, 1 review)

Current Votes:
   MODIFY(2) Wall, Frech
   REVIEWING(1) Christey

Comments:
 Wall> Reference Q179129
 Frech> XF:teardrop-mod
 Christey> Not sure how many separate "instances" of Teardrop there are.
 Christey> See: CAN-1999-0015, CAN-1999-0104, CAN-1999-0257, CAN-1999-0258


=================================
Candidate: CAN-1999-0411
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Feb19,1999
Reference: XF:sco-startup-scripts

Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p,
including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a
symlink attack, allowing a local user to gain root access.

CONTENT-DECISIONS: SF-EXEC

INFERRED ACTION: CAN-1999-0411 MOREVOTES (1 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech
   NOOP(1) Wall

Comments:
 Frech> Neither XFDB nor the BugTraq article (incidentally, shows up as 7 March, not
 Frech> 19 February) does not mention gaining root access... it says a local user
 Frech> could
 Frech> "delete or overwrite arbitrary files on the system."


=================================
Candidate: CAN-1999-0452
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: SF

A service or application has a backdoor password that was placed there
by the developer.

INFERRED ACTION: CAN-1999-0452 REJECT (1 reject, 1 accept, 0 review)

Current Votes:
   ACCEPT(1) Wall
   REJECT(1) Frech

Comments:
 Frech> Much too broad. Also may be HIGHCARD (or will be in the future).


=================================
Candidate: CAN-1999-0537
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990726
Assigned: 19990607
Category: CF

A configuration in a web browser such as Internet Explorer or Netscape
Navigator allows execution of active content such as ActiveX, Java,
Javascript, etc.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0537 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   RECAST(1) Frech

Comments:
 Frech> Good candidate for dot notation.
 Frech> XF:nav-java-enabled
 Frech> XF:nav-javascript-enabled
 Frech> XF:ie-active-content
 Frech> XF:ie-active-download
 Frech> XF:ie-active-scripting
 Frech> XF:ie-activex-execution
 Frech> XF:ie-java-enabled
 Frech> XF:netscape-javascript
 Frech> XF:netscape-java
 Frech> XF:zone-active-scripting
 Frech> XF:zone-activex-execution
 Frech> XF:zone-desktop-install
 Frech> XF:zone-low-channel
 Frech> XF:zone-file-download
 Frech> XF:zone-file-launch
 Frech> XF:zone-java-scripting
 Frech> XF:zone-low-java
 Frech> XF:zone-safe-scripting
 Frech> XF:zone-unsafe-scripting




--------------------- CLUSTER DESIGN ---------------------

DESIGN (27 candidates)
--------------------
Proposed: 7/20
Scheduled Proposed: 7/13
Scheduled Interim Decision: 8/2
Scheduled Final Decision: 8/6

Services or protocols with inherent design problems


Voters:
  Wall ACCEPT(2) NOOP(8)
  Frech ACCEPT(3) MODIFY(6) REVIEWING(2)
  Ozancin ACCEPT(8) RECAST(2)
  Northcutt ACCEPT(4) NOOP(3) REJECT(3)
  Meunier NOOP(1)
  Baker ACCEPT(10)


<FINAL> --> 17
<INTERIM> --> 1
<MODIFIED> --> 1
<PROPOSED> --> 8
ACCEPT --> 1
MODIFY --> 4
RECAST --> 2
REJECT --> 3
REVIEWING --> 1

=================================
Candidate: CAN-1999-0352
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SF
Reference: ISS:Multiple vulnerabilities in ControlIT(tm) (formerly Remotely Possible/32) enterprise management software
Reference: XF:controlit-passwd-encrypt

ControlIT 4.5 and earlier (aka Remotely Possible) has weak password
encryption.

CONTENT-DECISIONS: DESIGN-WEAK-ENCRYPTION,SF-EXEC

INFERRED ACTION: CAN-1999-0352 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Baker, Frech
   NOOP(2) Wall, Northcutt
   RECAST(1) Ozancin

Comments:
 Ozancin> Can we combine this with CAN-1999-0356 - ControlIT(tm) 4.5 and earlier uses
 Ozancin> weak encryption.


=================================
Candidate: CAN-1999-0356
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SF
Reference: ISS:Multiple vulnerabilities in ControlIT(tm) (formerly Remotely Possible/32) enterprise management software
Reference: XF:controlit-bookfile-access

ControlIT v4.5 and earlier uses weak encryption to store
usernames and passwords in an address book.

CONTENT-DECISIONS: DESIGN-WEAK-ENCRYPTION,SF-EXEC

INFERRED ACTION: CAN-1999-0356 RECAST (1 recast, 1 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Baker, Frech
   NOOP(2) Wall, Northcutt
   RECAST(1) Ozancin


=================================
Candidate: CAN-1999-0476
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:19990331 Potential vulnerability in SCO TermVision Windows 95 client
Reference: XF:sco-termvision-password

A weak encryption algorithm is used for passwords in SCO TermVision,
allowing them to be easily decrypted by a local user.

Modifications:
  ADDREF BUGTRAQ:19990331 Potential vulnerability in SCO TermVision Windows 95 client

CONTENT-DECISIONS: DESIGN-WEAK-ENCRYPTION

INFERRED ACTION: CAN-1999-0476 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Baker, Ozancin, Frech
   NOOP(2) Wall, Northcutt


=================================
Candidate: CAN-1999-0613
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SA

The rpc.sprayd service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0613 REJECT (1 reject, 2 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Baker, Ozancin
   MODIFY(1) Frech
   NOOP(1) Wall
   REJECT(1) Northcutt

Comments:
 Frech> XF:sprayd


=================================
Candidate: CAN-1999-0618
Published:
Final-Decision:
Interim-Decision:
Modified: 19990921-01
Proposed: 19990721
Assigned: 19990607
Category: SA
Reference: XF:rexec

The rexec service is running.

Modifications:
  ADDREF XF:rexec

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0618 ACCEPT (4 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Northcutt, Baker, Ozancin
   MODIFY(1) Frech

Comments:
 Frech> XF:decod-rexec
 Frech> XF:rexec


=================================
Candidate: CAN-1999-0624
Published:
Final-Decision:
Interim-Decision: 19990925
Modified: 19990924-01
Proposed: 19990721
Assigned: 19990607
Category: SA
Reference: XF:rstat-out
Reference: XF:rstatd

The rstat/rstatd service is running.

Modifications:
  ADDREF XF:rstat-out
  ADDREF XF:rstatd

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0624 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Northcutt, Baker, Ozancin
   MODIFY(1) Frech
   NOOP(2) Wall, Meunier

Comments:
 Frech> XF:rstat-out
 Frech> XF:rstatd


=================================
Candidate: CAN-1999-0625
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SA

The rpc.rquotad service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0625 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Northcutt, Baker, Ozancin
   MODIFY(1) Frech
   NOOP(1) Wall

Comments:
 Frech> XF:rquotad


=================================
Candidate: CAN-1999-0629
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SA

The ident/identd service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0629 REJECT (1 reject, 1 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(2) Baker, Ozancin
   NOOP(1) Wall
   REJECT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Frech> possibly XF:identd?


=================================
Candidate: CAN-1999-0647
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SA

The bootparam (bootparamd) service is running.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0647 REJECT (1 reject, 2 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Baker, Ozancin
   MODIFY(1) Frech
   NOOP(1) Wall
   REJECT(1) Northcutt

Comments:
 Frech> XF:bootp


=================================
Candidate: CAN-1999-0655
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: SA

A service may include useful information in its banner or help
function (such as the name and version), making it useful for
information gathering activities.

CONTENT-DECISIONS: SA

INFERRED ACTION: CAN-1999-0655 ACCEPT_REV (3 accept, 0 ack, 1 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Northcutt, Baker, Ozancin
   REVIEWING(1) Frech




--------------------- CLUSTER NTCONFIG ---------------------

NTCONFIG (13 candidates)
--------------------
Proposed: 7/20
Scheduled Proposed: 7/6
Scheduled Interim Decision: 8/2
Scheduled Final Decision: 8/6

Configuration problems related to NT


Voters:
  Frech MODIFY(11) REVIEWING(2)
  Shostack ACCEPT(12) REJECT(1)
  Wall ACCEPT(12) REVIEWING(1)
  Ozancin ACCEPT(9) MODIFY(3) RECAST(1)
  Christey ACCEPT(2)
  Northcutt ACCEPT(2) MODIFY(1) NOOP(1) RECAST(3) REJECT(6)
  Baker ACCEPT(8) MODIFY(2) REJECT(1) REVIEWING(2)


<PROPOSED> --> 13
MODIFY --> 4
RECAST --> 3
REJECT --> 6

=================================
Candidate: CAN-1999-0499
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

NETBIOS share information may be published through SNMP registry keys
in NT.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0499 ACCEPT (5 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(5) Wall, Northcutt, Baker, Shostack, Ozancin
   MODIFY(1) Frech

Comments:
 Frech> Change wording to 'Windows NT.'
 Frech> XF:snmp-netbios


=================================
Candidate: CAN-1999-0534
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT user has inappropriate rights or privileges, e.g. Act as
System, Add Workstation, Backup, Change System Time, Create Pagefile,
Create Permanent Object, Create Token Name, Debug, Generate Security
Audit, Increase Priority, Increase Quota, Load Driver, Lock Memory,
Profile Single Process, Remote Shutdown, Replace Process Token,
Restore, System Environment, Take Ownership, or Unsolicited Input.

CONTENT-DECISIONS: CF-PRIVS

INFERRED ACTION: CAN-1999-0534 ACCEPT (5 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(5) Wall, Baker, Shostack, Ozancin, Christey
   MODIFY(2) Northcutt, Frech

Comments:
 Northcutt> If we are going to write a laundry list put access to the scheduler in it.
 Christey> The list of privileges is very useful for lookup.
 Frech> XF:nt-create-token
 Frech> XF:nt-replace-token
 Frech> XF:nt-lock-memory
 Frech> XF:nt-increase-quota
 Frech> XF:nt-unsol-input
 Frech> XF:nt-act-system
 Frech> XF:nt-create-object
 Frech> XF:nt-sec-audit
 Frech> XF:nt-add-workstation
 Frech> XF:nt-manage-log
 Frech> XF:nt-take-owner
 Frech> XF:nt-load-driver
 Frech> XF:nt-profile-system
 Frech> XF:nt-system-time
 Frech> XF:nt-single-process
 Frech> XF:nt-increase-priority
 Frech> XF:nt-create-pagefile
 Frech> XF:nt-backup
 Frech> XF:nt-restore
 Frech> XF:nt-debug
 Frech> XF:nt-system-env
 Frech> XF:nt-remote-shutdown


=================================
Candidate: CAN-1999-0535
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT account policy for passwords has inappropriate,
security-critical settings, e.g. for password length, password age, or
uniqueness.

CONTENT-DECISIONS: CF-POLICY

INFERRED ACTION: CAN-1999-0535 RECAST (2 recast, 3 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Shostack
   MODIFY(2) Baker, Frech
   RECAST(2) Northcutt, Ozancin

Comments:
 Northcutt> inappropriate implies there is appropriate.  As a guy who has been
 Northcutt> monitoring
 Northcutt> networks for years I have deep reservations about justiying the existance
 Northcutt> of any fixed cleartext password. For appropriate to exist, some "we" would
 Northcutt> have to establish some criteria for appropriate passwords.
 Baker> Perhaps this could be re-worded a bit.  The CVE CAN-1999-00582
 Baker> specifies "...settings for lockouts".  To remain consistent with the
 Baker> other, maybe it should specify "...settings for passwords" I think
 Baker> most people would agree that passwords should be at least 8
 Baker> characters; contain letters (upper and lowercase), numbers and at
 Baker> least one non-alphanumeric; should only be good a limited time 30-90
 Baker> days; and should not contain character combinations from user's prior
 Baker> 2 or 3 passwords.
 Baker> Suggested rewrite -
 Baker> A Windows NT account policy does not enforce reasonable minimum
 Baker> security-critical settings for passwords, e.g. passwords of sufficient
 Baker> length, periodic required password changes, or new password uniqueness
 Ozancin> What is appropriate?
 Frech> XF:nt-autologonpwd
 Frech> XF:nt-pwlen
 Frech> XF:nt-maxage
 Frech> XF:nt-minage
 Frech> XF:nt-pw-history
 Frech> XF:nt-user-pwnoexpire
 Frech> XF:nt-unknown-pwdfilter
 Frech> XF:nt-pwd-never-expire
 Frech> XF:nt-pwd-nochange
 Frech> XF:nt-pwdcache-enable
 Frech> XF:nt-guest-change-passwords


=================================
Candidate: CAN-1999-0546
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

The Windows NT guest account is enabled.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0546 ACCEPT (5 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(5) Wall, Northcutt, Baker, Shostack, Ozancin
   MODIFY(1) Frech

Comments:
 Frech> XF:nt-guest-account


=================================
Candidate: CAN-1999-0562
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

The registry in Windows NT can be accessed remotely by users who are
not administrators.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0562 RECAST (1 recast, 4 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Baker, Shostack, Ozancin
   MODIFY(1) Frech
   RECAST(1) Northcutt

Comments:
 Northcutt> This isn't all or nothing, users may be allowed to access part of the
 Northcutt> registry.
 Frech> XF:nt-winreg-all
 Frech> XF:nt-winreg-net


=================================
Candidate: CAN-1999-0572
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

.reg files are associated with the Windows NT registry editor, making
the registry susceptible to Trojan Horse attacks.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0572 ACCEPT (4 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Baker, Shostack, Ozancin
   MODIFY(1) Frech
   NOOP(1) Northcutt

Comments:
 Northcutt> I don't quite get what this means, sorry
 Frech> XF:nt-regfile


=================================
Candidate: CAN-1999-0575
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT system's user audit policy does not log an event success
or failure, e.g. for Logon and Logoff, File and Object Access, Use of
User Rights, User and Group Management, Security Policy Changes,
Restart, Shutdown, and System, and Process Tracking.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0575 RECAST (1 recast, 4 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Shostack, Ozancin, Christey
   MODIFY(1) Frech
   RECAST(1) Northcutt
   REVIEWING(1) Baker

Comments:
 Northcutt> It isn't a great truth that you should enable all or the above, if you
 Northcutt> do you potentially introduce a vulnerbility of filling up the file
 Northcutt> system with stuff you will never look at.
 Ozancin> It is far less interesting what a user does successfully that what they
 Ozancin> attempt and fail at.
 Christey> The list of event types is very useful for lookup.
 Frech> XF:nt-system-audit
 Frech> XF:nt-logon-audit
 Frech> XF:nt-object-audit
 Frech> XF:nt-privil-audit
 Frech> XF:nt-process-audit
 Frech> XF:nt-policy-audit
 Frech> XF:nt-account-audit


=================================
Candidate: CAN-1999-0576
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT system's file audit policy does not log an event success
or failure for security-critical files or directories.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0576 REJECT (1 reject, 4 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Wall, Baker, Shostack
   MODIFY(2) Ozancin, Frech
   REJECT(1) Northcutt

Comments:
 Northcutt> 1.) Too general are we ready to state what the security-critical files
 Northcutt> and directories are
 Northcutt> 2.) Does Ataris, Windows CE, PalmOS, Linux have such a capability
 Ozancin> Some files and directories are clearly understood to be critical. Others are
 Ozancin> unclear. We need to clarify that critical is.
 Frech> XF:nt-object-audit


=================================
Candidate: CAN-1999-0577
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT system's file audit policy does not log an event success
or failure for non-critical files or directories.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0577 REJECT (1 reject, 4 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Shostack
   MODIFY(2) Ozancin, Frech
   REJECT(1) Northcutt
   REVIEWING(1) Baker

Comments:
 Ozancin> It is far less interesting what a user does successfully that what they
 Ozancin> attempt and fail at.
 Ozancin> Perhaps only failure should be logged.
 Frech> XF:nt-object-audit


=================================
Candidate: CAN-1999-0578
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT system's registry audit policy does not log an event
success or failure for security-critical registry keys.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0578 REJECT (1 reject, 3 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(4) Wall, Baker, Shostack, Ozancin
   REJECT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Ozancin> with reservation
 Ozancin> Again what is defined as critical


=================================
Candidate: CAN-1999-0579
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT system's registry audit policy does not log an event
success or failure for non-critical registry keys.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0579 REJECT (1 reject, 3 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(3) Wall, Baker, Shostack
   MODIFY(1) Ozancin
   REJECT(1) Northcutt
   REVIEWING(1) Frech

Comments:
 Ozancin> Again only failure may be of interest. It would be impractical to wad
 Ozancin> through the incredibly large amount of logging that this would generate. It
 Ozancin> could overwhelm log entries that you might find interesting.


=================================
Candidate: CAN-1999-0582
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT account policy has inappropriate, security-critical
settings for lockout, e.g. lockout duration, lockout after bad logon
attempts, etc.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0582 REJECT (1 reject, 4 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Wall, Shostack, Ozancin
   MODIFY(2) Baker, Frech
   REJECT(1) Northcutt

Comments:
 Northcutt> The definition is?
 Baker> Maybe a rewording of this one too.  I think most people would agree on
 Baker> some "minimum" policies like 3-5 bad attempts lockout for an hour or
 Baker> until the administrator unlocks the account.
 Baker> Suggested rewrite -
 Baker> A Windows NT account policy does not enforce reasonable minimum
 Baker> security-critical settings for lockouts, e.g. lockout duration,
 Baker> lockout after bad logon attempts, etc.
 Ozancin> with reservations
 Ozancin> What is appropriate?
 Frech> XF:nt-thres-lockout
 Frech> XF:nt-lock-duration
 Frech> XF:nt-lock-window
 Frech> XF:nt-perm-lockout
 Frech> XF:lockout-disabled


=================================
Candidate: CAN-1999-0585
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990721
Assigned: 19990607
Category: CF

A Windows NT administrator account has the default name of
Administrator.

CONTENT-DECISIONS: CF

INFERRED ACTION: CAN-1999-0585 REJECT (3 reject, 2 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Ozancin
   MODIFY(1) Frech
   REJECT(3) Northcutt, Baker, Shostack
   REVIEWING(1) Wall

Comments:
 Wall> Some sources say this is not a vulnerability, but a warning.  It just
 Wall> slows down the search for the admin account (SID = 500) which can
 Wall> always be found.
 Northcutt> I change this on all NT systems I am responsible for, but is
 Northcutt> root a vulnerability?
 Baker> There are ways to identify the administrator account anyway, so this
 Baker> is only a minor delay to someone that is knowledgeable.  This, in and
 Baker> of itself, doesn't really strike me as a vulnerability, anymore than
 Baker> the root account on a Unix box.
 Shostack> (there is no way to hide the account name today)
 Frech> XF:nt-adminexists




--------------------- CLUSTER PASS ---------------------

PASS (14 candidates)
--------------------
Proposed: 7/14
Scheduled Proposed: 7/6
Scheduled Interim Decision: 7/26
Scheduled Final Decision: 7/30

Configuration problems related to passwords


Voters:
  Shostack ACCEPT(14)
  Northcutt ACCEPT(14)
  Baker ACCEPT(14)
  Meunier ACCEPT(14)


<PROPOSED> --> 14
ACCEPT --> 14

=================================
Candidate: CAN-1999-0501
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Unix account has a guessable password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0501 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0502
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Unix account has a default, null, blank, or missing password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0502 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0503
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Windows NT local user or administrator account has a guessable
password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0503 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0504
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Windows NT local user or administrator account has a default, null,
blank, or missing password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0504 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0505
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Windows NT domain user or administrator account has a guessable
password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0505 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0506
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A Windows NT domain user or administrator account has a default, null,
blank, or missing password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0506 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0507
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

An account on a router, firewall, or other network device has a guessable
password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0507 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0508
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

An account on a router, firewall, or other network device has a
default, null, blank, or missing password.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0508 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0516
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

An SNMP community name is guessable.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0516 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0517
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

An SNMP community name is the default (e.g. public), null, or
missing.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0517 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0518
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A NETBIOS/SMB share password is guessable.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0518 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0519
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A NETBIOS/SMB share password is the default, null, or missing.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0519 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0521
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

An NIS domain name is easily guessable.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0521 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker


=================================
Candidate: CAN-1999-0541
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: CF

A password for accessing a WWW URL is guessable.

CONTENT-DECISIONS: CF-PASS

INFERRED ACTION: CAN-1999-0541 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(4) Northcutt, Shostack, Meunier, Baker




--------------------- CLUSTER MULT2 ---------------------

MULT2 (14 candidates)
--------------------
Proposed: 7/13
Scheduled Interim Decision: 7/26
Scheduled Final Decision: 7/30

other vuln's with multiple executables/LOA content decision


Voters:
  Frech ACCEPT(2) REVIEWING(2)
  Shostack ACCEPT(1) NOOP(1) REJECT(2)
  Christey REVIEWING(1)
  Northcutt ACCEPT(4)


<FINAL> --> 10
<PROPOSED> --> 4
REJECT --> 2
REVIEWING --> 2

=================================
Candidate: CAN-1999-0169
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: SF
Reference: XF:nfs-uid

NFS allows attackers to read and write any file on the system by
specifying a false UID.

INFERRED ACTION: CAN-1999-0169 REJECT (1 reject, 2 accept, 0 review)

Current Votes:
   ACCEPT(2) Northcutt, Frech
   REJECT(1) Shostack

Comments:
 Shostack> this is not a vulnerability but a design feature.


=================================
Candidate: CAN-1999-0171
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: SF
Reference: XF:syslog-flood

Denial of service in syslog by sending it a large number of
superfluous messages.

INFERRED ACTION: CAN-1999-0171 REJECT (1 reject, 2 accept, 1 review)

Current Votes:
   ACCEPT(2) Northcutt, Frech
   REJECT(1) Shostack
   REVIEWING(1) Christey

Comments:
 Shostack> design issue, not a vulnerability.  Alternately, add:
 Shostack> DOS on server by opening a large number of telnet sessions..
 Christey> Duplicate of CVE-1999-0566?


=================================
Candidate: CAN-1999-0193
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: SF

Denial of service in Ascend and 3com routers, which can be rebooted by
sending a zero length TCP option.

INFERRED ACTION: CAN-1999-0193 MOREVOTES (2 accept, 0 ack, 1 review)

Current Votes:
   ACCEPT(2) Northcutt, Shostack
   REVIEWING(1) Frech

Comments:
 Frech> possibly XF:ascend-kill
 Frech> I can't find a reference that lists both routers in the same reference.


=================================
Candidate: CAN-1999-0298
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990714
Assigned: 19990607
Category: SF
Reference: NAI:NAI-6

ypbind with -ypset and -ypsetme options activated
in Linux Slackware and SunOS allows local and remote attackers to
overwrite files.

INFERRED ACTION: CAN-1999-0298 MOREVOTES (1 accept, 1 ack, 1 review)

Current Votes:
   ACCEPT(1) Northcutt
   NOOP(1) Shostack
   REVIEWING(1) Frech




--------------------- CLUSTER MULT ---------------------

MULT (35 candidates)
--------------------
Proposed: 6/23
Scheduled Interim Decision: 7/5
Scheduled Final Decision: 7/9

Multiple executables split into


Voters:
  Wall ACCEPT(2) MODIFY(2)
  Levy ACCEPT(3) MODIFY(1)
  Ozancin ACCEPT(1) MODIFY(1) REVIEWING(1)
  Landfield ACCEPT(3) MODIFY(1) NOOP(1)
  Frech ACCEPT(4) MODIFY(11) RECAST(2) REVIEWING(2)
  Christey NOOP(3) RECAST(1) REJECT(1) REVIEWING(2)
  Northcutt ACCEPT(1) NOOP(3)
  Balinsky NOOP(1)
  Prosser ACCEPT(3) MODIFY(1) RECAST(2)
  Blake ACCEPT(2)


<FINAL> --> 15
<INTERIM> --> 1
<MODIFIED> --> 7
<PROPOSED> --> 11
ACCEPT --> 3
MODIFY --> 8
RECAST --> 4
REJECT --> 1
REVIEWING --> 3

=================================
Candidate: CAN-1999-0030
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: CERT:CA-97.21.sgi_buffer_overflow
Reference: AUSCERT:AA-97.24.IRIX.xlock.buffer.overflow.vul
Reference: XF:sgi-xlockbo
Reference: SGI:19970508-02-PX

root privileges via buffer overflow in xlock command on SGI IRIX
systems.

INFERRED ACTION: CAN-1999-0030 SMC_REJECT (1 reject, 3 accept, 0 review)

Current Votes:
   ACCEPT(3) Prosser, Levy, Ozancin
   RECAST(1) Frech
   REJECT(1) Christey

Comments:
 Frech> XF:xlock-bo (also add)
 Frech> As per xlock-bo, also appears on AIX, BSDI, DG/UX, FreeBSD, Solaris, and
 Frech> several Linii.
 Frech> Also, don't you mean to cite SGI:19970502-02-PX? The one you list is
 Frech> login/scheme.
 Levy> Notice that this xlock overflow is the same as in
 Levy> CA-97.13. CA-97.21 simply is a reminder.
 Christey> As pointed out by Elias, CA-97.21 states: "For more
 Christey> information about vulnerabilities in xlock... see CA-97.13"
 Christey> CA-97.13 = CVE-1999-0038.
 Christey> This may also be a duplicate with CAN-1999-0306.


=================================
Candidate: CAN-1999-0076
Published:
Final-Decision:
Interim-Decision:
Modified: 19990925-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: XF:ftp-args

Buffer overflow in wu-ftp from PASV command causes a core dump.

Modifications:
  DESC make more explicit to distinguish from CAN-1999-0075

INFERRED ACTION: CAN-1999-0076 MOREVOTES (1 accept, 0 ack, 0 review)

Current Votes:
   ACCEPT(1) Frech
   NOOP(1) Balinsky

Comments:
 Balinsky> Don't know what this is.  Is this the LIST Core dump vulnerability?


=================================
Candidate: CAN-1999-0092
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: ERS:ERS-SVA-E01-1997:006.1

Various vulnerabilities in the AIX portmir command allows
local users to obtain root access.

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0092 MOREVOTES (1 accept, 1 ack, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech

Comments:
 Frech> XF:ibm-portmir


=================================
Candidate: CAN-1999-0101
Published:
Final-Decision:
Interim-Decision: 20000111
Modified: 20000105-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: ERS:ERS-SVA-E01-1997:001.1
Reference: ERS:ERS-SVA-E01-1996:007.1
Reference: SUN:00137a
Reference: CIAC:H-13
Reference: NAI:NAI-1
Reference: XF:ghbn-bo

Buffer overflow in AIX and Solaris "gethostbyname" library call allows
root access through corrupt DNS host names.

Modifications:
  ADDREF CIAC:H-13
  CHANGEREF SUN:00137 SUN:00137a
  ADDREF XF:ghbn-bo

CONTENT-DECISIONS: SF-CODEBASE

INFERRED ACTION: CAN-1999-0101 ACCEPT_ACK (2 accept, 3 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Prosser
   MODIFY(1) Frech
   NOOP(1) Christey

Comments:
 Frech> XF:ghbn-bo
 Frech> in addition to ERS:1997:001.1, also include 1996:007.1
 Frech> Sun's bulletin is 137a, not 137.
 Prosser> concur wtih Andre, sun bul is 137a
 Christey> The NAI advisory discusses a problem with programs trusting
 Christey> the length field that is returned from gethostbyname().
 Christey> The ERS and SUN advisories implicitly refer to
 Christey> BUGTRAQ:19961118 Serious hole in Solaris 2.5[.1]
 Christey> gethostbyname() (exploit included)
 Christey> which allows local users to gain access by providing
 Christey> arguments *to* gethostbyname().
 Christey> As both Andre and Mike's comments relate to the advisories,
 Christey> NAI-1 will be deleted as a reference for this candidate, and
 Christey> a new candidate will be proposed later on.


=================================
Candidate: CAN-1999-0124
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: CERT:CA-93:11.UMN.UNIX.gopher.vulnerability
Reference: XF:gopher-vuln

Vulnerabilities in UMN gopher and gopher+ allow an intruder to read
any files that can be accessed by the gopher daemon.

INFERRED ACTION: CAN-1999-0124 MOREVOTES (1 accept, 1 ack, 0 review)

Current Votes:
   ACCEPT(1) Frech


=================================
Candidate: CAN-1999-0127
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: CERT:CA-96.27.hp_sw_install
Reference: AUSCERT:AA-96.04
Reference: XF:hpux-swinstall

swinstall and swmodify commands in SD-UX package in HP-UX systems
allow local users to create or overwrite arbitrary files to gain root
access.

CONTENT-DECISIONS: SF-EXEC

INFERRED ACTION: CAN-1999-0127 ACCEPT_ACK (2 accept, 2 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Prosser
   MODIFY(1) Frech
   NOOP(1) Christey

Comments:
 Frech> (keep current XF: reference, and add)
 Frech> XF:hpux-sqwmodify
 Christey> Perhaps this should be split, per SF-LOC.


=================================
Candidate: CAN-1999-0231
Published:
Final-Decision:
Interim-Decision:
Modified: 19991207-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:19990317 Re: SLMail 2.6 DoS - Imail also

Buffer overflow in IP-Switch IMail and Seattle Labs Slmail 2.6
packages using a long VRFY command, causing a denial of service and
possibly remote access.

Modifications:
  ADDREF BUGTRAQ:19990317 Re: SLMail 2.6 DoS - Imail also

CONTENT-DECISIONS: SF-CODEBASE

INFERRED ACTION: CAN-1999-0231 RECAST (1 recast, 1 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Levy
   NOOP(2) Northcutt, Landfield
   RECAST(1) Frech
   REVIEWING(1) Ozancin

Comments:
 Frech> XF:slmail-vrfyexpn-overflow (for Slmail v3.2 and below)
 Frech> XF:smtp-vrfy-bo (many mail packages)
 Northcutt> (There is no way I will have access to these systems)


=================================
Candidate: CAN-1999-0261
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:19980504 Netmanage Holes
Reference: INSECURE:http://www.insecure.org/sploits/netmanage.chameleon.overflows.html

Netmanager Chameleon SMTPd has several buffer overflows that cause a crash.

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0261 MOREVOTES (2 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   MODIFY(2) Frech, Landfield
   NOOP(1) Northcutt

Comments:
 Frech> XF:chamelion-smtp-dos
 Landfield> - Specify what "a crash" means.


=================================
Candidate: CAN-1999-0282
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: CERT:CA-95.12.sun.loadmodule.vul

Vulnerabilities in loadmodule and modload programs in SunOS and OpenWindows

INFERRED ACTION: CAN-1999-0282 RECAST (1 recast, 1 accept, 0 review)

Current Votes:
   MODIFY(1) Frech
   RECAST(1) Prosser

Comments:
 Frech> XF:sun-loadmodule
 Frech> XF:sun-modload (CERT CA-93.18 very old!)
 Prosser> Believe the reference given, 95-12,  is referencing a later
 Prosser> loadmodule(8) setuid problem in the X11/NeWS windowing system.  There is an
 Prosser> earlier, similar setuid vulnerability in the CA-93.18, CIAC G-02 advisories
 Prosser> for the SunOS 4.1.x/Solbourne and OpenWindow 3.0.  In fact, there may be the
 Prosser> same as the HP patches are 100448-02 for the 93 loadmodule/modload
 Prosser> vulnerability and 100448-03 for the 95 loadmodule vulnerability which
 Prosser> normally indicated a patch update.  Looks like the original patch either
 Prosser> didn't completely fix the problem or it resurfaced in X11 NeWS.  Can't tell
 Prosser> much beyond that and this is my opinion only as have no way to check it.
 Prosser> Which one is this CVE referencing?  I accept both.


=================================
Candidate: CAN-1999-0284
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: XF:smtp-helo-bo

Denial of service to NT mail servers including Ipswitch, Mdaemon, and
Exchange through a buffer overflow in the SMTP HELO command.

CONTENT-DECISIONS: SF-CODEBASE/DUPE CAN-1999-0098

INFERRED ACTION: CAN-1999-0284 SMC_REVIEW (5 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(2) Blake, Northcutt
   MODIFY(3) Frech, Levy, Ozancin
   REVIEWING(1) Christey

Comments:
 Frech> "Windows NT-based mail servers" (A trademark thing, and for clarification)
 Frech> XF:mdaemon-helo-bo
 Frech> XF:lotus-notes-helo-crash
 Frech> XF:slmail-helo-overflow
 Frech> XF:smtp-helo-bo (mentions several products)
 Frech> XF:smtp-exchangedos
 Levy> - Need one per software. Each one should be its own
 Levy> vulnerability.
 Ozancin> => Windows NT is correct
 Christey> These are probably multiple codebases, so we'll need to use
 Christey> dot notation.  Also need to see if this should be merged
 Christey> with CAN-1999-0098 (Sendmail SMTP HELO).


=================================
Candidate: CAN-1999-0333
Published:
Final-Decision:
Interim-Decision:
Modified: 19990925-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: RSI:RSI.0009.09-08-98.HP-UX.OMNIBACK
Reference: HP:HPSBUX9810-085
Reference: XF:omniback-remote

HP OpenView Omniback allows remote execution of commands as root via
spoofing, and local users can gain root access via a symlink attack.

Modifications:
  ADDREF HP:HPSBUX9810-085

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0333 RECAST (1 recast, 2 accept, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Frech
   MODIFY(1) Prosser
   RECAST(1) Christey

Comments:
 Prosser> additional source
 Prosser> HP Security Bulletin 85
 Prosser> http://us-support.external.hp.com
 Prosser> http://europe-support.external.hp.com
 Christey> Two separate bugs, so SF-LOC says this candidate should be
 Christey> split


=================================
Candidate: CAN-1999-0354
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: NTBUGTRAQ:Jan27,1999
Reference: MS:MS99-002

Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution
of Visual Basic programs to the IE client through the Word 97
template, which doesn't warn the user that the template contains
executable content.  Also applies to Outlook when the client views a
malicious email message.

CONTENT-DECISIONS: SF-EXEC, SF-LOC

INFERRED ACTION: CAN-1999-0354 MOREVOTES (1 accept, 1 ack, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Wall
   REVIEWING(1) Frech


=================================
Candidate: CAN-1999-0415
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: ISS:Remote Reconfiguration and Denial of Service Vulnerabilities in Cisco 700 ISDN Routers

The Clickstart web server in Cisco 700 series routers allows remote
attackers to execute commands on the router, or perform information
gathering, without authentication.

INFERRED ACTION: CAN-1999-0415 MOREVOTES (1 accept, 1 ack, 0 review)

Current Votes:
   MODIFY(1) Frech

Comments:
 Frech> Reference: ISS:March11,1999 (consistent with cluster 1, CAN-1999-0008)
 Frech> XF:cisco-router-commands
 Frech> XF:cisco-web-config


=================================
Candidate: CAN-1999-0416
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: ISS:Remote Reconfiguration and Denial of Service Vulnerabilities in Cisco 700 ISDN Routers

The Clickstart web server in Cisco 700 series routers allows remote
attackers to perform a denial of service.

INFERRED ACTION: CAN-1999-0416 MOREVOTES (1 accept, 1 ack, 0 review)

Current Votes:
   MODIFY(1) Frech

Comments:
 Frech> Reference: ISS:March11,1999
 Frech> XF:cisco-web-crash


=================================
Candidate: CAN-1999-0435
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: HP:HPSBUX9903-096

MC/ServiceGuard and MC/LockManager in HP-UX allows local users to gain
privileges through SAM.

CONTENT-DECISIONS: SF-EXEC

INFERRED ACTION: CAN-1999-0435 MOREVOTES (1 accept, 1 ack, 0 review) HAS_CDS

Current Votes:
   MODIFY(1) Frech

Comments:
 Frech> XF:hp-servicegaurd


=================================
Candidate: CAN-1999-0467
Published:
Final-Decision:
Interim-Decision:
Modified: 20000106-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: NTBUGTRAQ:19990409 Webcom's CGI Guestbook for Win32 web servers
Reference: XF:http-cgi-webcom-guestbook

The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a
remote attacker to read arbitrary files using the "template"
parameter.

Modifications:
  ADDREF NTBUGTRAQ:19990409 Webcom's CGI Guestbook for Win32 web servers
  DESC Add "read file via templates."

CONTENT-DECISIONS: SF-EXEC

INFERRED ACTION: CAN-1999-0467 ACCEPT (3 accept, 0 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(3) Frech, Landfield, Blake
   NOOP(2) Northcutt, Christey

Comments:
 Christey> CAN-1999-0287 is probably a duplicate of CAN-1999-0467.  In
 Christey> NTBUGTRAQ:19990409 Webcom's CGI Guestbook for Win32 web servers
 Christey> Mnemonix says that he had previously reported on a similar
 Christey> problem.  Let's refer to the NTBugtraq posting as
 Christey> CAN-1999-0467.  We will refer to the "previous report" as
 Christey> CAN-1999-0287, which can be found at:
 Christey> http://oliver.efri.hr/~crv/security/bugs/NT/httpd41.html
 Christey>
 Christey> 0287 describes an exploit via the "template" hidden variable.
 Christey> The exploit describes manually editing the HTML form to
 Christey> change the filename to read from the template variable.
 Christey>
 Christey> The exploit as described in 0467 encodes the template variable
 Christey> directly into the URL.  However, hidden variables are also
 Christey> encoded into the URL, which would have looked the same to
 Christey> the web server regardless of the exploit.  Therefore 0287
 Christey> and 0467 are the same.


=================================
Candidate: CAN-1999-0488
Published:
Final-Decision:
Interim-Decision:
Modified: 19991205-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: MS:MS99-012

Internet Explorer 4.0 and 5.0 allows a remote attacker to execute
security scripts in a different security context using malicious
URLs, a variant of the "cross frame" vulnerability.

Modifications:
  DESC added cross-frame and version details

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0488 ACCEPT (3 accept, 1 ack, 0 review) HAS_CDS

Current Votes:
   ACCEPT(1) Landfield
   MODIFY(2) Frech, Wall

Comments:
 Frech> XF:ie-mshtml-crossframe
 Wall> (source: MSKB:Q168485)


=================================
Candidate: CAN-1999-0489
Published:
Final-Decision:
Interim-Decision:
Modified: 19991205-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: MS:MS99-015

MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste
a file name into the file upload intrinsic control, a variant of
"untrusted scripted paste" as described in MS:MS98-013.

Modifications:
  DESC modified to discriminate more from "untrusted scripted
  paste" as described in MS:MS98-013.

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0489 RECAST (1 recast, 2 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(1) Levy
   MODIFY(1) Wall
   RECAST(1) Prosser
   REVIEWING(1) Frech

Comments:
 Frech> Wasn't Untrusted scripted paste MS98-015? I can find no mention of a
 Frech> clipboard in either.
 Frech> I cannot proceed on this one without further clarification.
 Wall> (source: MS:MS99-012)
 Prosser> agree with Andre here.  The Untrusted Scripted paste
 Prosser> vulnerability was originally addressed in MS98-015 and it is in the file
 Prosser> upload intrinsic control in which an attacker can paste the name of a file
 Prosser> on the target's drive in the control and a form submission would then send
 Prosser> that file from the attacked machine to the remote web site.  This one has
 Prosser> nothing to do with the clipboard.  What the advisory mentioned here,
 Prosser> MS99-012, does is replace the MSHTML parsing engine which is supposed to fix
 Prosser> the original Untrusted Scripted Paste issue and a variant, as well as the
 Prosser> two Cross-Frame variants and a privacy issue in IMG SRC.
 Prosser> The vulnerability that allowed reading of a user's clipboard is the Forms
 Prosser> 2.0 Active X control vulnerability discussed in MS99-01


=================================
Candidate: CAN-1999-0490
Published:
Final-Decision:
Interim-Decision:
Modified: 19991205-01
Proposed: 19990623
Assigned: 19990607
Category: SF
Reference: MS:MS99-012

MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to learn
information about a local user's files via an IMG SRC tag.

Modifications:
  DESC added "IMG SRC" details.

CONTENT-DECISIONS: SF-LOC

INFERRED ACTION: CAN-1999-0490 SMC_REVIEW (3 accept, 1 review) HAS_CDS

Current Votes:
   ACCEPT(2) Wall, Landfield
   MODIFY(1) Frech
   REVIEWING(1) Christey

Comments:
 Frech> XF:ie-scriplet-fileread
 Christey> Duplicate of CAN-1999-0347?
Prev by Date: [VOTES] Vote details for other recently proposed clusters
Next by Date: [VOTES] Vote details for remaining older clusters
Prev by thread: [VOTES] Vote details for other recently proposed clusters
Next by thread: [VOTES] Vote details for remaining older clusters
Index(es):
- Date
- Thread
Page Last Updated: May 22, 2007
Common Vulnerabilities and Exposures

[VOTES] Vote details for older clusters related to content decisions
