|
|
|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PROPOSAL] Cluster RECENT-51 - 20 candidates
The following cluster contains 20 candidates that were anounced between December 16, 2000 and January 10, 2001. You may vote on candidates by modifying this email ballot and sending it back to me, or by using the CVE voting web site. The voting web site will be updated with this cluster later today. Recent additions to the Editorial Board will also be notified about their account information at that time. The candidates are listed in order of priority. Priority 1 and Priority 2 candidates both deal with varying levels of vendor confirmation, so they should be easy to review and it can be trusted that the problems are real. If you discover that any RECENT-XX cluster is incomplete with respect to the problems discovered during the associated time frame, please send that information to me so that candidates can be assigned. - Steve Summary of votes to use (in ascending order of "severity") ---------------------------------------------------------- ACCEPT - voter accepts the candidate as proposed NOOP - voter has no opinion on the candidate MODIFY - voter wants to change some MINOR detail (e.g. reference/description) REVIEWING - voter is reviewing/researching the candidate, or needs more info RECAST - candidate must be significantly modified, e.g. split or merged REJECT - candidate is "not a vulnerability", or a duplicate, etc. 1) Please write your vote on the line that starts with "VOTE: ". If you want to add comments or details, add them to lines after the VOTE: line. 2) If you see any missing references, please mention them so that they can be included. References help greatly during mapping. 3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes. So if you don't have sufficient information for a candidate but you don't want to NOOP, use a REVIEWING. ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ====================================================== Candidate: CAN-2001-0125 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0125 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20001231 Advisory: exmh symlink vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97846489313059&w=2 Reference: BUGTRAQ:20010112 exmh security vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97958594330100&w=2 Reference: CONFIRM:http://www.beedub.com/exmh/symlink.html Reference: FREEBSD:FreeBSD-SA-01:17 Reference: URL:http://archives.neohapsis.com/archives/freebsd/2001-01/0543.html Reference: MANDRAKE:MDKSA-2001:015 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-015.php3 Reference: DEBIAN:DSA-022-1 Reference: URL:http://www.debian.org/security/2001/dsa-022 Reference: XF:exmh-error-symlink Reference: URL:http://xforce.iss.net/static/5829.php exmh 2.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the exmhErrorMsg temporary file. Analysis ---------------- ED_PRI CAN-2001-0125 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0128 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0128 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: MANDRAKE:MDKSA-2000-083 Reference: URL:http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-083.php3 Reference: CONECTIVA:CLA-2000:365 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000365 Reference: REDHAT:RHSA-2000:127-06 Reference: URL:http://www.redhat.com/support/errata/powertools/RHSA-2000-127.html Reference: DEBIAN:DSA-006-1 Reference: URL:http://www.debian.org/security/2000/20001219 Reference: FREEBSD:FreeBSD-SA-01:06 Reference: URL:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:06.zope.asc Reference: XF:zope-calculate-roles Reference: URL:http://xforce.iss.net/static/5777.php Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges. Analysis ---------------- ED_PRI CAN-2001-0128 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0131 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0131 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: DEBIAN:DSA-021 Reference: URL:http://www.debian.org/security/2001/dsa-021 Reference: BID:2182 Reference: URL:http://www.securityfocus.com/bid/2182 htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0131 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0139 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0139 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:010 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-010.php3 Reference: CALDERA:CSSA-2001-001.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2001-001.0.txt Reference: BID:2190 Reference: URL:http://www.securityfocus.com/bid/2190 inn 2.2.3 allows local users to overwrite arbitrary files via a symlink attack in some configurations. Analysis ---------------- ED_PRI CAN-2001-0139 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0141 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0141 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:009 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-009.php3 Reference: DEBIAN:DSA-011 Reference: URL:http://www.debian.org/security/2001/dsa-011 Reference: CALDERA:CSSA-2001-002.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2001-002.0.txt Reference: BID:2187 Reference: URL:http://www.securityfocus.com/bid/2187 mgetty 1.1.22 allows local users to overwrite arbitrary files via a symlink attack in some configurations. Analysis ---------------- ED_PRI CAN-2001-0141 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0116 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0116 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:006 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-006.php3 Reference: BID:2188 Reference: URL:http://www.securityfocus.com/bid/2188 gpm 1.19.3 allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0116 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0117 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0117 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:008-1 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-008.php3 Reference: BID:2191 Reference: URL:http://www.securityfocus.com/bid/2191 sdiff 2.7 in the diffutils package allows local users to overwrite files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0117 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0118 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0118 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001-005 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-005.php3 Reference: BID:2195 Reference: URL:http://www.securityfocus.com/bid/2195 rdist 6.1.5 allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0118 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0119 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0119 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:004 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-004.php3 Reference: BID:2194 Reference: URL:http://www.securityfocus.com/bid/2194 getty_ps 2.0.7j allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0119 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0120 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0120 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:007 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-007.php3 Reference: BID:2196 Reference: URL:http://www.securityfocus.com/bid/2196 useradd program in shadow-utils program may allow local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0120 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0123 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0123 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010107 Cgisecurity.com Advisory #3.1 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97905792214999&w=2 Reference: BID:2177 Reference: URL:http://www.securityfocus.com/bid/2177 Directory traversal vulnerability in eXtropia bbs_forum.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the file parameter. Analysis ---------------- ED_PRI CAN-2001-0123 2 Vendor Acknowledgement: yes followup Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0124 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0124 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010109 Solaris /usr/lib/exrecover buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97908386502156&w=2 Reference: SUNBUG:4161925 Reference: BID:2179 Reference: URL:http://www.securityfocus.com/bid/2179 Buffer overflow in exrecover in Solaris 2.6 and earlier possibly allows local users to gain privileges via a long command line argument. Analysis ---------------- ED_PRI CAN-2001-0124 2 Vendor Acknowledgement: yes followup Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0126 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0126 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010109 Oracle XSQL servlet and xml-stylesheet allow executing java on the web server Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97906670012796&w=2 Reference: BUGTRAQ:20010123 Patch for Potential Vulnerability in Oracle XSQL Servlet Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=98027700625521&w=2 Oracle XSQL servlet 1.0.3.0 and earlier allows remote attackers to execute arbitrary Java code by redirecting the XSQL server to another source via the xml-stylesheet parameter in the xslt stylesheet. Analysis ---------------- ED_PRI CAN-2001-0126 2 Vendor Acknowledgement: yes followup Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0138 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0138 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://archives.neohapsis.com/archives/linux/immunix/2001-q1/0010.html Reference: BID:2189 Reference: URL:http://www.securityfocus.com/bid/2189 privatepw program in wu-ftpd before 2.6.1-6 allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0138 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0140 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0140 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:002 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-002.php3 Reference: BID:2183 Reference: URL:http://www.securityfocus.com/bid/2183 arpwatch 2.1a4 allows local users to overwrite arbitrary files via a symlink attack in some configurations. Analysis ---------------- ED_PRI CAN-2001-0140 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0142 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0142 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010112 Trustix Security Advisory - diffutils squid Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-01/0212.html Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:003 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-003.php3 Reference: BID:2184 Reference: URL:http://www.securityfocus.com/bid/2184 squid 2.3 and earlier allows local users to overwrite arbitrary files via a symlink attack in some configurations. Analysis ---------------- ED_PRI CAN-2001-0142 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0143 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0143 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010110 Immunix OS Security update for lots of temp file problems Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97916374410647&w=2 Reference: MANDRAKE:MDKSA-2001:011 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-011.php3 Reference: BID:2186 Reference: URL:http://www.securityfocus.com/bid/2186 vpop3d program in linuxconf 1.23r and earlier allows local users to overwrite arbitrary files via a symlink attack. Analysis ---------------- ED_PRI CAN-2001-0143 2 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0121 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0121 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010108 def-2001-01: ImageCast IC3 Control Center DoS Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-01/0071.html Reference: BID:2174 Reference: URL:http://www.securityfocus.com/bid/2174 ImageCast Control Center 4.1.0 allows remote attackers to cause a denial of service (resource exhaustion or system crash) via a long string to port 12002. Analysis ---------------- ED_PRI CAN-2001-0121 3 Vendor Acknowledgement: Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0122 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0122 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20010108 def-2001-02: IBM Websphere 3.52 Kernel Leak DoS Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-01/0079.html Reference: BID:2175 Reference: URL:http://www.securityfocus.com/bid/2175 Memory leak in ApfaCache module in IBM HTTP Server and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests. Analysis ---------------- ED_PRI CAN-2001-0122 3 Vendor Acknowledgement: unknown discloser-claimed Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2001-0136 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0136 Final-Decision: Interim-Decision: Modified: Proposed: 20010214 Assigned: 20010206 Category: SF Reference: BUGTRAQ:20001220 ProFTPD 1.2.0 Memory leakage - denial of service Reference: URL:http://www.securityfocus.com/archive/1/152206 Reference: BUGTRAQ:20010109 Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-01/0122.html Reference: BUGTRAQ:20010110 Re: Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-01/0132.html Reference: XF:proftpd-size-memory-leak Reference: URL:http://xforce.iss.net/static/5801.php Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed. Analysis ---------------- ED_PRI CAN-2001-0136 3 Vendor Acknowledgement: Details on this item are extremely sketchy. In a followup, Michael Zalewski observes that the posted exploit does not add carriage returns, so it is generating one extremely large line. This in turn could be the source of the DoS. See: http://www.securityfocus.com/archive/1/152404 Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS:
|
||||
