[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[INTERIM] ACCEPT 350 candidates (Final April 2)
- To: cve-editorial-board-list@lists.mitre.org
- Subject: [INTERIM] ACCEPT 350 candidates (Final April 2)
- From: "Steven M. Christey" <coley@rcf-smtp.mitre.org>
- Date: Wed, 26 Mar 2003 18:03:17 -0500 (EST)
- Delivery-Date: Wed Mar 26 18:03:30 2003
- Sender: owner-cve-editorial-board-list@lists.mitre.org
I have made an Interim Decision to ACCEPT the following 350 candidates. I will make a Final Decision on April 2. The following Editorial Board members voted on these candidates: Ozancin ACCEPT(1) Green ACCEPT(90) MODIFY(2) NOOP(1) Magdych NOOP(1) LeBlanc NOOP(2) Cole ACCEPT(335) NOOP(14) Jones ACCEPT(4) MODIFY(9) NOOP(2) Balinsky ACCEPT(2) NOOP(2) Foat ACCEPT(82) MODIFY(3) NOOP(263) Cox ACCEPT(48) MODIFY(19) NOOP(239) Christey NOOP(136) Wall ACCEPT(118) NOOP(221) Ziese ACCEPT(8) NOOP(3) Levy ACCEPT(3) Frech ACCEPT(110) MODIFY(104) Alderson ACCEPT(31) Stracener ACCEPT(1) Baker ACCEPT(279) Prosser ACCEPT(3) Armstrong ACCEPT(159) NOOP(17) ====================================================== Candidate: CAN-1999-1337 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1337 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20010912 Assigned: 20010831 Category: SF Reference: BUGTRAQ:19990801 midnight commander vulnerability(?) (fwd) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=93370073207984&w=2 Reference: XF:midnight-commander-data-disclosure(9873) Reference: URL:http://www.iss.net/security_center/static/9873.php FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges. Modifications: ADDREF XF:midnight-commander-data-disclosure(9873) Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-1999-1337 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(1) Cole MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> (Task 1765) CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:midnight-commander-data-disclosure(9873) ====================================================== Candidate: CAN-1999-1468 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1468 Final-Decision: Interim-Decision: 20030326 Modified: 20020218-01 Proposed: 20010912 Assigned: 20010831 Category: SF Reference: MISC:http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-01.html Reference: CERT:CA-91.20 Reference: URL:http://www.cert.org/advisories/CA-91.20.rdist.vulnerability Reference: BID:31 Reference: URL:http://www.securityfocus.com/bid/31 Reference: XF:rdist-popen-gain-privileges(7160) Reference: URL:http://www.iss.net/security_center/static/7160.php rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable. Modifications: ADDREF XF:rdist-popen-gain-privileges(7160) CHANGEREF MISC [change url] Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-1999-1468 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Foat, Cole, Stracener MODIFY(1) Frech NOOP(2) Christey, Wall Voter Comments: Frech> XF:rdist-popen-gain-privileges(7160) MISC reference is dead. Alternative: http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-01.html Christey> It is unclear whether this is addressed by SUN:00115, SUN:00110, both, or neither. ====================================================== Candidate: CAN-1999-1490 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-1490 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20010912 Assigned: 20010831 Category: SF Reference: BUGTRAQ:19980528 ALERT: Tiresome security hole in "xosview", RedHat5.1? Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=90221101926021&w=2 Reference: BUGTRAQ:19980529 Re: Tiresome security hole in "xosview" (xosexp.c) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=90221101926034&w=2 Reference: BID:362 Reference: URL:http://www.securityfocus.com/bid/362 Reference: XF:linux-xosview-bo(8787) Reference: URL:http://www.iss.net/security_center/static/8787.php xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable. Modifications: ADDREF XF:linux-xosview-bo(8787) Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-1999-1490 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(1) Cole MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> (ACCEPT; Task 2354) CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:linux-xosview-bo(8787) ====================================================== Candidate: CAN-2000-0502 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0502 Final-Decision: Interim-Decision: 20030326 Modified: 20020222-01 Proposed: 20000712 Assigned: 20000711 Category: SF Reference: BUGTRAQ:20000607 Mcafee Alerting DOS vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0038.html Reference: BID:1326 Reference: URL:http://www.securityfocus.com/bid/1326 Reference: XF:mcafee-alerting-dos(4641) Reference: URL:http://xforce.iss.net/static/4641.php Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion. Modifications: ADDREF XF:mcafee-alerting-dos(4641) Analysis -------- Vendor Acknowledgement: unknown INFERRED ACTION: CAN-2000-0502 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Ozancin, Levy, Wall MODIFY(1) Frech NOOP(1) LeBlanc Voter Comments: Frech> XF:mcafee-alerting-dos(4641) CHANGE> [Wall changed vote from REVIEWING to ACCEPT] ====================================================== Candidate: CAN-2000-0590 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0590 Final-Decision: Interim-Decision: 20030326 Modified: 20010910-01 Proposed: 20000719 Assigned: 20000719 Category: SF Reference: BUGTRAQ:20000706 Vulnerability in Poll_It cgi v2.0 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-07/0076.html Reference: BID:1431 Reference: URL:http://www.securityfocus.com/bid/1431 Reference: XF:http-cgi-pollit-variable-overwrite(4878) Reference: URL:http://xforce.iss.net/static/4878.php Poll It 2.0 CGI script allows remote attackers to read arbitrary files by specifying the file name in the data_dir parameter. Modifications: ADDREF XF:http-cgi-pollit-variable-overwrite(4878) Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: Inquiry sent to http://www.cgi-world.com/cgi-bin/forms/forms.cgi on 2/22/2002. Confirmed by vendor on 2/22/2002. INFERRED ACTION: CAN-2000-0590 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Levy, Cole MODIFY(1) Frech NOOP(4) Magdych, LeBlanc, Wall, Christey Voter Comments: Frech> XF;http-cgi-pollit-variable-overwrite(4878) CHANGE> [Magdych changed vote from REVIEWING to NOOP] Christey> MISC:http://www.cgi-world.com/download/pollit.html An item on October 24, 2000 says "Updated to Version 2.05 from 2.0 to Fix Security Issues" but it's not clear whether it's related to *this* security issue; it's probably talking about CVE-2000-1068/1069/1070. Inquiry sent to http://www.cgi-world.com/cgi-bin/forms/forms.cgi on 2/22/2002. Confirmed by vendor on 2/22/2002. ====================================================== Candidate: CAN-2000-1210 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1210 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20000322 Security bug in Apache project: Jakarta Tomcat Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95371672300045&w=2 Reference: XF:apache-tomcat-file-contents(4205) Reference: URL:http://www.iss.net/security_center/static/4205.php Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2000-1210 ACCEPT (6 accept, 0 ack, 0 review) Current Votes: ACCEPT(6) Baker, Frech, Cox, Cole, Armstrong, Green NOOP(2) Wall, Foat Voter Comments: Green> APPEARS TO BE ACKNOWLEDGED IN APACHE'S BUGZILLA (#93 SEEMS CLOSE) ====================================================== Candidate: CAN-2000-1211 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1211 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20001222 Zope DTML Role Issue Reference: REDHAT:RHSA-2000:125 Reference: CONFIRM:http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert Reference: MANDRAKE:MDKSA-2000:083 Reference: URL:http://www.linux-mandrake.com/en/security/2000/MDKSA-2000-083.php3 Reference: XF:zope-legacy-names(5824) Reference: URL:http://www.iss.net/security_center/static/5824.php Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities. Modifications: ADDREF XF:zope-legacy-names(5824) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2000-1211 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Cox> ADDREF:REDHAT:RHSA-2000:125 Frech> XF:zope-legacy-names(5824) ====================================================== Candidate: CAN-2000-1212 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1212 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: MANDRAKE:MDKSA-2000:086 Reference: CONECTIVA:CLA-2000:365 Reference: DEBIAN:DSA-007 Reference: CONFIRM:http://www.zope.org/Products/Zope/Hotfix_2000-12-18/security_alert Reference: REDHAT:RHSA-2000:135 Reference: XF:zope-image-file(5778) Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2000-1212 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(6) Baker, Frech, Cox, Cole, Armstrong, Green NOOP(2) Wall, Foat ====================================================== Candidate: CAN-2001-0724 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0724 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-02 Proposed: 20020131 Assigned: 20010927 Category: SF Reference: MS:MS01-055 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS01-055.asp Reference: XF:ie-incorrect-security-zone-variant(8471) Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing Vulnerability variant" of CVE-2001-0664. Modifications: ADDREF XF:ie-incorrect-security-zone-variant(8471) DESC Change "CAN" to "CVE" in description. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-0724 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Baker MODIFY(1) Frech Voter Comments: Frech> (ACCEPT) CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:ie-incorrect-security-zone-variant(8471) ====================================================== Candidate: CAN-2001-0748 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0748 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20011012 Assigned: 20011012 Category: SF Reference: BUGTRAQ:20010531 Acme.Server v1.7 of 13nov96 Directory Browsing Reference: URL:http://www.securityfocus.com/archive/1/188141 Reference: XF:acme-serve-directory-traversal(6634) Reference: URL:http://www.iss.net/security_center/static/6634.php Reference: CISCO:20020702 Cisco Secure ACS Unix Acme.server Information Disclosure Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/acmeweb-acsunix-dirtravers-vuln-pub.shtml Reference: BID:2809 Reference: URL:http://www.securityfocus.com/bid/2809 Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several / (slash) characters to the URI. Modifications: ADDREF XF:acme-serve-directory-traversal(6634) ADDREF CISCO:20020702 Cisco Secure ACS Unix Acme.server Information Disclosure Vulnerability DESC replace "." with "/"; change spelling ADDREF BID:2809 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2001-0748 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(1) Armstrong MODIFY(1) Frech NOOP(4) Wall, Foat, Cole, Christey Voter Comments: Frech> XF:acme-serve-directory-traversal(6634) Christey> Change description to say "Acme.Serve". The original discloser spelled it 2 different ways. Christey> Description: Is it . or slash? Christey> Acknowledged by Cisco (!): CISCO:20020702 Cisco Secure ACS Unix Acme.server Information Disclosure Vulnerability URL:http://www.cisco.com/warp/public/707/acmeweb-acsunix-dirtravers-vuln-pub.shtml This affects Cisco Secure ACS Unix installation, and Cisco reports that it's due to multiple / at the end. ====================================================== Candidate: CAN-2001-0763 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0763 Final-Decision: Interim-Decision: 20030326 Modified: 20020821-03 Proposed: 20011012 Assigned: 20011012 Category: SF Reference: BUGTRAQ:20010608 potential buffer overflow in xinetd-2.1.8.9pre11-1 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-06/0064.html Reference: CONECTIVA:CLA-2001:404 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000404 Reference: DEBIAN:DSA-063 Reference: URL:http://www.debian.org/security/2001/dsa-063 Reference: SUSE:SA:2001:022 Reference: URL:http://lists.suse.com/archives/suse-security-announce/2001-Jun/0002.html Reference: IMMUNIX:IMNX-2001-70-024-01 Reference: URL:http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-024-01 Reference: ENGARDE:ESA-20010621-01 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-1469.html Reference: CIAC:L-104 Reference: URL:http://www.ciac.org/ciac/bulletins/l-104.shtml Reference: REDHAT:RHSA-2001:075 Reference: URL:http://www.redhat.com/support/errata/RHSA-2001-075.html Reference: FREEBSD:FreeBSD-SA-01:47 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:47.xinetd.asc Reference: XF:xinetd-identd-bo(6670) Reference: URL:http://xforce.iss.net/static/6670.php Reference: BID:2840 Reference: URL:http://www.securityfocus.com/bid/2840 Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, which is not properly handled by the svc_logprint function. Modifications: ADDREF XF:xinetd-identd-bo(6670) ADDREF BID:2840 ADDREF IMMUNIX:IMNX-2001-70-029-01 ADDREF ENGARDE:ESA-20010621-01 ADDREF CIAC:L-104 ADDREF REDHAT:RHSA-2001:075 ADDREF FREEBSD:FreeBSD-SA-01:47 ADDREF CONECTIVA:CLA-2001:404 DELREF CONECTIVA:CLA-2001:406 CHANGEREF IMMUNIX:IMNX-2001-70-024-01 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-0763 ACCEPT (5 accept, 5 ack, 0 review) Current Votes: ACCEPT(4) Foat, Cole, Armstrong, Baker MODIFY(1) Frech NOOP(2) Wall, Christey Voter Comments: Frech> XF:xinetd-identd-bo(6670) Christey> Need to sift through the references to make sure they're correct and appropriately distinguish from CAN-2001-0825. Christey> ADDREF CONECTIVA:CLA-2001:404 Christey> ADDREF FREEBSD:FreeBSD-SA-01:47 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:47.xinetd.asc DELREF CONECTIVA:CLA-2001:406 (that's for CAN-2001-0825) ADDREF CONECTIVA:CLA-2001:404 DELREF IMMUNIX:IMNX-2001-70-029-01 (that's for CAN-2001-0825) ADDREF IMMUNIX:IMNX-2001-70-024-01 ====================================================== Candidate: CAN-2001-0873 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0873 Final-Decision: Interim-Decision: 20030326 Modified: 20020818-01 Proposed: 20020131 Assigned: 20011206 Category: SF Reference: BUGTRAQ:20010908 Multiple vendor 'Taylor UUCP' problems. Reference: URL:http://www.securityfocus.com/archive/1/212892 Reference: BUGTRAQ:20011130 Redhat 7.0 local root (via uucp) (attempt 2) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100715446131820 Reference: CALDERA:CSSA-2001-033.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2001-033.0.txt Reference: CONECTIVA:CLA-2001:425 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000425 Reference: SUSE:SuSE-SA:2001:38 Reference: URL:http://www.suse.de/de/support/security/2001_038_uucp_txt.txt Reference: BID:3312 Reference: URL:http://www.securityfocus.com/bid/3312 Reference: XF:uucp-argument-gain-privileges(7099) Reference: URL:http://xforce.iss.net/static/7099.php Reference: REDHAT:RHSA-2001:165 Reference: URL:http://rhn.redhat.com/errata/RHSA-2001-165.html uuxqt in Taylor UUCP package does not properly remove dangerous long options, which allows local users to gain privileges by calling uux and specifying an alternate configuration file with the --config option. Modifications: ADDREF REDHAT:RHSA-2001:165 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-0873 ACCEPT (3 accept, 3 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Baker NOOP(3) Wall, Foat, Christey Voter Comments: Christey> ADDREF CONECTIVA:CLA-2002:463 Christey> No wait, scratch CONECTIVA:CLA-2002:463... It only mentions this older vulnerability. Christey> REDHAT:RHSA-2001:165 (per Mark Cox) ====================================================== Candidate: CAN-2001-0891 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0891 Final-Decision: Interim-Decision: 20030326 Modified: 20020616-01 Proposed: 20020131 Assigned: 20020116 Category: SF Reference: BUGTRAQ:20011127 UNICOS LOCAL HOLE ALL VERSIONS Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100695627423924&w=2 Reference: SGI:20020101-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020101-01-I Reference: XF:unicos-nqsd-format-string(7618) Format string vulnerability in NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX allows a local user to gain root privileges by using qsub to submit a batch job whose name contains formatting characters. Modifications: ADDREF XF:unicos-nqsd-format-string(7618) DESC Add SGI IRIX versions Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-0891 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker MODIFY(1) Frech NOOP(3) Wall, Foat, Christey Voter Comments: Frech> XF:unicos-nqsd-format-string(7618) Christey> Change desc to include SGI versions ====================================================== Candidate: CAN-2001-0921 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0921 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020131 Assigned: 20020131 Category: SF Reference: BUGTRAQ:20011121 Mac Netscape password fields Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100638816318705&w=2 Reference: XF:macos-netscape-print-passwords(7593) Reference: URL:http://xforce.iss.net/static/7593.php Reference: BID:3565 Reference: URL:http://www.securityfocus.com/bid/3565 Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the password has been typed, which is printed in cleartext. Analysis -------- Vendor Acknowledgement: unknown INFERRED ACTION: CAN-2001-0921 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Foat, Cole, Frech NOOP(2) Wall, Armstrong ====================================================== Candidate: CAN-2001-0959 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0959 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020131 Assigned: 20020131 Category: SF Reference: BUGTRAQ:20010915 ARCserve 6.61 Share Access Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-09/0137.html Reference: MISC:http://support.ca.com/Download/patches/asitnt/QO00945.html Reference: BID:3342 Reference: URL:http://www.securityfocus.com/bid/3342 Reference: XF:arcserve-aremote-plaintext(7122) Reference: URL:http://www.iss.net/security_center/static/7122.php Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to obtain sensitive information and overwrite critical files. Modifications: ADDREF XF:arcserve-aremote-plaintext(7122) Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: document QO00945, dated September 14, states that it "addresses a potential security vulnerability in ARCserve 2000 when performing full backups," which may be a vague acknowledgement of the problem. Followup posts to the original Bugtraq post do not say that the patch does NOT fix the problem, so the combination of these implicit or vague clues may be sufficient to determine that the vendor has fixed the problem and, by extension, acknowledged it. INFERRED ACTION: CAN-2001-0959 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(1) Cole MODIFY(2) Green, Frech NOOP(2) Wall, Foat Voter Comments: Green> VENDOR ACKNOWLEDGEMENT VAGUE Frech> XF:arcserve-aremote-plaintext(7122) ====================================================== Candidate: CAN-2001-0960 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0960 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020131 Assigned: 20020131 Category: CF Reference: BUGTRAQ:20010915 ARCserve 6.61 Share Access Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-09/0137.html Reference: MISC:http://support.ca.com/Download/patches/asitnt/QO00945.html Reference: XF:arcserve-aremote-plaintext(7122) Reference: URL:http://xforce.iss.net/static/7122.php Reference: BID:3343 Reference: URL:http://www.securityfocus.com/bid/3343 Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremote.dmp file in the ARCSERVE$ hidden share, which allows local and remote attackers to gain privileges. Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: document QO00945, dated September 14, states that it "addresses a potential security vulnerability in ARCserve 2000 when performing full backups," which may be a vague acknowledgement of the problem. Followup posts to the original Bugtraq post do not say that the patch does NOT fix the problem, so the combination of these implicit or vague clues may be sufficient to determine that the vendor has fixed the problem and, by extension, acknowledged it. INFERRED ACTION: CAN-2001-0960 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(2) Cole, Frech MODIFY(1) Green NOOP(2) Wall, Foat Voter Comments: Green> VENDOR ACKNOWLEDGEMENT MISSING ====================================================== Candidate: CAN-2001-0978 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0978 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020131 Assigned: 20020131 Category: SF Reference: HPBUG:PHCO_17719 Reference: URL:http://archives.neohapsis.com/archives/hp/2001-q3/0052.html Reference: HPBUG:PHCO_24454 Reference: BID:3289 Reference: URL:http://www.securityfocus.com/bid/3289 Reference: XF:hpux-login-btmp(8632) Reference: URL:http://www.iss.net/security_center/static/8632.php login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password guessing attacks without being detected or observed using the lastb program. Modifications: ADDREF XF:hpux-login-btmp(8632) Analysis -------- Vendor Acknowledgement: yes patch INFERRED ACTION: CAN-2001-0978 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Baker MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:hpux-login-btmp(8632) ====================================================== Candidate: CAN-2001-1008 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1008 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020131 Assigned: 20020131 Category: SF Reference: BUGTRAQ:20010824 Java Plugin 1.4 with JRE 1.3 -> Ignores certificates. Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-08/0359.html Reference: BID:3245 Reference: URL:http://www.securityfocus.com/bid/3245 Reference: XF:javaplugin-jre-expired-certificate(7048) Reference: URL:http://www.iss.net/security_center/static/7048.php Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate. Modifications: ADDREF XF:javaplugin-jre-expired-certificate(7048) Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2001-1008 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(2) Cole, Green MODIFY(1) Frech NOOP(3) Wall, Foat, Armstrong Voter Comments: Frech> XF:javaplugin-jre-expired-certificate(7048) ====================================================== Candidate: CAN-2001-1028 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1028 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020131 Assigned: 20020131 Category: SF Reference: REDHAT:RHSA-2001:072 Reference: URL:http://www.redhat.com/support/errata/RHSA-2001-072.html Reference: XF:man-ultimate-source-bo(8622) Reference: URL:http://www.iss.net/security_center/static/8622.php Buffer overflow in ultimate_source function of man 1.5 and earlier allows local users to gain privileges. Modifications: ADDREF XF:man-ultimate-source-bo(8622) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1028 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Baker MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:man-ultimate-source-bo(8622) ====================================================== Candidate: CAN-2001-1036 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1036 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020131 Assigned: 20020131 Category: SF Reference: BUGTRAQ:20010801 Slackware 8.0, 7.1 Vulnerability: /usr/bin/locate Reference: URL:http://www.securityfocus.com/archive/1/200991 Reference: XF:locate-command-execution(6932) Reference: URL:http://xforce.iss.net/static/6932.php Reference: BID:3127 Reference: URL:http://www.securityfocus.com/bid/3127 GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2001-1036 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Frech NOOP(3) Wall, Foat, Armstrong ====================================================== Candidate: CAN-2001-1059 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1059 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020131 Assigned: 20020131 Category: CF Reference: BUGTRAQ:20010730 vmware bug? Reference: URL:http://www.securityfocus.com/archive/1/200455 Reference: BID:3119 Reference: URL:http://www.securityfocus.com/bid/3119 Reference: XF:vmware-obtain-license-info(6925) Reference: URL:http://xforce.iss.net/static/6925.php VMWare creates a temporary file vmware-log.USERNAME with insecure permissions, which allows local users to read or modify license information. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2001-1059 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(4) Foat, Cole, Green, Frech NOOP(2) Wall, Armstrong ====================================================== Candidate: CAN-2001-1106 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1106 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020315 Assigned: 20020315 Category: SF Reference: BUGTRAQ:20010725 Sambar Server password decryption Reference: URL:http://www.securityfocus.com/archive/1/199418 Reference: BID:3095 Reference: URL:http://www.securityfocus.com/bid/3095 Reference: XF:sambar-insecure-passwords(6909) Reference: URL:http://xforce.iss.net/static/6909.php The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure. Analysis -------- Vendor Acknowledgement: unknown discloser-claimed INFERRED ACTION: CAN-2001-1106 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Frech, Ziese NOOP(5) Wall, Foat, Cole, Armstrong, Christey Voter Comments: Green> There is vendor acknowledgement in http://www.security.nnov.ru/advisories/sambarpass.asp Christey> For CVE's purposes, I do not count a vendor quote or excerpt from a third party as acknowledgement. ====================================================== Candidate: CAN-2001-1145 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1145 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020315 Assigned: 20020315 Category: SF Reference: NETBSD:NetBSD-SA2001-016 Reference: URL:http://archives.neohapsis.com/archives/netbsd/2001-q3/0204.html Reference: FREEBSD:FreeBSD-SA-01:40 Reference: URL:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:40.fts.v1.1.asc Reference: OPENBSD:20010530 029: SECURITY FIX: May 30, 2001 Reference: URL:http://www.openbsd.org/errata28.html Reference: BID:3205 Reference: URL:http://online.securityfocus.com/bid/3205 Reference: XF:bsd-fts-race-condition(8715) Reference: URL:http://www.iss.net/security_center/static/8715.php fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories. Modifications: ADDREF XF:bsd-fts-race-condition(8715) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1145 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Green, Baker, Ziese MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:bsd-fts-race-condition(8715) ====================================================== Candidate: CAN-2001-1251 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1251 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20010629 4 New vulns. vWebServer and SmallHTTP Reference: URL:http://online.securityfocus.com/archive/1/194418 Reference: BID:2980 Reference: URL:http://online.securityfocus.com/bid/2980 Reference: XF:vwebserver-long-url-dos(6771) Reference: URL:http://www.iss.net/security_center/static/6771.php SmallHTTP 1.204 through 3.00 beta 8 allows remote attackers to cause a denial of service via multiple long URL requests. Analysis -------- Vendor Acknowledgement: unknown discloser-claimed Discloser claims "all versions vulnerable" but only lists 2.x and 3.x, not 1.x. The lowest version listed (1.204) and the highest version up to the post date (3.00 beta 8) were chosen. INFERRED ACTION: CAN-2001-1251 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1291 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1291 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20010712 3Com TelnetD Reference: URL:http://www.securityfocus.com/archive/1/196957 Reference: XF:3com-telnetd-brute-force(6855) Reference: URL:http://xforce.iss.net/static/6855.php Reference: BID:3034 Reference: URL:http://www.securityfocus.com/bid/3034 The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2001-1291 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1296 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1296 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20011002 results of semi-automatic source code audit Reference: URL:http://www.securityfocus.com/archive/1/218000 Reference: MISC:http://www.moregroupware.org/index.php?action=detail&news_id=24 Reference: XF:php-includedir-code-execution(7215) Reference: URL:http://www.iss.net/security_center/static/7215.php Reference: BID:3383 Reference: URL:http://www.securityfocus.com/bid/3383 More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: the release notes dated October 31, 2001 say that the new release includes "some neat security fixes," but it is unclear whether the vendor is fixing *this* issue. INFERRED ACTION: CAN-2001-1296 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1301 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1301 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20010807 rcs2log Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-08/0093.html Reference: CONFIRM:http://savannah.gnu.org/cgi-bin/viewcvs/emacs/emacs/lib-src/rcs2log?only_with_tag=EMACS_PRETEST_21_0_95 Reference: XF:rcs2log-tmp-symlink(11210) Reference: URL:http://www.iss.net/security_center/static/11210.php rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users via a symlink attack on a temporary file. Modifications: ADDREF CONFIRM:http://savannah.gnu.org/cgi-bin/viewcvs/emacs/emacs/lib-src/rcs2log?only_with_tag=EMACS_PRETEST_21_0_95 ADDREF XF:rcs2log-tmp-symlink(11210) DESC change versions Analysis -------- Vendor Acknowledgement: yes cve-vote INFERRED ACTION: CAN-2001-1301 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(1) Green MODIFY(2) Frech, Cox NOOP(3) Wall, Foat, Cole Voter Comments: Frech> Task xxxx. CHANGE> [Cox changed vote from REVIEWING to MODIFY] Cox> Addref: http://savannah.gnu.org/cgi-bin/viewcvs/emacs/emacs/lib-src/rcs2log?only_with_tag=EMACS_PRETEST_21_0_95 This was public at least as far back as 28 September 1998, this is the date that the Red Hat emacs package was given a patch for this issue. Cox> Description currently says "xemacs 21.1.10" and it would be more correct to say "xemacs before version 21.4" CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:rcs2log-tmp-symlink(11210) ====================================================== Candidate: CAN-2001-1303 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1303 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: CF Reference: BUGTRAQ:20010718 Firewall-1 Information leak Reference: URL:http://www.securityfocus.com/archive/1/197566 Reference: BID:3058 Reference: URL:http://online.securityfocus.com/bid/3058 Reference: XF:fw1-securemote-gain-information(6857) Reference: URL:http://xforce.iss.net/static/6857.php The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2001-1303 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Cole, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1327 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1327 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: TURBO:TLSA2001024 Reference: URL:http://www.turbolinux.com/pipermail/tl-security-announce/2001-May/000313.html Reference: XF:pmake-binary-gain-privileges(9988) Reference: URL:http://www.iss.net/security_center/static/9988.php pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privileges by exploiting vulnerabilities in pmake or programs that are used by pmake. Modifications: ADDREF XF:pmake-binary-gain-privileges(9988) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1327 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Green MODIFY(1) Frech NOOP(3) Wall, Foat, Cox Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:pmake-binary-gain-privileges(9988) ====================================================== Candidate: CAN-2001-1334 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1334 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20010515 PHPSlash : potential vulnerability in URL blocks Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2001-05/0126.html Reference: CONFIRM:http://marc.theaimsgroup.com/?l=phpslash&m=99029398904419&w=2 Reference: BID:2724 Reference: URL:http://online.securityfocus.com/bid/2724 Reference: XF:phpslash-block-read-files(9990) Reference: URL:http://www.iss.net/security_center/static/9990.php Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block and specifying the target file as the source URL. Modifications: ADDREF XF:phpslash-block-read-files(9990) Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2001-1334 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Green MODIFY(1) Frech NOOP(3) Wall, Foat, Cox Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:phpslash-block-read-files(9990) ====================================================== Candidate: CAN-2001-1349 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1349 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BINDVIEW:20010528 Unsafe Signal Handling in Sendmail Reference: URL:http://razor.bindview.com/publish/advisories/adv_sm8120.html Reference: BUGTRAQ:20010529 sendmail 8.11.4 and 8.12.0.Beta10 available (fwd) Reference: URL:http://www.securityfocus.com/archive/1/187127 Reference: REDHAT:RHSA-2001:106 Reference: URL:http://rhn.redhat.com/errata/RHSA-2001-106.html Reference: CONFIRM:http://archives.neohapsis.com/archives/sendmail/2001-q2/0001.html Reference: BID:2794 Reference: URL:http://www.securityfocus.com/bid/2794 Reference: XF:sendmail-signal-handling(6633) Reference: URL:http://www.iss.net/security_center/static/6633.php Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers. Modifications: ADDREF REDHAT:RHSA-2001:106 ADDREF XF:sendmail-signal-handling(6633) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1349 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(4) Wall, Cole, Green, Cox MODIFY(1) Frech NOOP(1) Foat Voter Comments: CHANGE> [Cox changed vote from REVIEWING to ACCEPT] Cox> ADDREF: RHSA-2001:106 Frech> XF:sendmail-signal-handling(6633) ====================================================== Candidate: CAN-2001-1359 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1359 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: CF Reference: CALDERA:CSSA-2001-021.0 Reference: URL:http://www.caldera.com/support/security/advisories/CSSA-2001-021.0.txt Reference: BID:2850 Reference: URL:http://www.securityfocus.com/bid/2850 Reference: XF:volution-authentication-failure-access(6672) Reference: URL:http://xforce.iss.net/static/6672.php Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, which allows remote attackers to fully control clients via a Trojan horse Volution server. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1359 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Wall, Cole, Alderson, Green, Frech NOOP(2) Foat, Cox ====================================================== Candidate: CAN-2001-1369 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1369 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: FREEBSD:FreeBSD-SA-02:14 Reference: URL:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:14.pam-pgsql.asc Reference: BID:3319 Reference: URL:http://online.securityfocus.com/bid/3319 Reference: XF:postgresql-pam-authentication-module(7110) Reference: URL:http://www.iss.net/security_center/static/7110.php Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or modify user account records by injecting SQL statements into user or password fields. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1369 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Alderson, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1370 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1370 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20010722 [SEC] Hole in PHPLib 7.2 prepend.php3 Reference: URL:http://www.securityfocus.com/archive/1/198768 Reference: BUGTRAQ:20010726 TSLSA-2001-0014 - PHPLib Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=99616122712122&w=2 Reference: BUGTRAQ:20010721 IMP 2.2.6 (SECURITY) released Reference: URL:http://online.securityfocus.com/archive/1/198495 Reference: CONECTIVA:CLA-2001:410 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000410 Reference: CALDERA:CSSA-2001-027.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2001-027.0.txt Reference: DEBIAN:DSA-073 Reference: URL:http://www.debian.org/security/2001/dsa-073 Reference: BID:3079 Reference: URL:http://www.securityfocus.com/bid/3079 Reference: XF:phplib-script-execution(6892) Reference: URL:http://www.iss.net/security_center/static/6892.php prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1370 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Cole, Alderson, Green, Frech NOOP(3) Wall, Foat, Cox ====================================================== Candidate: CAN-2001-1371 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1371 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020206 Hackproofing Oracle Application Server paper Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101301813117562&w=2 Reference: MISC:http://www.nextgenss.com/papers/hpoas.pdf Reference: CERT-VN:VU#736923 Reference: URL:http://www.kb.cert.org/vuls/id/736923 Reference: CERT:CA-2002-08 Reference: URL:http://www.cert.org/advisories/CA-2002-08.html Reference: CONFIRM:http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf Reference: BID:4289 Reference: URL:http://www.securityfocus.com/bid/4289 Reference: XF:oracle-appserver-soap-components(8449) Reference: URL:http://www.iss.net/security_center/static/8449.php The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager. Modifications: ADDREF XF:oracle-appserver-soap-components(8449) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1371 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Alderson, Green MODIFY(1) Frech NOOP(1) Cox Voter Comments: Frech> XF:oracle-appserver-soap-components(8449) ====================================================== Candidate: CAN-2001-1372 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1372 Final-Decision: Interim-Decision: 20030326 Modified: 20021116-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20010917 Yet another path disclosure vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100074087824021&w=2 Reference: BUGTRAQ:20010921 Response to "Path disclosure vulnerability in Oracle 9i and 8i Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100119633925473&w=2 Reference: MISC:http://www.nii.co.in/research.html Reference: CERT:CA-2002-08 Reference: URL:http://www.cert.org/advisories/CA-2002-08.html Reference: CERT-VN:VU#278971 Reference: URL:http://www.kb.cert.org/vuls/id/278971 Reference: CONFIRM:http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf Reference: BID:3341 Reference: URL:http://www.securityfocus.com/bid/3341 Reference: XF:oracle-jsp-reveal-path(7135) Reference: URL:http://xforce.iss.net/static/7135.php Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1372 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Wall, Cole, Alderson, Green, Frech NOOP(3) Foat, Christey, Cox Voter Comments: Christey> ADDREF MISC:http://www.nii.co.in/research.html ====================================================== Candidate: CAN-2001-1373 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1373 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20010718 ZoneAlarm Pro Reference: URL:http://www.securityfocus.com/archive/1/197681 Reference: CONFIRM:http://www.zonelabs.com/products/zap/rel_history.html#2.6.362 Reference: XF:zonealarm-bypass-mailsafe(6877) Reference: URL:http://xforce.iss.net/static/6877.php Reference: BID:3055 Reference: URL:http://www.securityfocus.com/bid/3055 MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, which allows remote attackers to send potentially dangerous attachments. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the product's release history includes a heading titled "New and improved features in ZoneAlarm Pro version 2.6.231," which states: "MailSafe improvements to better handle attachments of long file names" INFERRED ACTION: CAN-2001-1373 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Wall, Cole, Alderson, Green, Frech NOOP(2) Foat, Cox ====================================================== Candidate: CAN-2001-1374 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1374 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-02 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187 Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224 Reference: CONECTIVA:CLA-2001:409 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000409 Reference: XF:expect-insecure-library-search(6870) Reference: URL:http://xforce.iss.net/static/6870.php Reference: BID:3074 Reference: URL:http://www.securityfocus.com/bid/3074 Reference: REDHAT:RHSA-2002:148 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-148.html Reference: MANDRAKE:MDKSA-2002:060 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:060 expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd. Modifications: ADDREF REDHAT:RHSA-2002:148 ADDREF MANDRAKE:MDKSA-2002:060 Analysis -------- Vendor Acknowledgement: yes changelog INFERRED ACTION: CAN-2001-1374 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(6) Wall, Cole, Alderson, Green, Frech, Cox NOOP(2) Foat, Christey Voter Comments: CHANGE> [Cox changed vote from REVIEWING to ACCEPT] Christey> REDHAT:RHSA-2002:148 Christey> MANDRAKE:MDKSA-2002:060 ====================================================== Candidate: CAN-2001-1375 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1375 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-02 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28226 Reference: CONECTIVA:CLA-2001:409 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000409 Reference: XF:tcltk-insecure-library-search(6869) Reference: URL:http://www.iss.net/security_center/static/6869.php Reference: BID:3073 Reference: URL:http://www.securityfocus.com/bid/3073 Reference: REDHAT:RHSA-2002:148 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-148.html Reference: MANDRAKE:MDKSA-2002:060 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:060 tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory. Modifications: ADDREF REDHAT:RHSA-2002:148 ADDREF MANDRAKE:MDKSA-2002:060 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1375 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(6) Foat, Cole, Alderson, Green, Frech, Cox NOOP(2) Wall, Christey Voter Comments: CHANGE> [Cox changed vote from REVIEWING to ACCEPT] Christey> REDHAT:RHSA-2002:148 Christey> MANDRAKE:MDKSA-2002:060 ====================================================== Candidate: CAN-2001-1378 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1378 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020715 Category: SF Reference: MISC:http://lists.ccil.org/pipermail/fetchmail-announce/2001-March/000015.html Reference: REDHAT:RHSA-2001:103 Reference: URL:http://www.redhat.com/support/errata/RHSA-2001-103.html fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1378 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Cox NOOP(2) Wall, Foat ====================================================== Candidate: CAN-2001-1380 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1380 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20011018 Immunix OS update for OpenSSH Reference: BUGTRAQ:20011017 TSLSA-2001-0023 - OpenSSH Reference: BUGTRAQ:20010926 OpenSSH Security Advisory (adv.option) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=100154541809940&w=2 Reference: BUGTRAQ:20011019 TSLSA-2001-0026 - OpenSSH Reference: REDHAT:RHSA-2001:114 Reference: URL:http://rhn.redhat.com/errata/RHSA-2001-114.html Reference: MANDRAKE:MDKSA-2001:081 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-081.php OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1380 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Cox NOOP(2) Wall, Foat ====================================================== Candidate: CAN-2001-1382 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1382 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: CONFIRM:http://www.openwall.com/Owl/CHANGES-stable.shtml The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1382 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Cox NOOP(2) Wall, Foat ====================================================== Candidate: CAN-2001-1383 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1383 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: REDHAT:RHSA-2001:110 Reference: URL:http://rhn.redhat.com/errata/RHSA-2001-110.html Reference: XF:linux-setserial-initscript-symlink(7177) Reference: URL:http://www.iss.net/security_center/static/7177.php Reference: BID:3367 Reference: URL:http://online.securityfocus.com/bid/3367 initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized operations on files. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1383 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Wall, Cole, Armstrong, Baker, Cox NOOP(1) Foat ====================================================== Candidate: CAN-2001-1385 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1385 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20010112 PHP Security Advisory - Apache Module bugs Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97957961212852 Reference: REDHAT:RHSA-2000:136 Reference: URL:http://www.redhat.com/support/errata/RHSA-2000-136.html Reference: MANDRAKE:MDKSA-2001:013 Reference: URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-013.php3 Reference: CONECTIVA:CLA-2001:373 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000373 Reference: DEBIAN:DSA-020 Reference: URL:http://www.debian.org/security/2001/dsa-020 Reference: BID:2205 Reference: URL:http://online.securityfocus.com/bid/2205 Reference: XF:php-view-source-code(5939) Reference: URL:http://www.iss.net/security_center/static/5939.php The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1385 ACCEPT (7 accept, 2 ack, 0 review) Current Votes: ACCEPT(7) Wall, Cole, Armstrong, Green, Baker, Frech, Cox NOOP(1) Foat ====================================================== Candidate: CAN-2001-1406 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1406 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20010829 Security Advisory for Bugzilla v2.13 and older Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=99912899900567 Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=66235 Reference: REDHAT:RHSA-2001:107 Reference: URL:http://www.redhat.com/support/errata/RHSA-2001-107.html Reference: XF:bugzilla-processbug-old-restrictions(10478) Reference: URL:http://www.iss.net/security_center/static/10478.php process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent. Modifications: ADDREF XF:bugzilla-processbug-old-restrictions(10478) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1406 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Green, Baker, Cox MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:bugzilla-processbug-old-restrictions(10478) ====================================================== Candidate: CAN-2001-1407 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1407 Final-Decision: Interim-Decision: 20030326 Modified: 20030318-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20010829 Security Advisory for Bugzilla v2.13 and older Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=99912899900567 Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=96085 Reference: REDHAT:RHSA-2001:107 Reference: URL:http://www.redhat.com/support/errata/RHSA-2001-107.html Reference: XF:bugzilla-duplicate-view-restricted(10479) Reference: URL:http://www.iss.net/security_center/static/10479.php Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug. Modifications: ADDREF XF:bugzilla-duplicate-view-restricted(10479) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2001-1407 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Green, Baker, Cox MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:bugzilla-duplicate-view-restricted(10479) ====================================================== Candidate: CAN-2002-0006 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0006 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020108 Category: SF Reference: BUGTRAQ:20020109 xchat IRC session hijacking vulnerability (versions 1.4.1, 1.4.2) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101060676210255&w=2 Reference: DEBIAN:DSA-099 Reference: URL:http://www.debian.org/security/2002/dsa-099 Reference: REDHAT:RHSA-2002:005 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-005.html Reference: HP:HPSBTL0201-016 Reference: URL:http://online.securityfocus.com/advisories/3806 Reference: CONECTIVA:CLA-2002:453 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000453 Reference: XF:xchat-ctcp-ping-command(7856) Reference: URL:http://xforce.iss.net/static/7856.php Reference: BID:3830 Reference: URL:http://www.securityfocus.com/bid/3830 XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING, which expands the characters in the client response when the percascii variable is set. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0006 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(6) Baker, Frech, Cox, Wall, Cole, Alderson NOOP(2) Foat, Christey Voter Comments: Christey> Consider adding BID:3830 ====================================================== Candidate: CAN-2002-0009 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0009 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020131 Assigned: 20020109 Category: SF Reference: BUGTRAQ:20020105 Security Advisory for Bugzilla v2.15 (cvs20020103) and older Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html Reference: CONFIRM:http://www.bugzilla.org/security2_14_1.html Reference: MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=102141 Reference: XF:bugzilla-showbug-reveal-bugs(7802) Reference: URL:http://www.iss.net/security_center/static/7802.php Reference: BID:3798 Reference: URL:http://www.securityfocus.com/bid/3798 show_bug.cgi in Bugzilla before 2.14.1 allows a user with "Bugs Access" privileges to see other products that are not accessible to the user, by submitting a bug and reading the resulting Product pulldown menu. Modifications: ADDREF XF:bugzilla-showbug-reveal-bugs(7802) ADDREF BID:3798 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0009 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Green MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:bugzilla-showbug-reveal-bugs(7802) ====================================================== Candidate: CAN-2002-0011 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0011 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020131 Assigned: 20020109 Category: SF Reference: BUGTRAQ:20020105 Security Advisory for Bugzilla v2.15 (cvs20020103) and older Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html Reference: CONFIRM:http://www.bugzilla.org/security2_14_1.html Reference: MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=98146 Reference: XF:bugzilla-doeditvotes-login-information(7803) Reference: URL:http://www.iss.net/security_center/static/7803.php Reference: BID:3800 Reference: URL:http://www.securityfocus.com/bid/3800 Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login. Modifications: ADDREF XF:bugzilla-doeditvotes-login-information(7803) ADDREF BID:3800 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0011 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Green MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:bugzilla-doeditvotes-login-information(7803) ====================================================== Candidate: CAN-2002-0014 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0014 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020110 Category: SF Reference: BUGTRAQ:20020105 Pine 4.33 (at least) URL handler allows embedded commands. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101027841605918&w=2 Reference: REDHAT:RHSA-2002:009 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-009.html Reference: ENGARDE:ESA-20020114-002 Reference: CONECTIVA:CLA-2002:460 Reference: FREEBSD:FreeBSD-SA-02:05 Reference: HP:HPSBTL0201-015 Reference: BID:3815 Reference: URL:http://online.securityfocus.com/bid/3815 URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&). Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0014 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong NOOP(2) Foat, Christey Voter Comments: Christey> Consider adding BID:3815 ====================================================== Candidate: CAN-2002-0017 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0017 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020502 Assigned: 20020111 Category: SF Reference: ISS:20020403 Remote Buffer Overflow Vulnerability in IRIX SNMP Daemon Reference: URL:http://www.iss.net/security_center/alerts/advise113.php Reference: SGI:20020201-01-P Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020201-01-P Reference: BID:4421 Reference: URL:http://www.securityfocus.com/bid/4421 Reference: XF:irix-snmp-bo(7846) Reference: URL:http://www.iss.net/security_center/static/7846.php Buffer overflow in SNMP daemon (snmpd) on SGI IRIX 6.5 through 6.5.15m allows remote attackers to execute arbitrary code via an SNMP request. Modifications: ADDREF BID:4421 ADDREF XF:irix-snmp-bo(7846) Analysis -------- Vendor Acknowledgement: yes advisory ABSTRACTION: while this issue may appear to be the same as CAN-2002-0012 or CAN-2002-0013, it is addressed by a different patch, so CD:SF-LOC suggests keeping this SPLIT. INFERRED ACTION: CAN-2002-0017 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Levy, Cole, Armstrong, Green MODIFY(1) Frech NOOP(4) Cox, Wall, Foat, Christey Voter Comments: Christey> Consider adding BID:4421 Levy> BID 4421 Frech> XF:irix-snmp-bo(7846) ====================================================== Candidate: CAN-2002-0024 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0024 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020315 Assigned: 20020114 Category: SF Reference: MS:MS02-005 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-005.asp Reference: BID:4087 Reference: URL:http://www.securityfocus.com/bid/4087 File Download box in Internet Explorer 5.01, 5.5 and 6.0 allows an attacker to use the Content-Disposition and Content-Type HTML header fields to modify how the name of the file is displayed, which could trick a user into believing that a file is safe to download. Modifications: ADDREF BID:4087 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0024 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Ziese, Wall, Foat, Cole, Green NOOP(1) Christey Voter Comments: Christey> Consider adding BID:4087 ====================================================== Candidate: CAN-2002-0032 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0032 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020611 Assigned: 20020116 Category: SF Reference: BUGTRAQ:20020527 Yahoo Messenger - Multiple Vulnerabilities Reference: URL:http://online.securityfocus.com/archive/1/274223 Reference: CERT:CA-2002-16 Reference: URL:http://www.cert.org/advisories/CA-2002-16.html Reference: CERT-VN:VU#172315 Reference: URL:http://www.kb.cert.org/vuls/id/172315 Reference: BID:4838 Reference: URL:http://www.securityfocus.com/bid/4838 Reference: XF:yahoo-messenger-script-injection(9184) Reference: URL:http://www.iss.net/security_center/static/9184.php Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI. Modifications: ADDREF XF:yahoo-messenger-script-injection(9184) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0032 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Foat, Christey Voter Comments: Christey> XF:yahoo-messenger-script-injection(9184) URL:http://www.iss.net/security_center/static/9184.php Frech> XF:yahoo-messenger-script-injection(9184) ====================================================== Candidate: CAN-2002-0033 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0033 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020611 Assigned: 20020116 Category: SF Reference: BUGTRAQ:20020505 [LSD] Solaris cachefsd remote buffer overflow vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0026.html Reference: CERT:CA-2002-11 Reference: URL:http://www.cert.org/advisories/CA-2002-11.html Reference: CONFIRM:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F44309 Reference: CERT-VN:VU#635811 Reference: URL:http://www.kb.cert.org/vuls/id/635811 Reference: BID:4674 Reference: URL:http://www.securityfocus.com/bid/4674 Reference: XF:solaris-cachefsd-name-bo(8999) Reference: URL:http://www.iss.net/security_center/static/8999.php Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. Modifications: ADDREF XF:solaris-cachefsd-name-bo(8999) DESC change "heap overflow" to "heap-based buffer overflow" Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0033 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> Note: this is a different vulnerability than CAN-2002-0084. However, if there are different patches for the 2 issues, then they may need to be merged per CD:SF-LOC. Frech> XF:solaris-cachefsd-name-bo(8999) ====================================================== Candidate: CAN-2002-0042 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0042 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020116 Category: SF Reference: SGI:20020402-01-P Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020402-01-P Reference: XF:irix-xfs-dos(8839) Reference: URL:http://www.iss.net/security_center/static/8839.php Reference: BID:4511 Reference: URL:http://www.securityfocus.com/bid/4511 Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file that is not properly processed by XFS. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0042 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0054 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0054 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020315 Assigned: 20020202 Category: SF Reference: MS:MS02-011 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-011.asp Reference: BID:4205 Reference: URL:http://www.securityfocus.com/bid/4205 Reference: BUGTRAQ:20020301 IIS SMTP component allows mail relaying via Null Session Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101501580409373&w=2 SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials. Modifications: ADDREF BID:4205 ADDREF BUGTRAQ:20020301 IIS SMTP component allows mail relaying via Null Session DESC add "SMTP AUTH" and null session info to desc Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0054 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Ziese, Wall, Foat, Cole, Green NOOP(1) Christey Voter Comments: Christey> Consider adding BID:4205 Christey> BUGTRAQ:20020301 IIS SMTP component allows mail relaying via Null Session URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101501580409373&w=2 Add details to desc, specifically that the issue is related to null sessions and SMTP AUTH. ====================================================== Candidate: CAN-2002-0061 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0061 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020611 Assigned: 20020213 Category: SF Reference: BUGTRAQ:20020321 Vulnerability in Apache for Win32 batch file processing - Remote command execution Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101674082427358&w=2 Reference: BUGTRAQ:20020325 Apache 1.3.24 Released! (fwd) Reference: URL:http://online.securityfocus.com/archive/1/263927 Reference: XF:apache-dos-batch-command-execution(8589) Reference: URL:http://www.iss.net/security_center/static/8589.php Reference: BID:4335 Reference: URL:http://www.securityfocus.com/bid/4335 Reference: CONFIRM:http://www.apacheweek.com/issues/02-03-29#apache1324 Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe. Modifications: ADDREF CONFIRM:http://www.apacheweek.com/issues/02-03-29#apache1324 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0061 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Green MODIFY(1) Cox NOOP(1) Christey Voter Comments: Christey> Consider adding BID:4335 Christey> XF:apache-dos-batch-command-execution(8589) URL:http://www.iss.net/security_center/static/8589.php Cox> ADDREF: http://www.apacheweek.com/issues/02-03-29#apache1324 ====================================================== Candidate: CAN-2002-0062 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0062 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-02 Proposed: 20020315 Assigned: 20020213 Category: SF Reference: REDHAT:RHSA-2002:020 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-020.html Reference: DEBIAN:DSA-113 Reference: URL:http://www.debian.org/security/2002/dsa-113 Reference: BID:2116 Reference: URL:http://online.securityfocus.com/bid/2116 Reference: XF:gnu-ncurses-window-bo(8222) Reference: URL:http://www.iss.net/security_center/static/8222.php Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolling." Modifications: ADDREF BID:2116 DESC clarify ncurses4 package ADDREF XF:gnu-ncurses-window-bo(8222) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0062 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Ziese, Wall, Cole, Green NOOP(3) Jones, Foat, Christey Voter Comments: Christey> BID:2116 URL:http://online.securityfocus.com/bid/2116 Also need to add other vendor advisories. Christey> Consider adding BID:2116 Christey> Specifically state that the ncurses4 compatibility package is Red Hat's. Also say that the problem is in the "routines for moving the physical cursor and scrolling" as stated by Daniel Jacobowitz. ====================================================== Candidate: CAN-2002-0067 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0067 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020315 Assigned: 20020219 Category: SF Reference: BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Reference: CONFIRM:http://www.squid-cache.org/Versions/v2/2.4/bugs/ Reference: REDHAT:RHSA-2002:029 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-029.html Reference: BUGTRAQ:20020222 TSLSA-2002-0031 - squid Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Reference: MANDRAKE:MDKSA-2002:016 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.php Reference: CALDERA:CSSA-2002-SCO.7 Reference: URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html Reference: CONECTIVA:CLA-2002:464 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 Reference: FREEBSD:FreeBSD-SA-02:12 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc Reference: XF:squid-htcp-enabled(8261) Reference: URL:http://www.iss.net/security_center/static/8261.php Reference: BID:4150 Reference: URL:http://www.securityfocus.com/bid/4150 Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions. Modifications: ADDREF BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 ADDREF BUGTRAQ:20020222 TSLSA-2002-0031 - squid ADDREF MANDRAKE:MDKSA-2002:016 CHANGEREF REDHAT [normalize] ADDREF CALDERA:CSSA-2002-SCO.7 ADDREF CONECTIVA:CLA-2002:464 ADDREF FREEBSD:FreeBSD-SA-02:12 ADDREF XF:squid-htcp-enabled(8261) ADDREF BID:4150 DESC change version from STABLE2 to STABLE3 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0067 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Ziese, Wall, Cole, Green MODIFY(2) Cox, Jones NOOP(2) Foat, Christey Voter Comments: Christey> BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Christey> BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Christey> MANDRAKE:MDKSA-2002:016 Christey> Fix ref: REDHAT:REDHAT:RHSA-2002:029 Jones> Change description to "Squid 2.4 STABLE3 and earlier" (vice STABLE2). Change description from "...which could allow remote attackers to bypass intended access restrictions" to "...which could allow remote attackers to access and/or modify cached data". Christey> CALDERA:CSSA-2002-SCO.7 URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html CONECTIVA:CLA-2002:464 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://archives.neohapsis.com/archives/bugtraq/2002-02/0257.html MANDRAKE:MDKSA-2002:016 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.php3 FREEBSD:FreeBSD-SA-02:12 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc XF:squid-htcp-enabled(8261) URL:http://www.iss.net/security_center/static/8261.php BID:4150 URL:http://www.securityfocus.com/bid/4150 Cox> This references REDHAT:REDHAT:RHSA-2002:029 instead of REDHAT:RHSA-2002:029 ====================================================== Candidate: CAN-2002-0068 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0068 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-02 Proposed: 20020315 Assigned: 20020219 Category: SF Reference: BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Reference: CONFIRM:http://www.squid-cache.org/Versions/v2/2.4/bugs/ Reference: BUGTRAQ:20020222 Squid buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101440163111826&w=2 Reference: REDHAT:RHSA-2002:029 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-029.html Reference: BUGTRAQ:20020222 TSLSA-2002-0031 - squid Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Reference: MANDRAKE:MDKSA-2002:016 Reference: CALDERA:CSSA-2002-010.0 Reference: URL:http://www.caldera.com/support/security/advisories/CSSA-2002-010.0.txt Reference: CALDERA:CSSA-2002-SCO.7 Reference: URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html Reference: CONECTIVA:CLA-2002:464 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 Reference: SUSE:SuSE-SA:2002:008 Reference: URL:http://www.suse.com/de/support/security/2002_008_squid_txt.html Reference: FREEBSD:FreeBSD-SA-02:12 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc Reference: BID:4148 Reference: URL:http://www.securityfocus.com/bid/4148 Reference: XF:squid-ftpbuildtitleurl-bo(8258) Reference: URL:http://www.iss.net/security_center/static/8258.php Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an ftp:// URL with a larger number of special characters, which exceed the buffer when Squid URL-escapes the characters. Modifications: ADDREF BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 ADDREF BUGTRAQ:20020222 TSLSA-2002-0031 - squid ADDREF MANDRAKE:MDKSA-2002:016 CHANGEREF REDHAT [normalize] ADDREF CALDERA:CSSA-2002-010.0 ADDREF CALDERA:CSSA-2002-SCO.7 ADDREF CONECTIVA:CLA-2002:464 ADDREF SUSE:SuSE-SA:2002:008 ADDREF BUGTRAQ:20020222 Squid buffer overflow ADDREF FREEBSD:FreeBSD-SA-02:12 ADDREF BID:4148 ADDREF XF:squid-ftpbuildtitleurl-bo(8258) DESC add that the problem occurs during escape processing Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0068 ACCEPT (6 accept, 5 ack, 0 review) Current Votes: ACCEPT(4) Ziese, Wall, Cole, Green MODIFY(2) Cox, Jones NOOP(2) Foat, Christey Voter Comments: Christey> BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Christey> BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Christey> MANDRAKE:MDKSA-2002:016 Christey> Fix ref: REDHAT:REDHAT:RHSA-2002:029 Jones> Drop "malformed" from description; legitimate FTP URL with reasonable userid and password may cause crash. Add enough detail to distinguish this vulnerability (i.e., the flaw is in authenticated FTP URL handling). Reference: BUGTRAQ:20020222 - Squid buffer overflow. Suggest: "Squid 2.4 STABLE3 and earlier contains a flaw in handling authenticated FTP URLs (FTP URLs with userID and passwords) which allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code via ftp:// URLs." Christey> fix typo: "possible" should be "possibly" CALDERA:CSSA-2002-010.0 URL:http://www.caldera.com/support/security/advisories/CSSA-2002-010.0.txt CALDERA:CSSA-2002-SCO.7 URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html CONECTIVA:CLA-2002:464 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 SUSE:SuSE-SA:2002:008 URL:http://www.suse.com/de/support/security/2002_008_squid_txt.html BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://archives.neohapsis.com/archives/bugtraq/2002-02/0257.html MANDRAKE:MDKSA-2002:016 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.php3 BUGTRAQ:20020222 Squid buffer overflow URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101440163111826&w=2 FREEBSD:FreeBSD-SA-02:12 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc BID:4148 URL:http://www.securityfocus.com/bid/4148 XF:squid-ftpbuildtitleurl-bo(8258) URL:http://www.iss.net/security_center/static/8258.php Cox> This references REDHAT:REDHAT:RHSA-2002:029 instead of REDHAT:RHSA-2002:029 Christey> See Bugtraq post for more information... the problem isn't a malformed URL, it's that the string exceeds the buffer size when it is URL-escaped. ====================================================== Candidate: CAN-2002-0069 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0069 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020315 Assigned: 20020219 Category: SF Reference: CONFIRM:http://www.squid-cache.org/Versions/v2/2.4/bugs/ Reference: REDHAT:RHSA-2002:029 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-029.html Reference: BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Reference: BUGTRAQ:20020222 TSLSA-2002-0031 - squid Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Reference: MANDRAKE:MDKSA-2002:016 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.php Reference: CALDERA:CSSA-2002-SCO.7 Reference: URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html Reference: CONECTIVA:CLA-2002:464 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 Reference: FREEBSD:FreeBSD-SA-02:12 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc Reference: XF:squid-snmp-dos(8260) Reference: URL:http://www.iss.net/security_center/static/8260.php Reference: BID:4146 Reference: URL:http://www.securityfocus.com/bid/4146 Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service. Modifications: DESC change STABLE2 to STABLE3 ADDREF BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 ADDREF BUGTRAQ:20020222 TSLSA-2002-0031 - squid ADDREF MANDRAKE:MDKSA-2002:016 CHANGEREF REDHAT [normalize] ADDREF CALDERA:CSSA-2002-SCO.7 ADDREF CONECTIVA:CLA-2002:464 ADDREF FREEBSD:FreeBSD-SA-02:12 ADDREF XF:squid-snmp-dos(8260) ADDREF BID:4146 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0069 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Ziese, Wall, Cole, Green MODIFY(2) Cox, Jones NOOP(2) Foat, Christey Voter Comments: Christey> BUGTRAQ:20020221 Squid HTTP Proxy Security Update Advisory 2002:1 URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101431040422095&w=2 Need to add version number to description (2.4) Christey> BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101443252627021&w=2 Christey> MANDRAKE:MDKSA-2002:016 Christey> Fix ref: REDHAT:REDHAT:RHSA-2002:029 Jones> Add version info to description (like 2002-0068): Squid 2.4 STABLE3 and earlier. Christey> CALDERA:CSSA-2002-SCO.7 URL:http://archives.neohapsis.com/archives/linux/caldera/2002-q1/0014.html CONECTIVA:CLA-2002:464 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000464 BUGTRAQ:20020222 TSLSA-2002-0031 - squid URL:http://archives.neohapsis.com/archives/bugtraq/2002-02/0257.html MANDRAKE:MDKSA-2002:016 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-016.php3 FREEBSD:FreeBSD-SA-02:12 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:12.squid.asc XF:squid-snmp-dos(8260) URL:http://www.iss.net/security_center/static/8260.php BID:4146 URL:http://www.securityfocus.com/bid/4146 Cox> This references REDHAT:REDHAT:RHSA-2002:029 instead of REDHAT:RHSA-2002:029 ====================================================== Candidate: CAN-2002-0071 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0071 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-03 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: ATSTAKE:A041002-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a041002-1.txt Reference: BUGTRAQ:20020411 KPMG-2002010: Microsoft IIS .htr ISAPI buffer overrun Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101854087828265&w=2 Reference: VULNWATCH:20020411 [VulnWatch] KPMG-2002010: Microsoft IIS .htr ISAPI buffer overrun Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#363715 Reference: URL:http://www.kb.cert.org/vuls/id/363715 Reference: XF:iis-htr-isapi-bo(8799) Reference: URL:http://www.iss.net/security_center/static/8799.php Reference: BID:4474 Reference: URL:http://www.securityfocus.com/bid/4474 Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-htr-isapi-bo(8799) ADDREF BID:4474 ADDREF CERT-VN:VU#363715 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0071 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-htr-isapi-bo(8799) ====================================================== Candidate: CAN-2002-0072 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0072 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-01 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: BUGTRAQ:20020411 KPMG-2002009: Microsoft IIS W3SVC Denial of Service Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101853851025208&w=2 Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CERT-VN:VU#521059 Reference: URL:http://www.kb.cert.org/vuls/id/521059 Reference: XF:iis-isapi-filter-error-dos(8800) Reference: URL:http://www.iss.net/security_center/static/8800.php Reference: BID:4479 Reference: URL:http://www.securityfocus.com/bid/4479 The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF CERT-VN:VU#521059 ADDREF XF:iis-isapi-filter-error-dos(8800) ADDREF BID:4479 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0072 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Christey> CERT-VN:VU#521059 URL:http://www.kb.cert.org/vuls/id/521059 XF:iis-isapi-filter-error-dos(8800) URL:http://www.iss.net/security_center/static/8800.php BID:4479 URL:http://www.securityfocus.com/bid/4479 Frech> XF:iis-isapi-filter-error-dos(8800) ====================================================== Candidate: CAN-2002-0073 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0073 Final-Decision: Interim-Decision: 20030326 Modified: 20030319-02 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: VULNWATCH:20020416 [VulnWatch] Microsoft FTP Service STAT Globbing DoS Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0023.html Reference: BUGTRAQ:20020417 Microsoft FTP Service STAT Globbing DoS Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101901273810598&w=2 Reference: MISC:http://www.digitaloffense.net/msftpd/advisory.txt Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: XF:iis-ftp-session-status-dos(8801) Reference: URL:http://www.iss.net/security_center/static/8801.php The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF VULNWATCH:20020416 [VulnWatch] Microsoft FTP Service STAT Globbing DoS ADDREF XF:iis-ftp-session-status-dos(8801) DESC add details as given in Vulnwatch post ADDREF BUGTRAQ:20020417 Microsoft FTP Service STAT Globbing DoS ADDREF MISC:http://www.digitaloffense.net/msftpd/advisory.txt Analysis -------- Vendor Acknowledgement: yes advisory ACCURACY: Microsft confirmed via e-mail that this is the issue described in the VulnWatch post of April 16, 2002. INFERRED ACTION: CAN-2002-0073 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Christey> Looks like this might be related to: VULNWATCH:20020416 [VulnWatch] Microsoft FTP Service STAT Globbing DoS URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0023.html Christey> Yep, confirmed by MS. Frech> XF:iis-ftp-session-status-dos(8801) ====================================================== Candidate: CAN-2002-0074 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0074 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: BUGTRAQ:20020410 Cgisecurity Advisory #9: Novell Websearch, and Microsoft IIS XSS Issues Reference: URL:http://online.securityfocus.com/archive/1/266888 Reference: MISC:http://www.cgisecurity.com/advisory/9.txt Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CERT-VN:VU#883091 Reference: URL:http://www.kb.cert.org/vuls/id/883091 Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: XF:iis-help-file-css(8802) Reference: URL:http://www.iss.net/security_center/static/8802.php Reference: BID:4483 Reference: URL:http://www.securityfocus.com/bid/4483 Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. Modifications: ADDREF MISC:http://www.cgisecurity.com/advisory/9.txt ADDREF BUGTRAQ:20020410 Cgisecurity Advisory #9: Novell Websearch, and Microsoft IIS XSS Issues ADDREF CERT-VN:VU#883091 ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-help-file-css(8802) ADDREF BID:4483 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0074 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> MISC:http://www.cgisecurity.com/advisory/9.txt BUGTRAQ:20020410 Cgisecurity Advisory #9: Novell Websearch, and Microsoft IIS XSS Issues URL:http://online.securityfocus.com/archive/1/266888 CERT-VN:VU#883091 URL:http://www.kb.cert.org/vuls/id/883091 Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-help-file-css(8802) ====================================================== Candidate: CAN-2002-0075 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0075 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: BUGTRAQ:20020411 [SNS Advisory No.49] A Possibility of Internet Information Server/Services Cross Site Scripting Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101854677802990&w=2 Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#520707 Reference: URL:http://www.kb.cert.org/vuls/id/520707 Reference: XF:iis-redirected-url-error-css(8804) Reference: URL:http://www.iss.net/security_center/static/8804.php Reference: BID:4487 Reference: URL:http://www.securityfocus.com/bid/4487 Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-redirected-url-error-css(8804) ADDREF CERT-VN:VU#520707 ADDREF BID:4487 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0075 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-redirected-url-error-css(8804) ====================================================== Candidate: CAN-2002-0076 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0076 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: MS:MS02-013 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-013.asp Reference: SUN:00218 Reference: URL:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/218 Reference: COMPAQ:SSRT0822 Reference: BID:4313 Reference: XF:java-vm-verifier-variant(8480) Reference: URL:http://www.iss.net/security_center/static/8480.php Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, as seen in (1) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, (2) Netscape 6.2.1 and earlier, and possibly other implementations that use vulnerable versions of SDK or JDK, aka a variant of the "Virtual Machine Verifier" vulnerability. Modifications: ADDREF BID:4313 ADDREF COMPAQ:SSRT0822 ADDREF XF:java-vm-verifier-variant(8480) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0076 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(4) Wall, Cole, Armstrong, Green MODIFY(1) Frech NOOP(3) Cox, Foat, Christey Voter Comments: Christey> Consider adding BID:4313 Christey> ADDREF COMPAQ:SSRT0822 Christey> COMPAQ:SSRT0822 Frech> XF:java-vm-verifier-variant(8480) ====================================================== Candidate: CAN-2002-0079 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0079 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020221 Category: SF Reference: BUGTRAQ:20020410 Windows 2000 and NT4 IIS .ASP Remote Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101846993304518&w=2 Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#610291 Reference: URL:http://www.kb.cert.org/vuls/id/610291 Reference: XF:iis-asp-chunked-encoding-bo(8795) Reference: URL:http://www.iss.net/security_center/static/8795.php Reference: BID:4485 Reference: URL:http://www.securityfocus.com/bid/4485 Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF CERT-VN:VU#610291 ADDREF BID:4485 ADDREF XF:iis-asp-chunked-encoding-bo(8795) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0079 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Cox, Christey Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Christey> XF:iis-asp-chunked-encoding-bo(8795) URL:http://www.iss.net/security_center/static/8795.php BID:4485 URL:http://www.securityfocus.com/bid/4485 CERT-VN:VU#610291 URL:http://www.kb.cert.org/vuls/id/610291 Frech> XF:iis-asp-chunked-encoding-bo(8795) ====================================================== Candidate: CAN-2002-0094 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0094 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020315 Assigned: 20020315 Category: SF Reference: BUGTRAQ:20020102 BSCW: Vulnerabilities and Problems Reference: URL:http://www.securityfocus.com/archive/1/248000 Reference: MISC:http://bscw.gmd.de/WhatsNew.html Reference: BID:3776 Reference: URL:http://www.securityfocus.com/bid/3776 Reference: XF:bscw-remote-shell-execution(7774) Reference: URL:http://www.iss.net/security_center/static/7774.php config_converters.py in BSCW (Basic Support for Cooperative Work) 3.x and versions before 4.06 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name during filename conversion. Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: The entry dated December 21, 2001 on the vendor's "What's New" page states "The new release fixes a number of bugs and security issues," but this is too vague to be certain that the vendor has fixed *this* problem. INFERRED ACTION: CAN-2002-0094 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Green NOOP(3) Ziese, Wall, Foat ====================================================== Candidate: CAN-2002-0095 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0095 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020315 Assigned: 20020315 Category: SF Reference: BUGTRAQ:20020102 BSCW: Vulnerabilities and Problems Reference: URL:http://www.securityfocus.com/archive/1/248000 Reference: BID:3777 Reference: URL:http://www.securityfocus.com/bid/3777 Reference: XF:bscw-default-installation-registration(7775) Reference: URL:http://www.iss.net/security_center/static/7775.php The default configuration of BSCW (Basic Support for Cooperative Work) 3.x and possibly version 4 enables user self registration, which could allow remote attackers to upload files and possibly join a user community that was intended to be closed. Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: The entry dated December 21, 2001 on the vendor's "What's New" page states "The new release fixes a number of bugs and security issues," but this is too vague to be certain that the vendor has fixed *this* problem. INFERRED ACTION: CAN-2002-0095 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Green NOOP(3) Ziese, Wall, Foat ====================================================== Candidate: CAN-2002-0120 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0120 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020315 Assigned: 20020315 Category: SF Reference: BUGTRAQ:20020112 Palm Desktop 4.0b76-77 for Mac OS X Reference: URL:http://online.securityfocus.com/archive/1/250093 Reference: BID:3863 Reference: URL:http://online.securityfocus.com/bid/3863 Reference: XF:palm-macos-backup-permissions(7937) Reference: URL:http://www.iss.net/security_center/static/7937.php Apple Palm Desktop 4.0b76 and 4.0b77 creates world-readable backup files and folders when a hotsync is performed, which could allow a local user to obtain sensitive information. Analysis -------- Vendor Acknowledgement: unknown INFERRED ACTION: CAN-2002-0120 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Foat, Green NOOP(2) Wall, Cole ====================================================== Candidate: CAN-2002-0123 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0123 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020315 Assigned: 20020315 Category: SF Reference: BUGTRAQ:20020114 Web Server 4D/eCommerce 3.5.3 DoS Vulnerability Reference: URL:http://online.securityfocus.com/archive/1/250242 Reference: BID:3874 Reference: URL:http://online.securityfocus.com/bid/3874 Reference: XF:ws4d-long-url-dos(7879) Reference: URL:http://www.iss.net/security_center/static/7879.php MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier, and possibly 3.5.3, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: inquiry sent to support@mdg.com on 3/11/2002. Response received on 3/12/2002 states "This vulnerability was not in 3.5.3, but rather version 3.0 or earlier. It was from some time ago." So, it is not entirely clear whether the discloser correctly reported the version, or if the problem was re-introduced, or appears in a slightly different distribution. INFERRED ACTION: CAN-2002-0123 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Green NOOP(4) Ziese, Balinsky, Wall, Foat Voter Comments: Green> website is very vague regarding vulnerabilities, but the upgrade message is clear enough. ====================================================== Candidate: CAN-2002-0146 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0146 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020318 Category: SF Reference: REDHAT:RHSA-2002:047 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-047.html Reference: CALDERA:CSSA-2002-027.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-027.0.txt Reference: HP:HPSBTL0205-042 Reference: URL:http://online.securityfocus.com/advisories/4145 Reference: MANDRAKE:MDKSA-2002:036 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-036.php Reference: BID:4788 Reference: URL:http://www.securityfocus.com/bid/4788 Reference: XF:fetchmail-imap-msgnum-bo(9133) Reference: URL:http://www.iss.net/security_center/static/9133.php fetchmail email client before 5.9.10 does not properly limit the maximum number of messages available, which allows a remote IMAP server to overwrite memory via a message count that exceeds the boundaries of an array. Modifications: ADDREF CALDERA:CSSA-2002-027.0 ADDREF HP:HPSBTL0205-042 ADDREF MANDRAKE:MDKSA-2002:036 ADDREF BID:4788 ADDREF XF:fetchmail-imap-msgnum-bo(9133) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0146 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Foat Voter Comments: Christey> CALDERA:CSSA-2002-027.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-027.0.txt HP:HPSBTL0205-042 URL:http://online.securityfocus.com/advisories/4145 MANDRAKE:MDKSA-2002:036 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-036.php BID:4788 URL:http://www.securityfocus.com/bid/4788 XF:fetchmail-imap-msgnum-bo(9133) URL:http://www.iss.net/security_center/static/9133.php Frech> XF:fetchmail-imap-msgnum-bo(9133) ====================================================== Candidate: CAN-2002-0147 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0147 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020319 Category: SF Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#669779 Reference: URL:http://www.kb.cert.org/vuls/id/669779 Reference: BID:4490 Reference: URL:http://www.securityfocus.com/bid/4490 Reference: XF:iis-asp-data-transfer-bo(8796) Reference: URL:http://www.iss.net/security_center/static/8796.php Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF CERT-VN:VU#669779 ADDREF BID:4490 ADDREF XF:iis-asp-data-transfer-bo(8796) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0147 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Christey> CERT-VN:VU#669779 URL:http://www.kb.cert.org/vuls/id/669779 BID:4490 URL:http://www.securityfocus.com/bid/4490 Frech> XF:iis-asp-data-transfer-bo(8796) ====================================================== Candidate: CAN-2002-0148 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0148 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020319 Category: SF Reference: BUGTRAQ:20020410 IIS allows universal CrossSiteScripting Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: XF:iis-http-error-page-css(8803) Reference: URL:http://www.iss.net/security_center/static/8803.php Reference: CERT-VN:VU#886699 Reference: URL:http://www.kb.cert.org/vuls/id/886699 Reference: BID:4486 Reference: URL:http://www.securityfocus.com/bid/4486 Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-http-error-page-css(8803) ADDREF CERT-VN:VU#886699 ADDREF BID:4486 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0148 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-http-error-page-css(8803) ====================================================== Candidate: CAN-2002-0149 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0149 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020319 Category: SF Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#721963 Reference: URL:http://www.kb.cert.org/vuls/id/721963 Reference: XF:iis-ssi-safety-check-bo(8798) Reference: URL:http://www.iss.net/security_center/static/8798.php Reference: BID:4478 Reference: URL:http://www.securityfocus.com/bid/4478 Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-ssi-safety-check-bo(8798) ADDREF CERT-VN:VU#721963 ADDREF BID:4478 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0149 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-ssi-safety-check-bo(8798) ====================================================== Candidate: CAN-2002-0150 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0150 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020319 Category: SF Reference: MS:MS02-018 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp Reference: CERT:CA-2002-09 Reference: URL:http://www.cert.org/advisories/CA-2002-09.html Reference: CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 Reference: URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Reference: CERT-VN:VU#454091 Reference: URL:http://www.kb.cert.org/vuls/id/454091 Reference: XF:iis-asp-http-header-bo(8797) Reference: URL:http://www.iss.net/security_center/static/8797.php Reference: BID:4476 Reference: URL:http://www.securityfocus.com/bid/4476 Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. Modifications: ADDREF CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 ADDREF XF:iis-asp-http-header-bo(8797) ADDREF CERT-VN:VU#454091 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0150 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> CISCO:20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 URL:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml Frech> XF:iis-asp-http-header-bo(8797) ====================================================== Candidate: CAN-2002-0155 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0155 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020319 Category: SF Reference: BUGTRAQ:20020508 ADVISORY: MSN Messenger OCX Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102089960531919&w=2 Reference: VULNWATCH:20020508 [VulnWatch] ADVISORY: MSN Messenger OCX Buffer Overflow Reference: MS:MS02-022 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-022.asp Reference: CERT:CA-2002-13 Reference: URL:http://www.cert.org/advisories/CA-2002-13.html Reference: XF:msn-chatcontrol-resdll-bo(9041) Reference: URL:http://www.iss.net/security_center/static/9041.php Reference: BID:4707 Reference: URL:http://www.securityfocus.com/bid/4707 Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX. Modifications: ADDREF XF:msn-chatcontrol-resdll-bo(9041) ADDREF BID:4707 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0155 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> XF:msn-chatcontrol-resdll-bo(9041) URL:http://www.iss.net/security_center/static/9041.php BID:4707 URL:http://www.securityfocus.com/bid/4707 Frech> XF:msn-chatcontrol-resdll-bo(9041) ====================================================== Candidate: CAN-2002-0157 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0157 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020325 Category: SF Reference: BUGTRAQ:20020502 R7-0003: Nautilus Symlink Vulnerability Reference: URL:http://online.securityfocus.com/archive/1/270691/2002-04-29/2002-05-05/0 Reference: REDHAT:RHSA-2002:064 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-064.html Reference: XF:nautilus-metafile-xml-symlink(8995) Reference: URL:http://www.iss.net/security_center/static/8995.php Reference: BID:4373 Reference: URL:http://www.securityfocus.com/bid/4373 Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file. Modifications: ADDREF XF:nautilus-metafile-xml-symlink(8995) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0157 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:nautilus-metafile-xml-symlink(8995) ====================================================== Candidate: CAN-2002-0163 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0163 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020328 Category: SF Reference: CONFIRM:http://www.squid-cache.org/Advisories/SQUID-2002_2.txt Reference: FREEBSD:FreeBSD-SA-02:19 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:19.squid.asc Reference: MANDRAKE:MDKSA-2002:027 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-027.php Reference: BUGTRAQ:20020326 updated squid advisory Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101716495023226&w=2 Reference: CALDERA:CSSA-2002-017.1 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-017.1.txt Reference: CALDERA:CSSA-2002-SCO.26 Reference: REDHAT:RHSA-2002:051 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-051.html Reference: BID:4363 Reference: URL:http://www.securityfocus.com/bid/4363 Reference: XF:squid-dns-reply-dos(8628) Reference: URL:http://www.iss.net/security_center/static/8628.php Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via compressed DNS responses. Modifications: ADDREF BID:4363 ADDREF XF:squid-dns-reply-dos(8628) ADDREF BUGTRAQ:20020326 updated squid advisory ADDREF CALDERA:CSSA-2002-017.0 ADDREF FREEBSD:FreeBSD-SA-02:19 ADDREF CALDERA:CSSA-2002-SCO.26 ADDREF REDHAT:RHSA-2002:051 DESC change "heap overflow" to "heap-based buffer overflow" Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0163 ACCEPT (5 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Cox, Cole, Armstrong, Green MODIFY(1) Frech NOOP(3) Christey, Wall, Foat Voter Comments: Christey> BID:4363 URL:http://www.securityfocus.com/bid/4363 XF:squid-dns-reply-dos(8628) URL:http://www.iss.net/security_center/static/8628.php BUGTRAQ:20020326 updated squid advisory URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101716495023226&w=2 CALDERA:CSSA-2002-017.0 MANDRAKE:MDKSA-2002:027 FREEBSD:FreeBSD-SA-02:19 Christey> CALDERA:CSSA-2002-017.1 URL:http://www.caldera.com/support/security/advisories/CSSA-2002-017.1.txt BID:4363 URL:http://www.securityfocus.com/bid/4363 Christey> CALDERA:CSSA-2002-SCO.26 Christey> REDHAT:RHSA-2002:051 (per Mark Cox) Frech> XF:squid-dns-reply-dos(8628) ====================================================== Candidate: CAN-2002-0169 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0169 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020411 Category: CF Reference: REDHAT:RHSA-2002:062 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-062.html Reference: HP:HPSBTL0205-038 Reference: URL:http://online.securityfocus.com/advisories/4095 Reference: XF:linux-docbook-stylesheet-insecure(8983) Reference: URL:http://www.iss.net/security_center/static/8983.php Reference: BID:4654 Reference: URL:http://online.securityfocus.com/bid/4654 The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to overwrite files outside of the current directory from an untrusted document by using a full pathname as an element identifier. Modifications: ADDREF HP:HPSBTL0205-038 ADDREF XF:linux-docbook-stylesheet-insecure(8983) ADDREF BID:4654 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0169 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:linux-docbook-stylesheet-insecure(8983) ====================================================== Candidate: CAN-2002-0170 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0170 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020411 Category: SF Reference: BUGTRAQ:20020301 [matt@zope.com: [Zope-Annce] Zope Hotfix 2002-03-01 (Ownership Roles Enforcement)] Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101503023511996&w=2 Reference: CONFIRM:http://www.zope.org/Products/Zope/hotfixes/ Reference: REDHAT:RHSA-2002:060 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-060.html Reference: XF:zope-proxy-role-privileges(8334) Reference: URL:http://www.iss.net/security_center/static/8334.php Reference: BID:4229 Reference: URL:http://www.securityfocus.com/bid/4229 Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration. Modifications: ADDREF REDHAT:RHSA-2002:060 ADDREF XF:zope-proxy-role-privileges(8334) ADDREF BID:4229 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0170 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Cox, Cole, Armstrong, Green MODIFY(1) Frech NOOP(3) Christey, Wall, Foat Voter Comments: Frech> XF:zope-proxy-role-privileges(8334) Christey> REDHAT:RHSA-2002:060 URL:http://www.redhat.com/support/errata/RHSA-2002-060.html ====================================================== Candidate: CAN-2002-0171 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0171 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020411 Category: SF Reference: SGI:20020406-01-P Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020406-01-P Reference: XF:irix-irisconsole-icadmin-access(8933) Reference: URL:http://www.iss.net/security_center/static/8933.php Reference: BID:4588 Reference: URL:http://www.securityfocus.com/bid/4588 IRISconsole 2.0 may allow users to log into the icadmin account with an incorrect password in some circumstances, which could allow users to gain privileges. Modifications: ADDREF XF:irix-irisconsole-icadmin-access(8933) ADDREF BID:4588 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0171 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Green MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:irix-irisconsole-icadmin-access(8933) ====================================================== Candidate: CAN-2002-0172 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0172 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020411 Category: CF Reference: SGI:20020408-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020408-01-I Reference: XF:irix-ipfilter-dos(8960) Reference: URL:http://www.iss.net/security_center/static/8960.php Reference: BID:4648 Reference: URL:http://online.securityfocus.com/bid/4648 /dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644), which could allow a local user to cause a denial of service (traffic disruption). Modifications: ADDREF XF:irix-ipfilter-dos(8960) ADDREF BID:4648 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0172 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Green MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BID:4648 URL:http://online.securityfocus.com/bid/4648 Frech> XF:irix-ipfilter-dos(8960) ====================================================== Candidate: CAN-2002-0173 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0173 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020411 Category: SF Reference: SGI:20020409-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020409-01-I Reference: BID:4644 Reference: URL:http://www.securityfocus.com/bid/4644 Reference: XF:irix-cpr-bo(8959) Reference: URL:http://www.iss.net/security_center/static/8959.php Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to gain root privileges. Modifications: ADDREF BID:4644 ADDREF XF:irix-cpr-bo(8959) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0173 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Green MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BID:4644 URL:http://www.securityfocus.com/bid/4644 Frech> XF:irix-cpr-bo(8959) ====================================================== Candidate: CAN-2002-0174 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0174 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020411 Category: SF Reference: SGI:20020501-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020501-01-I Reference: XF:irix-nsd-symlink(8981) Reference: URL:http://www.iss.net/security_center/static/8981.php Reference: BID:4655 Reference: URL:http://www.securityfocus.com/bid/4655 nsd on SGI IRIX before 6.5.11 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the nsd.dump file. Modifications: ADDREF XF:irix-nsd-symlink(8981) ADDREF BID:4655 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0174 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:irix-nsd-symlink(8981) ====================================================== Candidate: CAN-2002-0178 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020611 Assigned: 20020417 Category: SF Reference: MISC:http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en Reference: REDHAT:RHSA-2002:065 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-065.html Reference: HP:HPSBTL0205-040 Reference: URL:http://online.securityfocus.com/advisories/4132 Reference: MANDRAKE:MDKSA-2002:052 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-052.php Reference: XF:sharutils-uudecode-symlink(9075) Reference: URL:http://www.iss.net/security_center/static/9075.php Reference: BID:4742 Reference: URL:http://www.securityfocus.com/bid/4742 Reference: BUGTRAQ:20021030 GLSA: sharutils Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103599320902432&w=2 Reference: CERT-VN:VU#336083 Reference: URL:http://www.kb.cert.org/vuls/id/336083 Reference: CALDERA:CSSA-2002-040.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-040.0.txt Reference: COMPAQ:SSRT2301 uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands. Modifications: ADDREF HP:HPSBTL0205-040 ADDREF MANDRAKE:MDKSA-2002:052 ADDREF XF:sharutils-uudecode-symlink(9075) ADDREF BID:4742 ADDREF MISC:http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en ADDREF BUGTRAQ:20021030 GLSA: sharutils ADDREF CERT-VN:VU#336083 ADDREF CALDERA:CSSA-2002-040.0 ADDREF COMPAQ:SSRT2301 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0178 ACCEPT (6 accept, 5 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Green MODIFY(1) Cox NOOP(1) Christey Voter Comments: Cox> ADDREF: http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en Christey> HP:HPSBTL0205-040 URL:http://online.securityfocus.com/advisories/4132 XF:sharutils-uudecode-symlink(9075) URL:http://www.iss.net/security_center/static/9075.php BID:4742 URL:http://www.securityfocus.com/bid/4742 Christey> MANDRAKE:MDKSA-2002:052 Christey> BUGTRAQ:20021030 GLSA: sharutils URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103599320902432&w=2 CERT-VN:VU#336083 URL:http://www.kb.cert.org/vuls/id/336083 Christey> CALDERA:CSSA-2002-040.0 Christey> COMPAQ:SSRT2301 CERT-VN:VU#336083 URL:http://www.kb.cert.org/vuls/id/336083 ====================================================== Candidate: CAN-2002-0181 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0181 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020502 Assigned: 20020417 Category: SF Reference: BUGTRAQ:20020406 IMP 2.2.8 (SECURITY) released Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101828033830744&w=2 Reference: DEBIAN:DSA-126 Reference: URL:http://www.debian.org/security/2002/dsa-126 Reference: CALDERA:CSSA-2002-016.1 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2002-016.1.txt Reference: CONECTIVA:CLA-2001:473 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473 Reference: MISC:http://bugs.horde.org/show_bug.cgi?id=916 Reference: XF:imp-status-php3-css(8769) Reference: URL:http://www.iss.net/security_center/static/8769.php Reference: BID:4444 Reference: URL:http://www.securityfocus.com/bid/4444 Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter. Modifications: DESC rephrase CHANGEREF CALDERA [new version number] ADDREF CONECTIVA:CLA-2001:473 ADDREF MISC:http://bugs.horde.org/show_bug.cgi?id=916 ADDREF XF:imp-status-php3-css(8769) ADDREF BID:4444 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0181 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Green MODIFY(2) Frech, Cox NOOP(3) Christey, Wall, Foat Voter Comments: Cox> "execute script" sounds like local execution - it's just cross site scripting Christey> Try this desc: "Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary script and steal cookies of other IMP/HORDE users via the script parameter." CONECTIVA:CLA-2001:473 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473 MISC:http://bugs.horde.org/show_bug.cgi?id=916 XF:imp-status-php3-css(8769) URL:http://www.iss.net/security_center/static/8769.php BID:4444 URL:http://www.securityfocus.com/bid/4444 CHANGEREF CALDERA:CSSA-2002-016.1 (new version #) Frech> XF:imp-status-php3-css(8769) ====================================================== Candidate: CAN-2002-0184 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0184 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020502 Assigned: 20020419 Category: SF Reference: BUGTRAQ:20020425 [Global InterSec 2002041701] Sudo Password Prompt Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101974610509912&w=2 Reference: BUGTRAQ:20020425 Sudo version 1.6.6 now available (fwd) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101975443619600&w=2 Reference: MANDRAKE:MDKSA-2002:028 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-028.php3 Reference: DEBIAN:DSA-128 Reference: URL:http://www.debian.org/security/2002/dsa-128 Reference: REDHAT:RHSA-2002:071 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-071.html Reference: REDHAT:RHSA-2002:072 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-072.html Reference: ENGARDE:ESA-20020429-010 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2040.html Reference: BUGTRAQ:20020425 [slackware-security] sudo upgrade fixes a potential vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101979472822196&w=2 Reference: CONECTIVA:CLA-2002:475 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000475 Reference: TRUSTIX:TSLSA-2002-0046 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102010164413135&w=2 Reference: BUGTRAQ:20020429 TSLSA-2002-0046 - sudo Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102010164413135&w=2 Reference: SUSE:SuSE-SA:2002:014 Reference: URL:http://www.suse.de/de/security/2002_014_sudo_txt.html Reference: CERT-VN:VU#820083 Reference: URL:http://www.kb.cert.org/vuls/id/820083 Reference: XF:sudo-password-expansion-overflow(8936) Reference: URL:http://www.iss.net/security_center/static/8936.php Reference: BID:4593 Reference: URL:http://www.securityfocus.com/bid/4593 Heap-based buffer overflow in sudo before 1.6.6 may allow local users to gain root privileges via special characters in the -p (prompt) argument, which are not properly expanded. Modifications: ADDREF BUGTRAQ:20020429 TSLSA-2002-0046 - sudo ADDREF SUSE:SuSE-SA:2002:014 ADDREF XF:sudo-password-expansion-overflow(8936) DESC change terms to "heap-based buffer overflow" ADDREF BID:4593 ADDREF CERT-VN:VU#820083 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0184 ACCEPT (7 accept, 4 ack, 0 review) Current Votes: ACCEPT(6) Cox, Wall, Foat, Cole, Armstrong, Green MODIFY(1) Frech NOOP(1) Christey Voter Comments: Christey> BUGTRAQ:20020429 TSLSA-2002-0046 - sudo URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102010164413135&w=2 SUSE:SuSE-SA:2002:014 Frech> XF:sudo-password-expansion-overflow(8936) ====================================================== Candidate: CAN-2002-0185 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0185 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020419 Category: SF Reference: MISC:http://www.modpython.org/pipermail/mod_python/2002-April/001991.html Reference: MISC:http://www.modpython.org/pipermail/mod_python/2002-April/002003.html Reference: REDHAT:RHSA-2002:070 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-070.html Reference: CONECTIVA:CLA-2002:477 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000477 Reference: XF:modpython-imported-module-access(8997) Reference: URL:http://www.iss.net/security_center/static/8997.php Reference: BID:4656 Reference: URL:http://www.securityfocus.com/bid/4656 mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module. Modifications: ADDREF REDHAT:RHSA-2002:070 ADDREF CONECTIVA:CLA-2002:477 ADDREF XF:modpython-imported-module-access(8997) ADDREF BID:4656 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0185 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cox MODIFY(1) Frech NOOP(6) Christey, Wall, Foat, Cole, Armstrong, Green Voter Comments: Cox> ADDREF: RHSA-2002:070 Christey> ADDREF REDHAT:RHSA-2002:070 Christey> CONECTIVA:CLA-2002:477 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000477 Frech> XF:modpython-imported-module-access(8997) ====================================================== Candidate: CAN-2002-0186 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0186 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020420 Category: SF Reference: BUGTRAQ:20020613 wp-02-0007: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102397345410856&w=2 Reference: VULNWATCH:20020613 [VulnWatch] wp-02-0007: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0100.html Reference: MS:MS02-030 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-030.asp Reference: CERT-VN:VU#811371 Reference: URL:http://www.kb.cert.org/vuls/id/811371 Reference: BID:5004 Reference: URL:http://www.securityfocus.com/bid/5004 Reference: XF:mssql-sqlxml-isapi-bo(9328) Reference: URL:http://www.iss.net/security_center/static/9328.php Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." Modifications: ADDREF CERT-VN:VU#811371 ADDREF BID:5004 ADDREF XF:mssql-sqlxml-isapi-bo(9328) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0186 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> CERT-VN:VU#811371 URL:http://www.kb.cert.org/vuls/id/811371 BID:5004 URL:http://www.securityfocus.com/bid/5004 XF:mssql-sqlxml-isapi-bo(9328) URL:http://www.iss.net/security_center/static/9328.php ====================================================== Candidate: CAN-2002-0187 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0187 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020420 Category: SF Reference: BUGTRAQ:20020613 wp-02-0007: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102397345410856&w=2 Reference: VULNWATCH:20020613 [VulnWatch] wp-02-0007: Microsoft SQLXML ISAPI Overflow and Cross Site Scripting Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0100.html Reference: MS:MS02-030 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-030.asp Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag." Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0187 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> CERT-VN:VU#139931 URL:http://www.kb.cert.org/vuls/id/139931 XF:mssql-sqlxml-script-injection(9329) URL:http://www.iss.net/security_center/static/9329.php BID:5005 URL:http://www.securityfocus.com/bid/5005 ====================================================== Candidate: CAN-2002-0190 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0190 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020420 Category: SF Reference: MS:MS02-023 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-023.asp Reference: CERT-VN:VU#242891 Reference: URL:http://www.kb.cert.org/vuls/id/242891 Reference: XF:ie-netbios-incorrect-security-zone(9084) Reference: URL:http://www.iss.net/security_center/static/9084.php Reference: BID:4753 Reference: URL:http://www.securityfocus.com/bid/4753 Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability. Modifications: ADDREF XF:ie-netbios-incorrect-security-zone(9084) ADDREF BID:4753 ADDREF CERT-VN:VU#242891 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0190 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(1) Cox Voter Comments: Frech> XF:ie-netbios-incorrect-security-zone(9084) ====================================================== Candidate: CAN-2002-0191 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0191 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020420 Category: SF Reference: BUGTRAQ:20020402 Reading portions of local files in IE, depending on structure (GM#004-IE) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101778302030981&w=2 Reference: MS:MS02-023 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-023.asp Reference: XF:ie-css-read-files (8740) Reference: URL:http://www.iss.net/security_center/static/8740.php Reference: BID:4411 Reference: URL:http://online.securityfocus.com/bid/4411 Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText property of the stylesheet object, aka "Local Information Disclosure through HTML Object" vulnerability. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0191 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(6) Baker, Frech, Wall, Foat, Cole, Armstrong NOOP(1) Cox ====================================================== Candidate: CAN-2002-0213 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0213 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: CF Reference: BUGTRAQ:20020128 [ Hackerslab bug_paper ] Xkas application vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101223525118717&w=2 Reference: SGI:20020604-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020604-01-I Reference: BID:3969 Reference: URL:http://online.securityfocus.com/bid/3969 Reference: XF:kashare-xkas-icon-symlink(8002) Reference: URL:http://www.iss.net/security_center/static/8002.php xkas in Xinet K-AShare 0.011.01 for IRIX allows local users to read arbitrary files via a symlink attack on the VOLICON file, which copied to the .HSicon file in a shared directory. Modifications: ADDREF SGI:20020604-01-I Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0213 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Green NOOP(4) Christey, Wall, Foat, Cole Voter Comments: Christey> SGI:20020604-01-I ====================================================== Candidate: CAN-2002-0241 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0241 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: CISCO:20020207 Cisco Secure Access Control Server Novell Directory Service Expired/Disabled User Authentication Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/ciscosecure-acs-nds-authentication-vuln-pub.shtml Reference: XF:ciscosecure-nds-authentication(8106) Reference: URL:http://www.iss.net/security_center/static/8106.php Reference: BID:4048 Reference: URL:http://www.securityfocus.com/bid/4048 NDSAuth.DLL in Cisco Secure Authentication Control Server (ACS) 3.0.1 does not check the Expired or Disabled state of users in the Novell Directory Services (NDS), which could allow those users to authenticate to the server. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0241 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0246 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0246 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020210 Unixware Message catalog exploit code Reference: URL:http://online.securityfocus.com/archive/1/255414 Reference: CALDERA:CSSA-2002-SCO.3 Reference: URL:ftp://stage.caldera.com/pub/security/unixware/CSSA-2002-SCO.3/CSSA-2002-SCO.3.txt Reference: BID:4060 Reference: URL:http://online.securityfocus.com/bid/4060 Reference: XF:unixware-msg-catalog-format-string(8113) Reference: URL:http://www.iss.net/security_center/static/8113.php Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0246 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0250 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0250 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020208 Hewlett Packard AdvanceStack Switch Managment Authentication Bypass Vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101318469216213&w=2 Reference: HP:HPSBUX0202-185 Reference: URL:http://online.securityfocus.com/advisories/3870 Reference: BID:4062 Reference: URL:http://www.securityfocus.com/bid/4062 Reference: XF:hp-advancestack-bypass-auth(8124) Reference: URL:http://www.iss.net/security_center/static/8124.php Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, which allows the user to change the switch's configuration and modify the administrator password. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0250 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0267 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0267 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020212 SIPS - vulnerable to anyone gaining admin access. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101363233905645&w=2 Reference: CONFIRM:http://sips.sourceforge.net/adminvul.html Reference: BID:4097 Reference: URL:http://online.securityfocus.com/bid/4097 Reference: XF:sips-theme-admin-access(8193) Reference: URL:http://www.iss.net/security_center/static/8193.php preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file. Modifications: ADDREF XF:sips-theme-admin-access(8193) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0267 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:sips-theme-admin-access(8193) ====================================================== Candidate: CAN-2002-0274 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0274 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020213 Exim 3.34 and lower (fwd) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101362618118598&w=2 Reference: CONFIRM:http://www.exim.org/pipermail/exim-announce/2002q1/000053.html Reference: XF:exim-config-arg-bo(8194) Reference: URL:http://www.iss.net/security_center/static/8194.php Reference: BID:4096 Reference: URL:http://www.securityfocus.com/bid/4096 Exim 3.34 and earlier may allow local users to gain privileges via a buffer overflow in long -C (configuration file) and other command line arguments. Modifications: ADDREF XF:exim-config-arg-bo(8194) Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: A post to the Exim-announce mailing list on February 19th refers to problems "raised by the bugtraq posting last week." INFERRED ACTION: CAN-2002-0274 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cox, Cole MODIFY(1) Frech NOOP(3) Wall, Foat, Armstrong Voter Comments: Frech> XF:exim-config-arg-bo(8194) CHANGE> [Cox changed vote from REVIEWING to ACCEPT] ====================================================== Candidate: CAN-2002-0276 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0276 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020213 [NGSEC-2002-1] Ettercap, remote root compromise Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101370874219511&w=2 Reference: CONFIRM:http://ettercap.sourceforge.net/index.php?s=history Reference: BID:4104 Reference: URL:http://online.securityfocus.com/bid/4104 Reference: XF:ettercap-memcpy-bo(8200) Reference: URL:http://www.iss.net/security_center/static/8200.php Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier, when running on networks with an MTU greater than 2000, allows remote attackers to execute arbitrary code via large packets. Modifications: ADDREF XF:ettercap-memcpy-bo(8200) Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the entry for version 0.6.4 in the vendor's history file states "Fixed the possibility of remote exploitation on interface with MTU > 1500" INFERRED ACTION: CAN-2002-0276 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:ettercap-memcpy-bo(8200) ====================================================== Candidate: CAN-2002-0287 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0287 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: CF Reference: BUGTRAQ:20020216 pforum: mysql-injection-bug Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101389284625019&w=2 Reference: CONFIRM:http://www.powie.de/news/index.php Reference: BID:4114 Reference: URL:http://online.securityfocus.com/bid/4114 Reference: XF:pforum-quotes-sql-injection(8203) Reference: URL:http://www.iss.net/security_center/static/8203.php pforum 1.14 and earlier does no explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default. Modifications: ADDREF XF:pforum-quotes-sql-injection(8203) Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: While the comment on the News page is in German, it is clear that the vendor's statement on 20020214 constitutes sufficient acknowledgement, even when viewed using basic translation software: "Hiermit m?chte ich alle User des PFORUM auf eine schwere Sicherheitsl?cke aufmerksam machen... Diese Sicherheitsl?cke tritt nur auf, wenn auf den entsprechenden Webserver in der PHP.INI magic_quotes_gpc = Off sind." INFERRED ACTION: CAN-2002-0287 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:pforum-quotes-sql-injection(8203) ====================================================== Candidate: CAN-2002-0290 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0290 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020218 Netwin Webnews Buffer Overflow Vulnerability (#NISR18022002) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101413521417638&w=2 Reference: CONFIRM:ftp://netwinsite.com/pub/webnews/beta/webnews11m_solaris.tar.Z Reference: BID:4124 Reference: URL:http://online.securityfocus.com/bid/4124 Reference: XF:webnews-cgi-group-bo(8220) Reference: URL:http://www.iss.net/security_center/static/8220.php Buffer overflow in Netwin WebNews CGI program 1.1, Webnews.exe, allows remote attackers to execute arbitrary code via a long group argument. Modifications: ADDREF XF:webnews-cgi-group-bo(8220) Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the "webnews/manuals/update.htm" file in the WebNews distribution has an entry dated February 21, which states: "Fixed: Buffer Overflow Vulnerability reported by NGSSoftware Insight Security Research." INFERRED ACTION: CAN-2002-0290 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:webnews-cgi-group-bo(8220) ====================================================== Candidate: CAN-2002-0292 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0292 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020219 [SA-2002:01] Slashcode login vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101414005501708&w=2 Reference: BID:4116 Reference: URL:http://online.securityfocus.com/bid/4116 Reference: XF:slashcode-site-xss(8221) Reference: URL:http://www.iss.net/security_center/static/8221.php Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field. Modifications: ADDREF XF:slashcode-site-xss(8221) Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0292 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:slashcode-site-xss(8221) ====================================================== Candidate: CAN-2002-0299 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0299 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020220 CNet CatchUp arbitrary code execution Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101438631921749&w=2 Reference: BID:3975 Reference: URL:http://online.securityfocus.com/bid/3975 Reference: XF:cnet-catchup-gain-privileges(8035) Reference: URL:http://www.iss.net/security_center/static/8035.php CNet CatchUp before 1.3.1 allows attackers to execute arbitrary code via a .RVP file that creates a file with an arbitrary extension (such as .BAT), which is executed during a scan. Modifications: ADDREF XF:cnet-catchup-gain-privileges(8035) Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0299 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:cnet-catchup-gain-privileges(8035) ====================================================== Candidate: CAN-2002-0300 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0300 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020219 gnujsp: dir- and script-disclosure Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101415804625292&w=2 Reference: BUGTRAQ:20020220 Re: gnujsp: dir- and script-disclosure Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101422432123898&w=2 Reference: DEBIAN:DSA-114 Reference: URL:http://www.debian.org/security/2002/dsa-114 Reference: BID:4125 Reference: URL:http://online.securityfocus.com/bid/4125 Reference: XF:gnujsp-jserv-information-disclosure(8240) Reference: URL:http://www.iss.net/security_center/static/8240.php gnujsp 1.0.0 and 1.0.1 allows remote attackers to list directories, read source code of certain scripts, and bypass access restrictions by directly requesting the target file from the gnujsp servlet, which does not work around a limitation of JServ and does not process the requested file. Modifications: ADDREF XF:gnujsp-jserv-information-disclosure(8240) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0300 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:gnujsp-jserv-information-disclosure(8240) ====================================================== Candidate: CAN-2002-0302 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0302 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020220 Symantec Enterprise Firewall (SEF) Notify Daemon data loss via SN MP Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101424225814604&w=2 Reference: CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20a.html Reference: BID:4139 Reference: URL:http://online.securityfocus.com/bid/4139 Reference: XF:sef-smtp-proxy-information(8251) Reference: URL:http://www.iss.net/security_center/static/8251.php The Notify daemon for Symantec Enterprise Firewall (SEF) 6.5.x drops large alerts when SNMP is used as the transport, which could prevent some alerts from being sent in the event of an attack. Modifications: ADDREF XF:sef-smtp-proxy-information(8251) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0302 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Prosser, Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:sef-smtp-proxy-information(8251) Prosser> http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20a.html ====================================================== Candidate: CAN-2002-0309 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0309 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020221 Symantec Enterprise Firewall (SEF) SMTP proxy inconsistencies Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101430810813853&w=2 Reference: BUGTRAQ:20020220 Symantec Enterprise Firewall (SEF) SMTP proxy inconsistencies Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101424307617060&w=2 Reference: CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20.html Reference: BID:4141 Reference: URL:http://online.securityfocus.com/bid/4141 Reference: XF:sef-smtp-proxy-information(8251) Reference: URL:http://www.iss.net/security_center/static/8251.php SMTP proxy in Symantec Enterprise Firewall (SEF) 6.5.x includes the firewall's physical interface name and address in an SMTP protocol exchange when NAT translation is made to an address other than the firewall, which could allow remote attackers to determine certain firewall configuration information. Modifications: ADDREF CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20.html ADDREF XF:sef-smtp-proxy-information(8251) Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0309 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Prosser, Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:sef-smtp-proxy-information(8251) Prosser> http://securityresponse.symantec.com/avcenter/security/Content/2002.02.20.html ====================================================== Candidate: CAN-2002-0318 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0318 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020221 DoS Attack against many RADIUS servers Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101440113410083&w=2 Reference: XF:freeradius-access-request-dos(9968) Reference: URL:http://www.iss.net/security_center/static/9968.php FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets. Modifications: ADDREF XF:freeradius-access-request-dos(9968) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0318 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:freeradius-access-request-dos(9968) http://www.freeradius.org/radiusd/doc/ChangeLog Possibly: Fix a bug which would hang the server when many SQL connections were open. ====================================================== Candidate: CAN-2002-0329 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0329 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020227 RE: Open Bulletin Board javascript bug. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101485184605149&w=2 Reference: BUGTRAQ:20020227 Snitz 2000 Code Patch (was RE: Open Bulletin Board javascript bug.) Reference: URL:http://online.securityfocus.com/archive/1/258981 Reference: CONFIRM:http://forum.snitz.com/forum/link.asp?TOPIC_ID=23660 Reference: BID:4192 Reference: URL:http://www.securityfocus.com/bid/4192 Reference: XF:snitz-img-css(8309) Reference: URL:http://www.iss.net/security_center/static/8309.php Cross-site scripting vulnerability in Snitz Forums 2000 3.3.03 and earlier allows remote attackers to execute arbitrary script as other Forums 2000 users via Javascript in an IMG tag. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0329 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> DELREF one BID:4192 (mentioned twice) ====================================================== Candidate: CAN-2002-0330 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0330 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: BUGTRAQ:20020225 Open Bulletin Board javascript bug. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101466092601554&w=2 Reference: CONFIRM:http://community.iansoft.net/read.php?TID=5159 Reference: BID:4171 Reference: URL:http://online.securityfocus.com/bid/4171 Reference: XF:openbb-img-css(8278) Reference: URL:http://www.iss.net/security_center/static/8278.php Cross-site scripting vulnerability in codeparse.php of Open Bulletin Board (OpenBB) 1.0.0 allows remote attackers to execute arbitrary script and steal cookies via Javascript in the IMG tag. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0330 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0339 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0339 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020502 Assigned: 20020501 Category: SF Reference: CISCO:20020227 Cisco Security Advisory: Data Leak with Cisco Express Forwarding Reference: URL:http://www.cisco.com/warp/public/707/IOS-CEF-pub.shtml Reference: XF:ios-cef-information-leak(8296) Reference: URL:http://www.iss.net/security_center/static/8296.php Reference: BID:4191 Reference: URL:http://www.securityfocus.com/bid/4191 Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0339 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0355 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0355 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020502 Category: SF Reference: SGI:20020503-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020503-01-I Reference: BID:4682 Reference: URL:http://www.securityfocus.com/bid/4682 Reference: XF:irix-netstat-file-existence(9023) Reference: URL:http://www.iss.net/security_center/static/9023.php netstat in SGI IRIX before 6.5.12 allows local users to determine the existence of files on the system, even if the users do not have the appropriate permissions. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0355 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0356 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0356 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020502 Category: SF Reference: SGI:20020504-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020504-01-I Reference: XF:irix-fsrxfs-gain-privileges(9042) Reference: URL:http://www.iss.net/security_center/static/9042.php Reference: BID:4706 Reference: URL:http://www.securityfocus.com/bid/4706 Vulnerability in XFS filesystem reorganizer (fsr_xfs) in SGI IRIX 6.5.10 and earlier allows local users to gain root privileges by overwriting critical system files. Modifications: ADDREF XF:irix-fsrxfs-gain-privileges(9042) ADDREF BID:4706 Analysis -------- Vendor Acknowledgement: yes advisory NOTE: CAN-2002-0356 was incorrectly used in a report for the sgdynamo product. The correct identifier for the sgdynamo vulnerability is CAN-2002-0375. INFERRED ACTION: CAN-2002-0356 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> NOTE: CAN-2002-0356 was mistakenly referenced in a report for the sgdynamo product. The correct identifier for the sgdynamo vulnerability is CAN-2002-0375. Christey> XF:irix-fsrxfs-gain-privileges(9042) URL:http://www.iss.net/security_center/static/9042.php BID:4706 URL:http://www.securityfocus.com/bid/4706 Frech> XF:irix-fsrxfs-gain-privileges(9042) ====================================================== Candidate: CAN-2002-0358 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0358 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020502 Category: SF Reference: SGI:20020602-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020602-01-I Reference: XF:irix-mediamail-core-dump(9292) Reference: URL:http://www.iss.net/security_center/static/9292.php Reference: BID:4959 Reference: URL:http://www.securityfocus.com/bid/4959 MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the users to read sensitive data or gain privileges. Modifications: DESC Fix typo: "Medial" Mail ADDREF BID:4959 ADDREF XF:irix-mediamail-core-dump(9292) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0358 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> Fix typo: "Medial" Mail XF:irix-mediamail-core-dump(9292) URL:http://www.iss.net/security_center/static/9292.php BID:4959 URL:http://www.securityfocus.com/bid/4959 Frech> XF:irix-mediamail-core-dump(9292) ====================================================== Candidate: CAN-2002-0359 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0359 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020502 Category: SF Reference: BUGTRAQ:20020620 [LSD] IRIX rpc.xfsmd multiple remote root vulnerabilities Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102459162909825&w=2 Reference: SGI:20020606-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020606-01-I Reference: CERT-VN:VU#521147 Reference: URL:http://www.kb.cert.org/vuls/id/521147 Reference: XF:irix-xfsmd-bypass-authentication(9401) Reference: URL:http://www.iss.net/security_center/static/9401.php Reference: BID:5072 Reference: URL:http://www.securityfocus.com/bid/5072 xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges. Modifications: ADDREF XF:irix-xfsmd-bypass-authentication(9401) ADDREF BID:5072 ADDREF CERT-VN:VU#521147 DELREF SGI:20020605-01-I Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0359 ACCEPT_ACK (2 accept, 2 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:irix-xfsmd-bypass-authentication(9401) URL:http://www.iss.net/security_center/static/9401.php BID:5072 URL:http://www.securityfocus.com/bid/5072 Christey> DELREF SGI:20020605-01-I (that one is for CAN-2003-0392) ====================================================== Candidate: CAN-2002-0363 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020507 Category: SF Reference: MISC:http://www.ghostscript.com/pipermail/gs-code-review/2002-January/001801.html Reference: MISC:http://www.ghostscript.com/pipermail/gs-code-review/2002-February/001900.html Reference: REDHAT:RHSA-2002:083 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-083.html Reference: CALDERA:CSSA-2002-026.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-026.0.txt Reference: XF:ghostscript-postscript-command-execution(9254) Reference: URL:http://www.iss.net/security_center/static/9254.php Reference: BID:4937 Reference: URL:http://www.securityfocus.com/bid/4937 ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice. Modifications: ADDREF CALDERA:CSSA-2002-026.0 ADDREF XF:ghostscript-postscript-command-execution(9254) ADDREF BID:4937 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0363 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Alderson MODIFY(1) Frech NOOP(3) Christey, Wall, Foat Voter Comments: Christey> CALDERA:CSSA-2002-026.0 Christey> XF:ghostscript-postscript-command-execution(9254) URL:http://www.iss.net/security_center/static/9254.php BID:4937 URL:http://www.securityfocus.com/bid/4937 Frech> XF:ghostscript-postscript-command-execution(9254) ====================================================== Candidate: CAN-2002-0364 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0364 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020508 Category: SF Reference: BUGTRAQ:20020612 ADVISORY: Windows 2000 and NT4 IIS .HTR Remote Buffer Overflow [AD20020612] Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102392069305962&w=2 Reference: NTBUGTRAQ:20020612 ADVISORY: Windows 2000 and NT4 IIS .HTR Remote Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102392308608100&w=2 Reference: VULNWATCH:20020612 ADVISORY: Windows 2000 and NT4 IIS .HTR Remote Buffer Overflow [AD20020612] Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0099.html Reference: BUGTRAQ:20020613 VNA - .HTR HEAP OVERFLOW Reference: URL:http://online.securityfocus.com/archive/1/276767 Reference: CERT-VN:VU#313819 Reference: URL:http://www.kb.cert.org/vuls/id/313819 Reference: MS:MS02-028 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-028.asp Reference: BID:4855 Reference: URL:http://www.securityfocus.com/bid/4855 Reference: XF:iis-htr-chunked-encoding-bo(9327) Reference: URL:http://www.iss.net/security_center/static/9327.php Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." Modifications: ADDREF BID:4855 ADDREF BUGTRAQ:20020613 VNA - .HTR HEAP OVERFLOW ADDREF CERT-VN:VU#313819 ADDREF XF:iis-htr-chunked-encoding-bo(9327) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0364 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> BID:4855 URL:http://www.securityfocus.com/bid/4855 BUGTRAQ:20020613 VNA - .HTR HEAP OVERFLOW URL:http://online.securityfocus.com/archive/1/276767 CERT-VN:VU#313819 URL:http://www.kb.cert.org/vuls/id/313819 XF:iis-htr-chunked-encoding-bo(9327) URL:http://www.iss.net/security_center/static/9327.php ====================================================== Candidate: CAN-2002-0366 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0366 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020508 Category: SF Reference: BUGTRAQ:20020613 Microsoft RASAPI32.DLL Reference: URL:http://online.securityfocus.com/archive/1/276776 Reference: BUGTRAQ:20020620 VPN and Q318138 Reference: URL:http://online.securityfocus.com/archive/1/278145 Reference: MISC:http://www.nextgenss.com/vna/ms-ras.txt Reference: MS:MS02-029 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS02-029.asp Reference: BID:4852 Reference: URL:http://www.securityfocus.com/bid/4852 Buffer overflow in Remote Access Service (RAS) phonebook for Windows NT 4.0, 2000, XP, and Routing and Remote Access Server (RRAS) allows local users to execute arbitrary code by modifying the rasphone.pbk file to use a long dial-up entry. Modifications: ADDREF BUGTRAQ:20020613 Microsoft RASAPI32.DLL ADDREF BUGTRAQ:20020620 VPN and Q318138 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0366 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> Add: a long script name is the issue. BUGTRAQ:20020613 Microsoft RASAPI32.DLL URL:http://online.securityfocus.com/archive/1/276776 BUGTRAQ:20020620 VPN and Q318138 URL:http://online.securityfocus.com/archive/1/278145 ====================================================== Candidate: CAN-2002-0367 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0367 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020508 Category: SF Reference: BUGTRAQ:20020314 Fwd: DebPloit (exploit) Reference: URL:http://www.securityfocus.com/archive/1/262074 Reference: BUGTRAQ:20020326 Re: DebPloit (exploit) Reference: URL:http://www.securityfocus.com/archive/1/264441 Reference: BUGTRAQ:20020327 Local Security Vulnerability in Windows NT and Windows 2000 Reference: URL:http://www.securityfocus.com/archive/1/264927 Reference: NTBUGTRAQ:20020314 DebPloit (exploit) Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=101614320402695&w=2 Reference: BID:4287 Reference: URL:http://www.securityfocus.com/bid/4287 Reference: XF:win-debug-duplicate-handles(8462) Reference: URL:http://www.iss.net/security_center/static/8462.php Reference: MS:MS02-024 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-024.asp smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0367 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Green NOOP(1) Cox ====================================================== Candidate: CAN-2002-0368 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0368 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020508 Category: SF Reference: MS:MS02-025 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-025.asp Reference: XF:exchange-msg-attribute-dos(9195) Reference: URL:http://www.iss.net/security_center/static/9195.php Reference: BID:4881 Reference: URL:http://www.securityfocus.com/bid/4881 The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources." Modifications: ADDREF XF:exchange-msg-attribute-dos(9195) ADDREF BID:4881 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0368 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:exchange-msg-attribute-dos(9195) URL:http://www.iss.net/security_center/static/9195.php BID:4881 URL:http://www.securityfocus.com/bid/4881 Frech> XF:exchange-msg-attribute-dos(9195) ====================================================== Candidate: CAN-2002-0369 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0369 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020508 Category: SF Reference: MS:MS02-026 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS02-026.asp Reference: XF:ms-aspdotnet-stateserver-bo(9276) Reference: URL:http://www.iss.net/security_center/static/9276.php Reference: BID:4958 Reference: URL:http://www.securityfocus.com/bid/4958 Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode. Modifications: ADDREF XF:ms-aspdotnet-stateserver-bo(9276) ADDREF BID:4958 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0369 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:ms-aspdotnet-stateserver-bo(9276) http://www.iss.net/security_center/static/9276.php BID:4958 URL:http://www.securityfocus.com/bid/4958 Frech> XF:ms-aspdotnet-stateserver-bo(9276) ====================================================== Candidate: CAN-2002-0372 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0372 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020508 Category: SF Reference: MS:MS02-032 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-032.asp Reference: XF:mediaplayer-cache-code-execution(9420) Reference: URL:http://www.iss.net/security_center/static/9420.php Reference: BID:5107 Reference: URL:http://www.securityfocus.com/bid/5107 Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement stored in the IE cache, aka the "Cache Path Disclosure via Windows Media Player". Modifications: ADDREF XF:mediaplayer-cache-code-execution(9420) ADDREF BID:5107 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0372 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> XF:mediaplayer-cache-code-execution(9420) URL:http://www.iss.net/security_center/static/9420.php BID:5107 URL:http://www.securityfocus.com/bid/5107 ====================================================== Candidate: CAN-2002-0373 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0373 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020726 Assigned: 20020508 Category: SF Reference: MS:MS02-032 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-032.asp Reference: XF:mediaplayer-wmdm-privilege-elevation(9421) Reference: URL:http://www.iss.net/security_center/static/9421.php Reference: BID:5109 Reference: URL:http://www.securityfocus.com/bid/5109 The Windows Media Device Manager (WMDM) Service in Microsoft Windows Media Player 7.1 on Windows 2000 systems allows local users to obtain LocalSystem rights via a program that calls the WMDM service to connect to an invalid local storage device, aka "Privilege Elevation through Windows Media Device Manager Service". Modifications: ADDREF XF:mediaplayer-wmdm-privilege-elevation(9421) ADDREF BID:5109 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0373 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:mediaplayer-wmdm-privilege-elevation(9421) URL:http://www.iss.net/security_center/static/9421.php BID:5109 URL:http://www.securityfocus.com/bid/5109 ====================================================== Candidate: CAN-2002-0374 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0374 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020508 Category: SF Reference: BUGTRAQ:20020506 ldap vulnerabilities Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102070762606525&w=2 Reference: VULNWATCH:20020506 ldap vulnerabilities Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0053.html Reference: CALDERA:CSSA-2002-041.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-041.0.txt Reference: MANDRAKE:MDKSA-2002:075 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:075 Reference: REDHAT:RHSA-2002:084 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-084.html Reference: REDHAT:RHSA-2002:175 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-175.html Reference: BUGTRAQ:20021030 GLSA: pam_ldap Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103601912505261&w=2 Reference: XF:pamldap-config-format-string(9018) Reference: URL:http://www.iss.net/security_center/static/9018.php Reference: BID:4679 Reference: URL:http://online.securityfocus.com/bid/4679 Format string vulnerability in the logging function for the pam_ldap PAM LDAP module before version 144 allows attackers to execute arbitrary code via format strings in the configuration file name. Modifications: ADDREF XF:pamldap-config-format-string(9018) ADDREF BID:4679 ADDREF BUGTRAQ:20021030 GLSA: pam_ldap ADDREF CALDERA:CSSA-2002-041.0 ADDREF MANDRAKE:MDKSA-2002:075 ADDREF REDHAT:RHSA-2002:175 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0374 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Foat Voter Comments: Christey> XF:pamldap-config-format-string(9018) URL:http://www.iss.net/security_center/static/9018.php BID:4679 URL:http://online.securityfocus.com/bid/4679 Frech> XF:pamldap-config-format-string(9018) Christey> REDHAT:RHSA-2002:084 Christey> BUGTRAQ:20021030 GLSA: pam_ldap URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103601912505261&w=2 CALDERA:CSSA-2002-041.0 Christey> MANDRAKE:MDKSA-2002:075 Christey> REDHAT:RHSA-2002:175 URL:http://www.redhat.com/support/errata/RHSA-2002-175.html CALDERA:CSSA-2002-041.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-041.0.txt ====================================================== Candidate: CAN-2002-0377 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0377 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020611 Assigned: 20020514 Category: SF Reference: BUGTRAQ:20020512 Gaim abritary Email Reading Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102130733815285&w=2 Reference: VULN-DEV:20020511 Gaim abritary Email Reading Reference: URL:http://archives.neohapsis.com/archives/vuln-dev/2002-q2/0584.html Reference: CONFIRM:http://gaim.sourceforge.net/ChangeLog Reference: XF:gaim-email-access(9061) Reference: URL:http://www.iss.net/security_center/static/9061.php Reference: BID:4730 Reference: URL:http://www.securityfocus.com/bid/4730 Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files. Modifications: ADDREF VULN-DEV:20020511 Gaim abritary Email Reading ADDREF XF:gaim-email-access(9061) ADDREF BID:4730 Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: The Change Log for Gaim version 0.58, dated May 13, says "Tempfiles used for secure MSN/HotMail login (added in 0.57) are now themselves created securely." In addition to a statement on the vendor's News page, dated May 14, regarding "the fix to the recent BugTraq posting about Gaim," this is sufficient acknowledgement. INFERRED ACTION: CAN-2002-0377 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Wall, Foat Voter Comments: Christey> VULN-DEV:20020511 Gaim abritary Email Reading URL:http://archives.neohapsis.com/archives/vuln-dev/2002-q2/0584.html Frech> XF:gaim-email-access(9061) Christey> XF:gaim-email-access(9061) URL:http://www.iss.net/security_center/static/9061.php BID:4730 URL:http://www.securityfocus.com/bid/4730 ====================================================== Candidate: CAN-2002-0379 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0379 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020517 Category: SF Reference: BUGTRAQ:20020510 wu-imap buffer overflow condition Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102107222100529&w=2 Reference: REDHAT:RHSA-2002:092 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-092.html Reference: CONECTIVA:CLA-2002:487 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000487 Reference: HP:HPSBTL0205-043 Reference: URL:http://online.securityfocus.com/advisories/4167 Reference: CALDERA:CSSA-2002-021.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-021.0.txt Reference: MANDRAKE:MDKSA-2002:034 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php Reference: ENGARDE:ESA-20020607-013 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2120.html Reference: BID:4713 Reference: URL:http://www.securityfocus.com/bid/4713 Reference: XF:wuimapd-partial-mailbox-bo(9055) Reference: URL:http://www.iss.net/security_center/static/9055.php Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support, and imapd 2000.287 and earlier, allows remote authenticated users to execute arbitrary code via a long BODY request. Modifications: ADDREF CONECTIVA:CLA-2002:487 ADDREF HP:HPSBTL0205-043 ADDREF CALDERA:CSSA-2002-021.0 ADDREF MANDRAKE:MDKSA-2002:034 ADDREF ENGARDE:ESA-20020607-013 ADDREF BID:4713 ADDREF XF:wuimapd-partial-mailbox-bo(9055) Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0379 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Foat Voter Comments: Christey> Add "long BODY request" to desc. CONECTIVA:CLA-2002:487 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000487 HP:HPSBTL0205-043 URL:http://online.securityfocus.com/advisories/4167 CALDERA:CSSA-2002-021.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-021.0.txt MANDRAKE:MDKSA-2002:034 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-034.php ENGARDE:ESA-20020607-013 URL:http://www.linuxsecurity.com/advisories/other_advisory-2120.html BID:4713 URL:http://www.securityfocus.com/bid/4713 XF:wuimapd-partial-mailbox-bo(9055) URL:http://www.iss.net/security_center/static/9055.php Frech> XF:wuimapd-partial-mailbox-bo(9055) ====================================================== Candidate: CAN-2002-0381 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0381 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020517 Category: SF Reference: MISC:http://www.FreeBSD.org/cgi/query-pr.cgi?pr=35022 Reference: BUGTRAQ:20020317 TCP Connections to a Broadcast Address on BSD-Based Systems Reference: URL:http://online.securityfocus.com/archive/1/262733 Reference: CONFIRM:http://www.openbsd.org/cgi-bin/cvsweb/src/sys/netinet/tcp_input.c.diff?r1=1.109&r2=1.110 Reference: CONFIRM:http://cvsweb.netbsd.org/bsdweb.cgi/syssrc/sys/netinet/tcp_input.c.diff?r1=1.136&r2=1.137 Reference: BID:4309 Reference: URL:http://online.securityfocus.com/bid/4309 Reference: XF:bsd-broadcast-address(8485) Reference: URL:http://www.iss.net/security_center/static/8485.php The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0381 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Green NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0382 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0382 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-02 Proposed: 20020611 Assigned: 20020521 Category: SF Reference: BUGTRAQ:20020327 Xchat /dns command execution vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101725430425490&w=2 Reference: REDHAT:RHSA-2002:097 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-097.html Reference: MANDRAKE:MDKSA-2002:051 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-051.php Reference: CONECTIVA:CLA-2002:526 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000526 Reference: XF:xchat-dns-execute-commands(8704) Reference: URL:http://www.iss.net/security_center/static/8704.php Reference: BID:4376 Reference: URL:http://www.securityfocus.com/bid/4376 XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters. Modifications: DESC capitalize XChat properly ADDREF MANDRAKE:MDKSA-2002:051 ADDREF CONECTIVA:CLA-2002:526 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0382 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Armstrong MODIFY(2) Cox, Foat NOOP(3) Christey, Wall, Cole Voter Comments: Cox> Xchat should be XChat Foat> Agree with Cox modification Christey> MANDRAKE:MDKSA-2002:051 Christey> CONECTIVA:CLA-2002:526 ====================================================== Candidate: CAN-2002-0389 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0389 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020611 Assigned: 20020523 Category: SF Reference: BUGTRAQ:20020417 Mailman/Pipermail private mailing list/local user vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101902003314968&w=2 Reference: MISC:http://sourceforge.net/tracker/?func=detail&atid=100103&aid=474616&group_id=103 Reference: XF:pipermail-view-archives(8874) Reference: URL:http://www.iss.net/security_center/static/8874.php Reference: BID:4538 Reference: URL:http://www.securityfocus.com/bid/4538 Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives. Modifications: DESC fix typo ADDREF XF:pipermail-view-archives(8874) ADDREF BID:4538 Analysis -------- Vendor Acknowledgement: no disputed INCLUSION: In a response to the bug report, the vendor says "I'm not inclined to fix this, since this arrangement is crucial to the web security of private archives." INFERRED ACTION: CAN-2002-0389 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cox MODIFY(1) Frech NOOP(4) Christey, Wall, Foat, Cole Voter Comments: Frech> XF: pipermail-view-archives(8874) Christey> Add period to the end of the description. ====================================================== Candidate: CAN-2002-0391 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0391 Final-Decision: Interim-Decision: 20030326 Modified: 20030320-01 Proposed: 20020830 Assigned: 20020528 Category: SF Reference: ISS:20020731 Remote Buffer Overflow Vulnerability in Sun RPC Reference: URL:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Reference: BUGTRAQ:20020731 Remote Buffer Overflow Vulnerability in Sun RPC Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102813809232532&w=2 Reference: BUGTRAQ:20020801 RPC analysis Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102821785316087&w=2 Reference: BUGTRAQ:20020802 MITKRB5-SA-2002-001: Remote root vulnerability in MIT krb5 admin Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102831443208382&w=2 Reference: CERT:CA-2002-25 Reference: URL:http://www.cert.org/advisories/CA-2002-25.html Reference: CERT-VN:VU#192995 Reference: URL:http://www.kb.cert.org/vuls/id/192995 Reference: AIXAPAR:IY34194 Reference: URL:http://archives.neohapsis.com/archives/aix/2002-q4/0002.html Reference: CALDERA:CSSA-2002-055.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-055.0.txt Reference: CONECTIVA:CLA-2002:515 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000515 Reference: CONECTIVA:CLA-2002:535 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000535 Reference: DEBIAN:DSA-142 Reference: URL:http://www.debian.org/security/2002/dsa-142 Reference: DEBIAN:DSA-143 Reference: URL:http://www.debian.org/security/2002/dsa-143 Reference: DEBIAN:DSA-146 Reference: URL:http://www.debian.org/security/2002/dsa-146 Reference: DEBIAN:DSA-149 Reference: URL:http://www.debian.org/security/2002/dsa-149 Reference: ENGARDE:ESA-20021003-021 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2399.html Reference: FREEBSD:FreeBSD-SA-02:34.rpc Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102821928418261&w=2 Reference: HP:HPSBTL0208-061 Reference: URL:http://online.securityfocus.com/advisories/4402 Reference: HP:HPSBUX0209-215 Reference: URL:http://archives.neohapsis.com/archives/hp/2002-q3/0077.html Reference: MANDRAKE:MDKSA-2002:057 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:057 Reference: MS:MS02-057 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-057.asp Reference: NETBSD:NetBSD-SA2002-011 Reference: URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-011.txt.asc Reference: REDHAT:RHSA-2002:166 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-166.html Reference: REDHAT:RHSA-2002:172 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-172.html Reference: REDHAT:RHSA-2002:167 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-167.html Reference: SGI:20020801-01-A Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020801-01-A Reference: SGI:20020801-01-P Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020801-01-A Reference: SUSE:SuSE-SA:2002:031 Reference: BUGTRAQ:20020803 OpenAFS Security Advisory 2002-001: Remote root vulnerability in OpenAFS servers Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0514.html Reference: BUGTRAQ:20020802 kerberos rpc xdr_array Reference: URL:http://online.securityfocus.com/archive/1/285740 Reference: BUGTRAQ:20020909 GLSA: glibc Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103158632831416&w=2 Reference: XF:sunrpc-xdr-array-bo(9170) Reference: URL:http://www.iss.net/security_center/static/9170.php Reference: BID:5356 Reference: URL:http://www.securityfocus.com/bid/5356 Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. Modifications: ADDREF REDHAT:RHSA-2002:167 ADDREF XF:sunrpc-xdr-array-bo(9170) ADDREF BID:5356 ADDREF BUGTRAQ:20020803 OpenAFS Security Advisory 2002-001: Remote root vulnerability in OpenAFS servers ADDREF CONECTIVA:CLA-2002:515 ADDREF HP:HPSBTL0208-061 ADDREF BUGTRAQ:20020802 kerberos rpc xdr_array ADDREF BUGTRAQ:20020909 GLSA: glibc ADDREF SUSE:SuSE-SA:2002:031 ADDREF MS:MS02-057 ADDREF HP:HPSBUX0209-215 ADDREF MANDRAKE:MDKSA-2002:057 ADDREF ENGARDE:ESA-20021003-021 ADDREF CALDERA:CSSA-2002-055.0 ADDREF AIXAPAR:IY34194 ADDREF CONECTIVA:CLA-2002:535 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0391 ACCEPT (4 accept, 13 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole MODIFY(1) Cox NOOP(2) Christey, Foat Voter Comments: Cox> ADDREF: RHSA-2002:167 Christey> XF:sunrpc-xdr-array-bo(9170) URL:http://www.iss.net/security_center/static/9170.php BID:5356 URL:http://www.securityfocus.com/bid/5356 BUGTRAQ:20020803 OpenAFS Security Advisory 2002-001: Remote root vulnerability in OpenAFS servers URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0514.html CONECTIVA:CLA-2002:515 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000515 HP:HPSBTL0208-061 URL:http://online.securityfocus.com/advisories/4402 BUGTRAQ:20020802 kerberos rpc xdr_array URL:http://online.securityfocus.com/archive/1/285740 Christey> BUGTRAQ:20020909 GLSA: glibc URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103158632831416&w=2 Christey> SUSE:SuSE-SA:2002:031 Christey> MS:MS02-057 Christey> HP:HPSBUX0209-215 URL:http://archives.neohapsis.com/archives/hp/2002-q3/0077.html MANDRAKE:MDKSA-2002:057 ENGARDE:ESA-20021003-021 Christey> CALDERA:CSSA-2002-055.0 Christey> AIXAPAR:IY34194 URL:http://archives.neohapsis.com/archives/aix/2002-q4/0002.html CONECTIVA:CLA-2002:535 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000535 ====================================================== Candidate: CAN-2002-0392 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020726 Assigned: 20020530 Category: SF Reference: CONFIRM:http://httpd.apache.org/info/security_bulletin_20020617.txt Reference: VULNWATCH:20020617 [VulnWatch] Apache httpd: vulnerability with chunked encoding Reference: ISS:20020617 Remote Compromise Vulnerability in Apache HTTP Server Reference: BUGTRAQ:20020617 Re: ISS Advisory: Remote Compromise Vulnerability in Apache HTTP Server Reference: BUGTRAQ:20020617 Re: Remote Compromise Vulnerability in Apache HTTP Server Reference: BUGTRAQ:20020618 Fixed version of Apache 1.3 available Reference: BUGTRAQ:20020619 Implications of Apache vuln for Oracle Reference: BUGTRAQ:20020619 Remote Apache 1.3.x Exploit Reference: BUGTRAQ:20020620 Apache Exploit Reference: BUGTRAQ:20020620 TSLSA-2002-0056 - apache Reference: BUGTRAQ:20020621 [SECURITY] Remote exploit for 32-bit Apache HTTP Server known Reference: URL:http://online.securityfocus.com/archive/1/278149 Reference: BUGTRAQ:20020622 Ending a few arguments with one simple attachment. Reference: BUGTRAQ:20020622 blowchunks - protecting existing apache servers until upgrades arrive Reference: CERT:CA-2002-17 Reference: URL:http://www.cert.org/advisories/CA-2002-17.html Reference: SGI:20020605-01-A Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020605-01-A Reference: SGI:20020605-01-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I Reference: REDHAT:RHSA-2002:103 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-103.html Reference: MANDRAKE:MDKSA-2002:039 Reference: CALDERA:CSSA-2002-029.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt Reference: CALDERA:CSSA-2002-SCO.31 Reference: URL:ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31 Reference: CALDERA:CSSA-2002-SCO.32 Reference: URL:ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32 Reference: COMPAQ:SSRT2253 Reference: CONECTIVA:CLSA-2002:498 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498 Reference: DEBIAN:DSA-131 Reference: URL:http://www.debian.org/security/2002/dsa-131 Reference: DEBIAN:DSA-132 Reference: URL:http://www.debian.org/security/2002/dsa-132 Reference: DEBIAN:DSA-133 Reference: URL:http://www.debian.org/security/2002/dsa-133 Reference: ENGARDE:ESA-20020619-014 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2137.html Reference: REDHAT:RHSA-2002:118 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-118.html Reference: REDHAT:RHSA-2002:117 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-117.html Reference: BUGTRAQ:20020619 [OpenPKG-SA-2002.004] OpenPKG Security Advisory (apache) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0235.html Reference: BUGTRAQ:20020621 [slackware-security] new apache/mod_ssl packages available Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0266.html Reference: SUSE:SuSE-SA:2002:022 Reference: URL:http://www.suse.com/de/security/2002_22_apache.html Reference: CERT-VN:VU#944335 Reference: URL:http://www.kb.cert.org/vuls/id/944335 Reference: HP:HPSBTL0206-049 Reference: URL:http://online.securityfocus.com/advisories/4240 Reference: HP:HPSBUX0207-197 Reference: URL:http://online.securityfocus.com/advisories/4257 Reference: BID:5033 Reference: URL:http://online.securityfocus.com/bid/5033 Reference: XF:apache-chunked-encoding-bo(9249) Reference: URL:http://www.iss.net/security_center/static/9249.php Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size. Modifications: ADDREF CALDERA:CSSA-2002-029.0 ADDREF CALDERA:CSSA-2002-SCO.31 ADDREF CALDERA:CSSA-2002-SCO.32 ADDREF COMPAQ:SSRT2253 ADDREF CONECTIVA:CLSA-2002:498 ADDREF DEBIAN:DSA-131 ADDREF DEBIAN:DSA-132 ADDREF DEBIAN:DSA-133 ADDREF ENGARDE:ESA-20020619-014 ADDREF REDHAT:RHSA-2002:118 ADDREF REDHAT:RHSA-2002:117 ADDREF BUGTRAQ:20020619 [OpenPKG-SA-2002.004] OpenPKG Security Advisory (apache) ADDREF BUGTRAQ:20020621 [slackware-security] new apache/mod_ssl packages available ADDREF SUSE:SuSE-SA:2002:022 ADDREF CERT-VN:VU#944335 ADDREF HP:HPSBTL0206-049 ADDREF HP:HPSBUX0207-197 ADDREF BID:5033 ADDREF XF:apache-chunked-encoding-bo(9249) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0392 ACCEPT (5 accept, 11 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Foat, Cole NOOP(1) Christey Voter Comments: Christey> CALDERA:CSSA-2002-029.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt CALDERA:CSSA-2002-SCO.31 URL:ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31 CALDERA:CSSA-2002-SCO.32 URL:ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32 COMPAQ:SSRT2253 CONECTIVA:CLSA-2002:498 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498 DEBIAN:DSA-131 URL:http://www.debian.org/security/2002/dsa-131 DEBIAN:DSA-132 URL:http://www.debian.org/security/2002/dsa-132 DEBIAN:DSA-133 URL:http://www.debian.org/security/2002/dsa-133 ENGARDE:ESA-20020619-014 URL:http://www.linuxsecurity.com/advisories/other_advisory-2137.html REDHAT:RHSA-2002:118 URL:http://rhn.redhat.com/errata/RHSA-2002-118.html REDHAT:RHSA-2002:117 URL:http://rhn.redhat.com/errata/RHSA-2002-117.html BUGTRAQ:20020619 [OpenPKG-SA-2002.004] OpenPKG Security Advisory (apache) URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0235.html BUGTRAQ:20020621 [slackware-security] new apache/mod_ssl packages available URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0266.html SUSE:SuSE-SA:2002:022 URL:http://www.suse.com/de/security/2002_22_apache.html CERT-VN:VU#944335 URL:http://www.kb.cert.org/vuls/id/944335 BID:5033 URL:http://online.securityfocus.com/bid/5033 XF:apache-chunked-encoding-bo(9249) URL:http://www.iss.net/security_center/static/9249.php HP:HPSBTL0206-049 URL:http://online.securityfocus.com/advisories/4240 HP:HPSBUX0207-197 URL:http://online.securityfocus.com/advisories/4257 ====================================================== Candidate: CAN-2002-0394 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0394 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020611 Assigned: 20020530 Category: SF Reference: ATSTAKE:A060502-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a060502-1.txt Reference: XF:redm-1050ap-insecure-passwords(9263) Reference: URL:http://www.iss.net/security_center/static/9263.php Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords. Modifications: ADDREF XF:redm-1050ap-insecure-passwords(9263) Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0394 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(2) Baker, Foat MODIFY(1) Frech NOOP(4) Cox, Wall, Cole, Armstrong Voter Comments: Frech> XF:redm-1050ap-insecure-passwords(9263) Baker> The vendor response does not dispute any of the issues, stating the remaining issues will be resolved in a future firmware update. Sounds like confirmation to me. ====================================================== Candidate: CAN-2002-0401 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0401 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020611 Assigned: 20020603 Category: SF Reference: BUGTRAQ:20020529 Potential security issues in Ethereal Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102268626526119&w=2 Reference: CONFIRM:http://www.ethereal.com/appnotes/enpa-sa-00004.html Reference: DEBIAN:DSA-130 Reference: URL:http://www.debian.org/security/2002/dsa-130 Reference: REDHAT:RHSA-2002:088 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-088.html Reference: CONECTIVA:CLSA-2002:505 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Reference: CALDERA:CSSA-2002-037.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt Reference: BID:4806 Reference: URL:http://online.securityfocus.com/bid/4806 Reference: XF:ethereal-smb-dissector-dos(9204) Reference: URL:http://www.iss.net/security_center/static/9204.php SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer. Modifications: ADDREF REDHAT:RHSA-2002:088 ADDREF XF:ethereal-smb-dissector-dos(9204) ADDREF CONECTIVA:CLSA-2002:505 ADDREF CALDERA:CSSA-2002-037.0 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0401 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong MODIFY(2) Frech, Cox NOOP(2) Christey, Wall Voter Comments: Cox> ADDREF: RHSA-2002:088 Christey> Fix version: 0.9.3 is also affected (thanks to Mark Cox for noticing this) Christey> XF:ethereal-smb-dissector-dos(9204) URL:http://www.iss.net/security_center/static/9204.php CONECTIVA:CLSA-2002:505 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Frech> XF:ethereal-smb-dissector-dos(9204) Christey> CALDERA:CSSA-2002-037.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt ====================================================== Candidate: CAN-2002-0402 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0402 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020611 Assigned: 20020603 Category: SF Reference: CONFIRM:http://www.ethereal.com/appnotes/enpa-sa-00004.html Reference: DEBIAN:DSA-130 Reference: URL:http://www.debian.org/security/2002/dsa-130 Reference: BUGTRAQ:20020529 Potential security issues in Ethereal Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102268626526119&w=2 Reference: REDHAT:RHSA-2002:088 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-088.html Reference: CONECTIVA:CLSA-2002:505 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Reference: CALDERA:CSSA-2002-037.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt Reference: XF:ethereal-x11-dissector-bo(9203) Reference: URL:http://www.iss.net/security_center/static/9203.php Reference: BID:4805 Reference: URL:http://online.securityfocus.com/bid/4805 Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms. Modifications: ADDREF REDHAT:RHSA-2002:088 ADDREF CONECTIVA:CLSA-2002:505 ADDREF XF:ethereal-x11-dissector-bo(9203) ADDREF CALDERA:CSSA-2002-037.0 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0402 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong MODIFY(2) Frech, Cox NOOP(2) Christey, Wall Voter Comments: Cox> ADDREF: RHSA-2002:088 Christey> Fix version: 0.9.3 is also affected (thanks to Mark Cox for noticing this) Christey> XF:ethereal-x11-dissector-bo(9203) URL:http://www.iss.net/security_center/static/9203.php CONECTIVA:CLSA-2002:505 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Frech> XF:ethereal-x11-dissector-bo(9203) Christey> CALDERA:CSSA-2002-037.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt ====================================================== Candidate: CAN-2002-0403 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0403 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020611 Assigned: 20020603 Category: SF Reference: CONFIRM:http://www.ethereal.com/appnotes/enpa-sa-00004.html Reference: DEBIAN:DSA-130 Reference: URL:http://www.debian.org/security/2002/dsa-130 Reference: BUGTRAQ:20020529 Potential security issues in Ethereal Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102268626526119&w=2 Reference: REDHAT:RHSA-2002:088 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-088.html Reference: CONECTIVA:CLSA-2002:505 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Reference: CALDERA:CSSA-2002-037.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt Reference: BID:4807 Reference: URL:http://online.securityfocus.com/bid/4807 Reference: XF:ethereal-dns-dissector-dos(9205) Reference: URL:http://www.iss.net/security_center/static/9205.php DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop. Modifications: ADDREF REDHAT:RHSA-2002:088 ADDREF CONECTIVA:CLSA-2002:505 ADDREF XF:ethereal-dns-dissector-dos(9205) ADDREF CALDERA:CSSA-2002-037.0 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0403 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong MODIFY(2) Frech, Cox NOOP(2) Christey, Wall Voter Comments: Cox> ADDREF: RHSA-2002:088 Christey> Fix version: 0.9.3 is also affected (thanks to Mark Cox for noticing this) Christey> XF:ethereal-dns-dissector-dos(9205) URL:http://www.iss.net/security_center/static/9205.php CONECTIVA:CLSA-2002:505 URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Frech> XF:ethereal-dns-dissector-dos(9205) Christey> CALDERA:CSSA-2002-037.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt ====================================================== Candidate: CAN-2002-0404 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0404 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020611 Assigned: 20020603 Category: SF Reference: CONFIRM:http://www.ethereal.com/appnotes/enpa-sa-00004.html Reference: DEBIAN:DSA-130 Reference: URL:http://www.debian.org/security/2002/dsa-130 Reference: BUGTRAQ:20020529 Potential security issues in Ethereal Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102268626526119&w=2 Reference: REDHAT:RHSA-2002:088 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-088.html Reference: CONECTIVA:CLSA-2002:505 Reference: URL:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000505 Reference: CALDERA:CSSA-2002-037.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt Reference: BID:4808 Reference: URL:http://online.securityfocus.com/bid/4808 Reference: XF:ethereal-giop-dissector-dos(9206) Reference: URL:http://www.iss.net/security_center/static/9206.php Vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption). Modifications: ADDREF REDHAT:RHSA-2002:088 ADDREF CONECTIVA:CLSA-2002:505 ADDREF XF:ethereal-giop-dissector-dos(9206) ADDREF CALDERA:CSSA-2002-037.0 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0404 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong MODIFY(2) Frech, Cox NOOP(2) Christey, Wall Voter Comments: Cox> ADDREF: RHSA-2002:088 Christey> Fix version: 0.9.3 is also affected (thanks to Mark Cox for noticing this) Christey> XF:ethereal-giop-dissector-dos(9206) URL:http://www.iss.net/security_center/static/9206.php Frech> XF:ethereal-giop-dissector-dos(9206) Christey> CALDERA:CSSA-2002-037.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-037.0.txt ====================================================== Candidate: CAN-2002-0406 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0406 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020302 Denial of Service in Sphereserver Reference: URL:http://online.securityfocus.com/archive/1/259334 Reference: XF:sphereserver-connections-dos(8338) Reference: URL:http://www.iss.net/security_center/static/8338.php Reference: BID:4258 Reference: URL:http://www.securityfocus.com/bid/4258 Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials, which prevents other users from being able to log in. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0406 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0412 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0412 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020304 [H20020304]: Remotely exploitable format string vulnerability in ntop Reference: URL:http://online.securityfocus.com/archive/1/259642 Reference: BUGTRAQ:20020411 ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101854261030453&w=2 Reference: BUGTRAQ:20020411 re: gobbles ntop alert Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101856541322245&w=2 Reference: BUGTRAQ:20020417 segfault in ntop Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101908224609740&w=2 Reference: VULNWATCH:20020304 [VulnWatch] [H20020304]: Remotely exploitable format string vulnerability in ntop Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0056.html Reference: CONFIRM:http://snapshot.ntop.org/ Reference: MISC:http://listmanager.unipi.it/pipermail/ntop-dev/2002-February/000489.html Reference: XF:ntop-traceevent-format-string(8347) Reference: URL:http://www.iss.net/security_center/static/8347.php Reference: BID:4225 Reference: URL:http://www.securityfocus.com/bid/4225 Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote attackers to execute arbitrary code by causing format strings to be injected into calls to the syslog function, via (1) an HTTP GET request, (2) a user name in HTTP authentication, or (3) a password in HTTP authentication. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: On the front page, the vendor has an item dated March 5, 2002, which states "A security exposure (remote code execution) in ntop was reported to bugtraq (bugtraq@securityfocus.com) by 'hologram'" - the original discloser to Bugtraq. INFERRED ACTION: CAN-2002-0412 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Frech, Wall, Cole, Alderson MODIFY(1) Cox NOOP(1) Foat Voter Comments: Cox> I believe this only apples to ntop version 2 not version 1 ====================================================== Candidate: CAN-2002-0414 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0414 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020304 BSD: IPv4 forwarding doesn't consult inbound SPD in KAME-derived IPsec Reference: URL:http://www.securityfocus.com/archive/1/259598 Reference: CONFIRM:http://orange.kame.net/dev/cvsweb.cgi/kame/CHANGELOG Reference: BID:4224 Reference: URL:http://www.securityfocus.com/bid/4224 Reference: XF:kame-forged-packet-forwarding(8416) Reference: URL:http://www.iss.net/security_center/static/8416.php Reference: VULNWATCH:20020304 [VulnWatch] BSD: IPv4 forwarding doesn't consult inbound SPD in KAME-derived IPsec Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0057.html KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: In a changelog item dated "Mon Feb 25 2:00:06 2002," the vendor says "enforce ipsec policy checking on forwarding case" and credits the Bugtraq poster. INFERRED ACTION: CAN-2002-0414 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0423 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0423 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020306 efingerd remote buffer overflow and a dangerous feature Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html Reference: CONFIRM:http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.5.tar.gz Reference: BID:4239 Reference: URL:http://www.securityfocus.com/bid/4239 Reference: XF:efingerd-reverse-lookup-bo(8380) Reference: URL:http://www.iss.net/security_center/static/8380.php Buffer overflow in efingerd 1.5 and earlier, and possibly up to 1.61, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a finger request from an IP address with a long hostname that is obtained via a reverse DNS lookup. Analysis -------- Vendor Acknowledgement: yes patch ACKNOWLEDGEMENT: an examination of the source code for 1.6.2 has a child.c file, dated several weeks after initial disclosure, whose only change was to terminate the string that is copied. But the source code shows a strncpy call, as opposed to a strcpy as claimed by the discloser. Looking back at the source code for older versions, it appears that the first attempt to fix the overflow was made in version 1.5, where the strcpy was replaced by strncpy. However, since the string was not null terminated until 1.6.2, the discloser may have believed that the overflow still existed since they were probably still able to at least trigger a crash. It is unclear whether the unterminated string in versions 1.5 through 1.6.2 is actually exploitable. INFERRED ACTION: CAN-2002-0423 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0424 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0424 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020306 efingerd remote buffer overflow and a dangerous feature Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html Reference: CONFIRM:http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.6.2.tar.gz Reference: BID:4240 Reference: URL:http://www.securityfocus.com/bid/4240 Reference: XF:efingerd-file-execution(8381) Reference: URL:http://www.iss.net/security_center/static/8381.php efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor acknowledges but does not fix the problem in 1.6.2. The README file for efingerd 1.6.2 includes a new "Security Notes" section that states: "unless run with option -u, efingerd executes ... [the .efingerd file] under the same UID as the efingerd daemon... This means that users could gain access to this UID very easily." For the purposes of CVE, vendor acknowledgement is all that is necessary. INFERRED ACTION: CAN-2002-0424 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0425 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0425 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020306 mIRC DCC Server Security Flaw Reference: URL:http://online.securityfocus.com/archive/1/260244 Reference: XF:mirc-dcc-reveal-info(8393) Reference: URL:http://www.iss.net/security_center/static/8393.php Reference: BID:4247 Reference: URL:http://www.securityfocus.com/bid/4247 mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0425 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0429 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0429 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020308 linux <=2.4.18 x86 traps.c problem Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101561298818888&w=2 Reference: CONFIRM:http://www.openwall.com/linux/ Reference: REDHAT:RHSA-2002:158 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-158.html Reference: BID:4259 Reference: URL:http://online.securityfocus.com/bid/4259 Reference: XF:linux-ibcs-lcall-process(8420) Reference: URL:http://www.iss.net/security_center/static/8420.php The iBCS routines in arch/i386/kernel/traps.c for Linux kernels 2.4.18 and earlier on x86 systems allow local users to kill arbitrary processes via a a binary compatibility interface (lcall). Modifications: ADDREF REDHAT:RHSA-2002:158 ADDREF XF:linux-ibcs-lcall-process(8420) Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: the Openwall home page has an item dated March 3, 2002, which states "Linux 2.2.20-ow2 fixes an x86-specific vulnerability in the Linux kernel discovered by Stephan Springl where local users could abuse a binary compatibility interface (lcall) to kill processes not belonging to them ." INFERRED ACTION: CAN-2002-0429 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Alderson MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:linux-ibcs-lcall-process(8420) CHANGE> [Cox changed vote from REVIEWING to ACCEPT] Cox> Addref: RHSA-2002:158 ====================================================== Candidate: CAN-2002-0431 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0431 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020309 xtux server DoS. Reference: URL:http://online.securityfocus.com/archive/1/260912 Reference: MISC:https://sourceforge.net/tracker/index.php?func=detail&aid=529046&group_id=206&atid=100206 Reference: BID:4260 Reference: URL:http://www.securityfocus.com/bid/4260 Reference: XF:xtux-server-dos(8422) Reference: URL:http://www.iss.net/security_center/static/8422.php XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection. Analysis -------- Vendor Acknowledgement: ACKNOWLEDGEMENT: as of this writing (20020514), a bug report was filed on 20020319, but the vendor had not responded. INFERRED ACTION: CAN-2002-0431 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cole, Alderson NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0435 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0435 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020310 GNU fileutils - recursive directory removal race condition Reference: URL:http://www.securityfocus.com/archive/1/260936 Reference: CONFIRM:http://mail.gnu.org/archive/html/bug-fileutils/2002-03/msg00028.html Reference: CALDERA:CSSA-2002-018.1 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-018.1.txt Reference: XF:gnu-fileutils-race-condition(8432) Reference: URL:http://www.iss.net/security_center/static/8432.php Reference: BID:4266 Reference: URL:http://www.securityfocus.com/bid/4266 Reference: MANDRAKE:MDKSA-2002:031 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-031.php Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted, which causes fileutils to chdir to a ".." directory that is higher than expected, possibly up to the root file system. Modifications: ADDREF MANDRAKE:MDKSA-2002:032 CHANGEREF CONFIRM [URL changed] CHANGEREF MANDRAKE [wrong number] Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0435 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Green, Baker, Cox, Foat, Cole NOOP(2) Christey, Wall Voter Comments: Christey> MANDRAKE:MDKSA-2002:032 CHANGE> [Cox changed vote from REVIEWING to ACCEPT] Cox> CONFIRM:http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html is a dead link, I traced the message to the new live link here http://mail.gnu.org/archive/html/bug-fileutils/2002-03/msg00028.html Christey> Mandrake reference should be MANDRAKE:MDKSA-2002:031 (032 is for tcpdump) ====================================================== Candidate: CAN-2002-0437 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0437 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020311 SMStools vulnerabilities in release before 1.4.8 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0103.html Reference: CONFIRM:http://www.isis.de/members/~s.frings/smstools/history.html Reference: BID:4268 Reference: URL:http://www.securityfocus.com/bid/4268 Reference: XF:sms-tools-format-string(8433) Reference: URL:http://www.iss.net/security_center/static/8433.php Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, as described with the term "string format vulnerability" by some sources. Analysis -------- Vendor Acknowledgement: yes changelog ACCURACY: The original discloser (probably a non-native English speaker) says the problem is due to "string format vulnerabilities," which makes it sound like format string vulnerabilities; but the impact is described as "arbitrary command injection," and the vendor's change log says "disable execution of programs by using backquotes in the message text," which makes it sound like a shell metacharacter problem. In addition, a source code review of 1.4.9 indicates that the problem is with shell metacharacters. getSMSdata() in smsd.c removes the quote from a text field, which is then provided to sendsms(), which is then fed into my_system(), which then calls system(). A followup email to the discloser confirms that the discloser was dealing with a metacharacter issue. ACKNOWLEDGEMENT: In a "thanks" page, the vendor credits the researcher, and in the change log, described security issues that match the dates and affected versions from the initial disclosure. INFERRED ACTION: CAN-2002-0437 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0441 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0441 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020311 Directory traversal vulnerability in phpimglist Reference: URL:http://www.securityfocus.com/archive/1/261221 Reference: CONFIRM:http://www.liquidpulse.net/get.lp?id=17 Reference: XF:phpimglist-dot-directory-traversal(8441) Reference: URL:http://www.iss.net/security_center/static/8441.php Reference: BID:4276 Reference: URL:http://www.securityfocus.com/bid/4276 Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a .. (dot dot) in the cwd parameter. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: The CHANGELOG for version 1.2.2 identifies a bug fix that "stops people from browsing outside of your specified directory." INFERRED ACTION: CAN-2002-0441 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0442 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0442 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: Reference: CALDERA:CSSA-2002-SCO.8 Reference: URL:ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.8/CSSA-2002-SCO.8.txt Reference: XF:openserver-dlvraudit-bo(8442) Reference: URL:http://www.iss.net/security_center/static/8442.php Reference: BID:4273 Reference: URL:http://www.securityfocus.com/bid/4273 Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0442 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0451 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0451 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020313 Command execution in phprojekt. Reference: URL:http://www.securityfocus.com/archive/1/261676 Reference: CONFIRM:http://www.phprojekt.com/modules.php?op=modload&name=News&file=article&sid=19&mode=&order= Reference: BID:4284 Reference: URL:http://www.securityfocus.com/bid/4284 Reference: XF:phpprojekt-filemanager-include-files(8448) Reference: URL:http://www.iss.net/security_center/static/8448.php filemanager_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0451 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0454 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0454 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020315 Bug in QPopper (All Versions?) Reference: URL:http://www.securityfocus.com/archive/1/262213 Reference: CONFIRM:ftp://ftp.qualcomm.com/eudora/servers/unix/popper/qpopper4.0.4.tar.gz Reference: XF:qpopper-qpopper-dos(8458) Reference: URL:http://www.iss.net/security_center/static/8458.php Reference: BID:4295 Reference: URL:http://www.securityfocus.com/bid/4295 Reference: CALDERA:CSSA-2002-SCO.20 Reference: URL:ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.20 Qpopper (aka in.qpopper or popper) 4.0.3 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a very large string, which causes an infinite loop. Modifications: ADDREF CALDERA:CSSA-2002-SCO.20 Analysis -------- Vendor Acknowledgement: yes patch ACKNOWLEDGEMENT: the change log for version 4.0.4 says "Fixed DOS attack seen on some systems," but the description itself is too vague to be certain that the vendor has fixed *this* issue. However, a diff of popper/popper.c in versions 4.0.4 and 4.0.3 reveals a new comment: "getline() now clears out storage buffer when giving up after discarding bytes. Fixes looping DOS attack seen on some systems." That would be consistent with the behavior that was originally reported. INFERRED ACTION: CAN-2002-0454 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Wall, Cole NOOP(3) Christey, Cox, Foat Voter Comments: Christey> CALDERA:CSSA-2002-SCO.20 ====================================================== Candidate: CAN-2002-0462 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0462 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020318 [ARL02-A11] Big Sam (Built-In Guestbook Stand-Alone Module) Multiple Vulnerabilities Reference: URL:http://www.securityfocus.com/archive/1/262735 Reference: CONFIRM:http://www.gezzed.net/bigsam/bigsam.1_1_12.php.txt Reference: XF:bigsam-displaybegin-dos(8478) Reference: URL:http://www.iss.net/security_center/static/8478.php Reference: XF:bigsam-safemode-path-disclosure(8479) Reference: URL:http://www.iss.net/security_center/static/8479.php Reference: BID:4312 Reference: URL:http://www.securityfocus.com/bid/4312 bigsam_guestbook.php for Big Sam (Built-In Guestbook Stand-Alone Module) 1.1.08 and earlier allows remote attackers to cause a denial of service (CPU consumption) or obtain the absolute path of the web server via a displayBegin parameter with a very large number, which leaks the web path in an error message when PHP safe_mode is enabled, or consumes resources when safe_mode is not enabled. Modifications: DESC rephrase to clarify Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: in the source code for the program, the vendor has a comment that states "Checks if $displayBegin is not too large," and credits the discloser. INFERRED ACTION: CAN-2002-0462 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0463 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0463 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020319 Re: [ARL02-A07] ARSC Really Simple Chat System Information Path Disclosure Vulnerability Reference: URL:http://www.securityfocus.com/archive/1/262802 Reference: BUGTRAQ:20020316 [ARL02-A07] ARSC Really Simple Chat System Information Path Disclosure Vulnerability Reference: URL:http://www.securityfocus.com/archive/1/262652 Reference: BID:4307 Reference: URL:http://www.securityfocus.com/bid/4307 Reference: XF:arsc-language-path-disclosure(8472) Reference: URL:http://www.iss.net/security_center/static/8472.php home.php in ARSC (Really Simple Chat) 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an invalid language in the arsc_language parameter, which leaks the pathname in an error message. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0463 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0464 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0464 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020318 Hosting Directory Traversal madness... Reference: URL:http://www.securityfocus.com/archive/1/262734 Reference: CONFIRM:http://www.hostingcontroller.com/english/patches/ForAll/download/dot-slash.zip Reference: BID:4311 Reference: URL:http://www.securityfocus.com/bid/4311 Directory traversal vulnerability in Hosting Controller 1.4.1 and earlier allows remote attackers to read and modify arbitrary files and directories via a .. (dot dot) in arguments to (1) file_editor.asp, (2) folderactions.asp, or (3) editoractions.asp. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the readme.txt file in a patch labeled "Infamous Dot-Slash Bug Fix," dated March 22, 2002, states: "Folder Manager was vulnerable to infamous ../ bug, if an alternate path was sent using the query string variables, the altered path could be deleted or renamed." ABSTRACTION: Although another directory traversal vulnerability was discovered shortly before this one (January 2002), CD:SF-LOC suggests keeping separate CVE items for them because separate patches were produced. INFERRED ACTION: CAN-2002-0464 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0473 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0473 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: VULN-DEV:20020318 phpBB2 remote execution command Reference: URL:http://online.securityfocus.com/archive/82/262600 Reference: BUGTRAQ:20020318 Re: phpBB2 remote execution command (fwd) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0221.html Reference: BUGTRAQ:20020318 phpBB2 remote execution command Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0229.html Reference: CONFIRM:http://prdownloads.sourceforge.net/phpbb/phpBB-2.0.1.zip Reference: MISC:http://phpbb.sourceforge.net/phpBB2/viewtopic.php?t=9483 Reference: BID:4380 Reference: URL:http://www.securityfocus.com/bid/4380 Reference: XF:phpbb-db-command-execution(8476) Reference: URL:http://www.iss.net/security_center/static/8476.php db.php in phBB 2.0 (aka phBB2) RC-3 and earlier allows remote attackers to execute arbitrary code from remote servers via the phpbb_root_path parameter. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: a followup post to Bugtraq points to a URL that could contain acknowledgement, but no longer exists. A post from the developer to a web forum, dated March 23, 2002, is titled "Security vulnerability in phpBB 2.0" and implies that any "CVS version dated before March 19th 2002" is vulnerable. The comments in the changelog in docs/README.html say that version RC4 "Addressed serious security issue with included files," which would be consistent with the slightly vague Bugtraq post, which says "some backdoor server [is] needed to launch the attack," which implies that the problem is in PHP include files or the rough equivalent. A "diff" between 2.0.1 and 2.0.0 RC3 indicates that the only change to db.php was a check for the IN_PHPBB variable, which (a) does not exist in RC3, (b) is defined in all top-level PHP programs in 2.0.1, and (c) dies with the phrase "Hacking attempt" if IN_PHPBB is not defined. INFERRED ACTION: CAN-2002-0473 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0484 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0484 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020321 Re: move_uploaded_file breaks safe_mode restrictions in PHP Reference: URL:http://online.securityfocus.com/archive/1/263259 Reference: BUGTRAQ:20020317 move_uploaded_file breaks safe_mode restrictions in PHP Reference: URL:http://online.securityfocus.com/archive/1/262999 Reference: BUGTRAQ:20020322 Re: move_uploaded_file breaks safe_mode restrictions in PHP Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101683938806677&w=2 Reference: CONFIRM:http://bugs.php.net/bug.php?id=16128 Reference: XF:php-moveuploadedfile-create-files(8591) Reference: URL:http://www.iss.net/security_center/static/8591.php Reference: BID:4325 Reference: URL:http://www.securityfocus.com/bid/4325 move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0484 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Cox, Cole NOOP(2) Wall, Foat Voter Comments: CHANGE> [Cox changed vote from REVIEWING to ACCEPT] ====================================================== Candidate: CAN-2002-0488 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0488 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020321 PHP script: Penguin Traceroute, Remote Command Execution Reference: URL:http://www.securityfocus.com/archive/1/263285 Reference: CONFIRM:http://www.linux-directory.com/scripts/traceroute.pl Reference: XF:penguin-traceroute-command-execution(8600) Reference: URL:http://www.iss.net/security_center/static/8600.php Reference: BID:4332 Reference: URL:http://www.securityfocus.com/bid/4332 Linux Directory Penguin traceroute.pl CGI script 1.0 allows remote attackers to execute arbitrary code via shell metacharacters in the host parameter. Analysis -------- Vendor Acknowledgement: yes patch ACKNOWLEDGEMENT: in the source code, the vendor cleanses the host parameter, adding a comment dated 20020321 that says the line was added. INFERRED ACTION: CAN-2002-0488 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Green, Baker, Wall, Foat, Cole NOOP(1) Cox ====================================================== Candidate: CAN-2002-0490 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0490 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020323 Instant Web Mail additional POP3 commands and mail headers Reference: URL:http://www.securityfocus.com/archive/1/264041 Reference: CONFIRM:http://instantwebmail.sourceforge.net/#changeLog Reference: XF:instant-webmail-pop-commands(8650) Reference: URL:http://www.iss.net/security_center/static/8650.php Reference: BID:4361 Reference: URL:http://www.securityfocus.com/bid/4361 Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the change log for version 0.60, dated March 17, 2002, says "For security reasons it is no longer possible to write extra headers besides the normal ones when composing messages." INFERRED ACTION: CAN-2002-0490 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0493 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0493 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020325 re: Tomcat Security Exposure Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101709002410365&w=2 Reference: MISC:http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail@icarus.apache.org%3E Reference: XF:tomcat-xml-bypass-restrictions(9863) Reference: URL:http://www.iss.net/security_center/static/9863.php Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions. Modifications: ADDREF XF:tomcat-xml-bypass-restrictions(9863) Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0493 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: CHANGE> [Frech changed vote from REVIEWING to MODIFY] Frech> XF:tomcat-xml-bypass-restrictions(9863) ====================================================== Candidate: CAN-2002-0494 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0494 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020325 WebSight Directory System: cross-site-scripting bug Reference: URL:http://www.securityfocus.com/archive/1/263914 Reference: CONFIRM:http://sourceforge.net/forum/forum.php?forum_id=163389 Reference: BID:4357 Reference: URL:http://www.securityfocus.com/bid/4357 Reference: XF:websight-directory-system-css(8624) Reference: URL:http://www.iss.net/security_center/static/8624.php Cross-site scripting vulnerability in WebSight Directory System 0.1 allows remote attackers to execute arbitrary Javascript and gain access to the WebSight administrator via a new link submission containing the script in a website name. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: A news item posted by the vendor titled "Important security fix!", dated 20020325, says "the problem was that in the administration area, there was no prevention from javascripts etc to being executed," and credits the poster. INFERRED ACTION: CAN-2002-0494 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0495 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0495 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020325 CGIscript.net - csSearch.cgi - Remote Code Execution (up to 17,000 sites vulnerable) Reference: URL:http://www.securityfocus.com/archive/1/264169 Reference: MISC:http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=7 Reference: BID:4368 Reference: URL:http://www.securityfocus.com/bid/4368 Reference: XF:cssearch-url-execute-commands(8636) Reference: URL:http://www.iss.net/security_center/static/8636.php csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi. Analysis -------- Vendor Acknowledgement: unknown vague ACKNOWLEDGEMENT: On the csSearch Pro web page, the vendor states "Security Alert: We recently discovered vulnerabilities in csSearch versions 2.3 and below. Please download and install csSearch 2.5 to correct the problem." This is not enough detail to be certain that the vendor is addressing this particular vulnerability. INFERRED ACTION: CAN-2002-0495 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(3) Cox, Wall, Armstrong Voter Comments: Frech> http://online.securityfocus.com/archive/1/266432 ====================================================== Candidate: CAN-2002-0497 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0497 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020306 mtr 0.45, 0.46 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0048.html Reference: DEBIAN:DSA-124 Reference: URL:http://www.debian.org/security/2002/dsa-124 Reference: BID:4217 Reference: URL:http://www.securityfocus.com/bid/4217 Reference: XF:mtr-options-bo(8367) Reference: URL:http://www.iss.net/security_center/static/8367.php Buffer overflow in mtr 0.46 and earlier, when installed setuid root, allows local users to access a raw socket via a long MTR_OPTIONS environment variable. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0497 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cox, Cole NOOP(2) Wall, Foat ====================================================== Candidate: CAN-2002-0501 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0501 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020327 Format String Bug in Posadis DNS Server Reference: URL:http://online.securityfocus.com/archive/1/264450 Reference: CONFIRM:http://sourceforge.net/forum/forum.php?forum_id=165094 Reference: XF:posadis-logging-format-string(8653) Reference: URL:http://www.iss.net/security_center/static/8653.php Reference: BID:4378 Reference: URL:http://www.securityfocus.com/bid/4378 Format string vulnerability in log_print() function of Posadis DNS server before version m5pre2 allows local users and possibly remote attackers to execute arbitrary code via format strings that are inserted into logging messages. Modifications: DESC fix typo Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: a vendor announcement fixes the vulnerability "As reported on Bugtraq March 27 2002." INFERRED ACTION: CAN-2002-0501 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Frech, Foat, Cole, Armstrong NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0505 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0505 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CISCO:20020327 LDAP Connection Leak in CTI when User Authentication Fails Reference: URL:http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml Reference: XF:cisco-cti-memory-leak(8655) Reference: URL:http://www.iss.net/security_center/static/8655.php Reference: BID:4370 Reference: URL:http://www.securityfocus.com/bid/4370 Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures, e.g. via incorrect passwords. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0505 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0506 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0506 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020328 A possible buffer overflow in libnewt Reference: URL:http://online.securityfocus.com/archive/1/264699 Reference: XF:libnewt-bo(8700) Reference: URL:http://www.iss.net/security_center/static/8700.php Reference: BID:4393 Reference: URL:http://www.securityfocus.com/bid/4393 Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execute arbitrary code in setuid programs that use libnewt. Modifications: DESC emphasize setuid programs only Analysis -------- Vendor Acknowledgement: yes cve-vote INFERRED ACTION: CAN-2002-0506 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Frech, Cox, Cole NOOP(3) Wall, Foat, Armstrong Voter Comments: Cox> (although only really a problem if you have setuid programs that use libnewt) ====================================================== Candidate: CAN-2002-0511 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0511 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CALDERA:CSSA-2002-013.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2002-013.0.txt Reference: XF:nscd-dns-ptr-validation(8745) Reference: URL:http://www.iss.net/security_center/static/8745.php Reference: BID:4399 Reference: URL:http://www.securityfocus.com/bid/4399 The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulting the authoritative DNS server for the A record, which could make it easier for remote attackers to bypass applications that restrict access based on host names. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0511 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Frech, Foat, Cole, Armstrong NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0512 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0512 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CALDERA:CSSA-2002-005.0 Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2002-005.0.txt Reference: BID:4400 Reference: URL:http://www.securityfocus.com/bid/4400 Reference: XF:kde-startkde-search-directory(8737) Reference: URL:http://www.iss.net/security_center/static/8737.php startkde in KDE for Caldera OpenLinux 2.3 through 3.1.1 sets the LD_LIBRARY_PATH environment variable to include the current working directory, which could allow local users to gain privileges of other users running startkde via Trojan horse libraries. Modifications: ADDREF XF:kde-startkde-search-directory(8737) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0512 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Frech> XF:kde-startkde-search-directory(8737) Christey> There's a long history of overflows via long -xrm arguments. Need to make sure there's no overlap with other separate vulnerability reports. ====================================================== Candidate: CAN-2002-0513 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0513 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020330 popper_mod 1.2.1 and previous accounts compromise Reference: URL:http://online.securityfocus.com/archive/1/265438 Reference: CONFIRM:http://www.symatec-computer.com/forums/viewtopic.php?t=14 Reference: XF:symatec-popper-admin-access(8746) Reference: URL:http://www.iss.net/security_center/static/8746.php Reference: BID:4412 Reference: URL:http://www.securityfocus.com/bid/4412 The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator. Analysis -------- Vendor Acknowledgement: yes INCLUSION: Whether this dependency on .htaccess is a design problem or a configuration problem, this issue meets the definition of vulnerability and should be included in CVE. INFERRED ACTION: CAN-2002-0513 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0516 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0516 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020327 squirrelmail 1.2.5 email user can execute command Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0350.html Reference: BUGTRAQ:20020331 Re: squirrelmail 1.2.5 email user can execute command Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-03/0386.html Reference: BID:4385 Reference: URL:http://www.securityfocus.com/bid/4385 Reference: XF:squirrelmail-theme-command-execution(8671) Reference: URL:http://www.iss.net/security_center/static/8671.php SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0516 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0531 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0531 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020403 emumail.cgi Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0066.html Reference: CONFIRM:http://www.emumail.com/downloads/download_unix.html/ Reference: XF:emumail-cgi-view-files(8766) Reference: URL:http://www.iss.net/security_center/static/8766.php Reference: BID:4435 Reference: URL:http://www.securityfocus.com/bid/4435 Directory traversal vulnerability in emumail.cgi in EMU Webmail 4.5.x and 5.1.0 allows remote attackers to read arbitrary files or list arbitrary directories via a .. (dot dot) in the type parameter. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: the download page for Webmail includes a statement dated April 11, 2002, which says "This patch corrects a security flaw in EMU Webmail which may allow remote users to exploit emumail.cgi under certain conditions to read files on the remote system." INFERRED ACTION: CAN-2002-0531 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0532 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0532 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020410 Re: emumail.cgi, one more local vulnerability (not verified) Reference: URL:http://online.securityfocus.com/archive/1/266930 Reference: XF:emumail-http-host-execute(8836) Reference: URL:http://www.iss.net/security_center/static/8836.php Reference: BID:4488 Reference: URL:http://www.securityfocus.com/bid/4488 EMU Webmail allows local users to execute arbitrary programs via a .. (dot dot) in the HTTP Host header that points to a Trojan horse configuration file that contains a pageroot specifier that contains shell metacharacters. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: an inquiry was posted to http://www.emumail.com/support/tech_inquiry.html on June 3, 2002. WIthin 24 hours, techprod@emumail.com confirmed the vulnerability: "Yes this has been fixed...there is an update patch for 4.5 and 5.1 on our website. Known versions that are affected are 4.5 and 5.x, 4.0 and earlier version may be affected/" INFERRED ACTION: CAN-2002-0532 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0536 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0536 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020403 SQL injection in PHPGroupware Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0036.html Reference: BUGTRAQ:20020411 Re: SQL injection in PHPGroupware Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0143.html Reference: XF:phpgroupware-sql-injection(8755) Reference: URL:http://www.iss.net/security_center/static/8755.php Reference: BID:4424 Reference: URL:http://www.securityfocus.com/bid/4424 PHPGroupware 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack. Analysis -------- Vendor Acknowledgement: yes followup INCLUSION: a followup from the vendor indicates that the issue is due to a non-default configuration of magic_quotes_gpc in phpGroupWare's configuration file. While this could be attributed to an apparent limitation of PHP itself (since the quotes apparently can't be cleanly enabled within the PHP programs themselves?), this vendor did not work around this issue, so the problem should be included in CVE. INFERRED ACTION: CAN-2002-0536 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(4) Cox, Wall, Foat, Armstrong ====================================================== Candidate: CAN-2002-0538 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0538 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020415 Raptor Firewall FTP Bounce vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0166.html Reference: BUGTRAQ:20020417 Re: Raptor Firewall FTP Bounce vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0224.html Reference: CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.04.17.html Reference: XF:raptor-firewall-ftp-bounce(8847) Reference: URL:http://www.iss.net/security_center/static/8847.php Reference: BID:4522 Reference: URL:h ttp://www.securityfocus.com/bid/4522 FTP proxy in Symantec Raptor Firewall 6.5.3 and Enterprise 7.0 rewrites an FTP server's "FTP PORT" responses in a way that allows remote attackers to redirect FTP data connections to arbitrary ports, a variant of the "FTP bounce" vulnerability. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0538 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0539 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0539 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020415 Demarc PureSecure 1.05 may be other (user can bypass login) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0168.html Reference: BUGTRAQ:20020417 Demarc Security Update Advisory Reference: URL:http://online.securityfocus.com/archive/1/267941 Reference: XF:puresecure-sql-injection(8854) Reference: URL:http://www.iss.net/security_center/static/8854.php Reference: BID:4520 Reference: URL:http://www.securityfocus.com/bid/4520 Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0539 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0542 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0542 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020411 local root compromise in openbsd 3.0 and below Reference: URL:http://online.securityfocus.com/archive/1/267089 Reference: BUGTRAQ:20020411 OpenBSD Local Root Compromise Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101855467811695&w=2 Reference: CONFIRM:http://www.openbsd.org/errata30.html#mail Reference: XF:openbsd-mail-root-privileges(8818) Reference: URL:http://www.iss.net/security_center/static/8818.php Reference: BID:4495 Reference: URL:http://www.securityfocus.com/bid/4495 mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0542 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0543 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0543 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020409 Abyss Webserver 1.0 Administration password file retrieval exploit Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0110.html Reference: CONFIRM:http://www.aprelium.com/forum/viewtopic.php?t=24 Reference: BID:4466 Reference: URL:http://www.securityfocus.com/bid/4466 Reference: XF:abyss-unicode-directory-traversal(8805) Reference: URL:http://www.iss.net/security_center/static/8805.php Directory traversal vulnerability in Aprelium Abyss Web Server (abyssws) before 1.0.0.2 allows remote attackers to read files outside the web root, including the abyss.conf file, via URL-encoded .. (dot dot) sequences in the HTTP request. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: a posting to a vendor forum titled "Patched release 1.0.0.2" and dated 20020408 says that the patch is "against some form of dot-dot URLs refering to an aliased directory and that can allow people to read abyss.conf file." INFERRED ACTION: CAN-2002-0543 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0545 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0545 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: CISCO:20020409 Aironet Telnet Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/Aironet-Telnet.shtml Reference: BID:4461 Reference: URL:http://www.securityfocus.com/bid/4461 Reference: XF:cisco-aironet-telnet-dos(8788) Reference: URL:http://www.iss.net/security_center/static/8788.php Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0545 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0553 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0553 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020413 SunSop: cross-site-scripting bug Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0154.html Reference: XF:sunshop-new-cust-css(8840) Reference: URL:http://www.iss.net/security_center/static/8840.php Reference: BID:4506 Reference: URL:http://www.securityfocus.com/bid/4506 Cross-site scripting vulnerability in SunShop 2.5 and earlier allows remote attackers to gain administrative privileges to SunShop by injecting the script into fields during new customer registration. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: An e-mail inquiry sent to support@turnkeywebtools.com on June 3, 2002. A response was sent within an hour, saying "a patch was released before that vulnerability was released. If you upgrade to 2.6 you will have no worries." INFERRED ACTION: CAN-2002-0553 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0567 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0567 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020206 Remote Compromise in Oracle 9i Database Server Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101301332402079&w=2 Reference: CERT-VN:VU#180147 Reference: URL:http://www.kb.cert.org/vuls/id/180147 Reference: CERT:CA-2002-08 Reference: URL:http://www.cert.org/advisories/CA-2002-08.html Reference: CONFIRM:http://otn.oracle.com/deploy/security/pdf/plsextproc_alert.pdf Reference: BID:4033 Reference: URL:http://www.securityfocus.com/bid/4033 Reference: XF:oracle-plsql-remote-access(8089) Reference: URL:http://xforce.iss.net/static/8089.php Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0567 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Frech, Wall, Cole, Alderson NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0569 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0569 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020607 Category: SF Reference: BUGTRAQ:20020206 Hackproofing Oracle Application Server paper Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101301813117562&w=2 Reference: CERT-VN:VU#977251 Reference: URL:http://www.kb.cert.org/vuls/id/977251 Reference: CERT:CA-2002-08 Reference: URL:http://www.cert.org/advisories/CA-2002-08.html Reference: MISC:http://www.nextgenss.com/papers/hpoas.pdf Reference: BID:4298 Reference: URL:http://www.securityfocus.com/bid/4298 Reference: XF:oracle-appserver-config-file-access(8453) Reference: URL:http://www.iss.net/security_center/static/8453.php Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServlet). Modifications: ADDREF XF:oracle-appserver-config-file-access(8453) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0569 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Alderson MODIFY(1) Frech NOOP(2) Cox, Foat Voter Comments: Frech> XF:oracle-appserver-config-file-access(8453) ====================================================== Candidate: CAN-2002-0571 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0571 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020416 ansi outer join syntax in Oracle allows access to any data Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0175.html Reference: CIAC:M-071 Reference: URL:http://www.ciac.org/ciac/bulletins/m-071.shtml Reference: CONFIRM:http://otn.oracle.com/deploy/security/pdf/sql_joins_alert.pdf Reference: XF:oracle-ansi-sql-bypass-acl(8855) Reference: URL:http://www.iss.net/security_center/static/8855.php Reference: BID:4523 Reference: URL:http://www.securityfocus.com/bid/4523 Oracle Oracle9i database server 9.0.1.x allows local users to access restricted data via a SQL query using ANSI outer join syntax. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0571 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Wall, Cole NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0573 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0573 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020430 Adivosry + Exploit for Remote Root Hole in Default Installation of Popular Commercial Operating System Reference: URL:http://online.securityfocus.com/archive/1/270268 Reference: VULNWATCH:20020430 [VulnWatch] Adivosry + Exploit for Remote Root Hole in Default Installation of Popular Commercial Operating System Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0049.html Reference: CERT:CA-2002-10 Reference: URL:http://www.cert.org/advisories/CA-2002-10.html Reference: CERT-VN:VU#638099 Reference: URL:http://www.kb.cert.org/vuls/id/638099 Reference: XF:solaris-rwall-format-string(8971) Reference: URL:http://www.iss.net/security_center/static/8971.php Reference: BID:4639 Reference: URL:http://www.securityfocus.com/bid/4639 Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0573 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0574 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0574 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020611 Assigned: 20020611 Category: SF Reference: FREEBSD:FreeBSD-SA-02:21 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:21.tcpip.asc Reference: BID:4539 Reference: URL:http://www.securityfocus.com/bid/4539 Reference: XF:freebsd-icmp-echo-reply-dos(8893) Reference: URL:http://www.iss.net/security_center/static/8893.php Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_output() in which the reference count for a routing table entry is not decremented, which prevents the entry from being removed. Modifications: ADDREF XF:freebsd-icmp-echo-reply-dos(8893) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0574 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(3) Cox, Wall, Foat Voter Comments: Frech> XF:freebsd-icmp-echo-reply-dos(8893) ====================================================== Candidate: CAN-2002-0575 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0575 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020426 Revised OpenSSH Security Advisory (adv.token) Reference: URL:http://online.securityfocus.com/archive/1/269701 Reference: BUGTRAQ:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow Reference: URL:http://online.securityfocus.com/archive/1/268718 Reference: VULN-DEV:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=101924296115863&w=2 Reference: BUGTRAQ:20020517 OpenSSH 3.2.2 released (fwd) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102167972421837&w=2 Reference: BUGTRAQ:20020429 TSLSA-2002-0047 - openssh Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0394.html Reference: BUGTRAQ:20020420 OpenSSH Security Advisory (adv.token) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0298.html Reference: CALDERA:CSSA-2002-022.2 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-022.2.txt Reference: BID:4560 Reference: URL:http://www.securityfocus.com/bid/4560 Reference: XF:openssh-sshd-kerberos-bo(8896) Reference: URL:http://www.iss.net/security_center/static/8896.php Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges. Modifications: ADDREF BUGTRAQ:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow ADDREF VULN-DEV:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow ADDREF BUGTRAQ:20020517 OpenSSH 3.2.2 released (fwd) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0575 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Cox, Cole NOOP(3) Christey, Wall, Foat Voter Comments: Christey> BUGTRAQ:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow URL:http://online.securityfocus.com/archive/1/268718 VULN-DEV:20020419 OpenSSH 2.2.0 - 3.1.0 server contains a locally exploitable buffer overflow URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=101924296115863&w=2 BUGTRAQ:20020517 OpenSSH 3.2.2 released (fwd) URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102167972421837&w=2 ====================================================== Candidate: CAN-2002-0576 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0576 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020418 KPMG-2002013: Coldfusion Path Disclosure Reference: URL:http://online.securityfocus.com/archive/1/268263 Reference: VULNWATCH:20020418 [VulnWatch] KPMG-2002013: Coldfusion Path Disclosure Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0028.html Reference: CONFIRM:http://www.macromedia.com/v1/handlers/index.cfm?ID=22906 Reference: BID:4542 Reference: URL:http://www.securityfocus.com/bid/4542 Reference: XF:coldfusion-dos-device-path-disclosure(8866) Reference: URL:http://www.iss.net/security_center/static/8866.php ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0576 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Wall, Cole NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0594 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0594 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020430 RE: Reading local files in Netscape 6 and Mozilla (GM#001-NS) Reference: URL:http://online.securityfocus.com/archive/1/270249 Reference: CONECTIVA:CLA-2002:490 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000490 Reference: BID:4640 Reference: URL:http://www.securityfocus.com/bid/4640 Reference: XF:mozilla-css-files-exist(8977) Reference: URL:http://www.iss.net/security_center/static/8977.php Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to determine the existence of files on the client system via a LINK element in a Cascading Style Sheet (CSS) page that causes an HTTP redirect. Modifications: ADDREF XF:mozilla-css-files-exist(8977) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0594 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cox, Cole MODIFY(1) Frech NOOP(2) Wall, Foat Voter Comments: Frech> XF:mozilla-css-files-exist(8977) CHANGE> [Cox changed vote from REVIEWING to ACCEPT] ====================================================== Candidate: CAN-2002-0597 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0597 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020417 KPMG-2002011: Windows 2000 microsoft-ds Denial of Service Reference: URL:http://online.securityfocus.com/archive/1/268066 Reference: VULNWATCH:20020417 [VulnWatch] KPMG-2002011: Windows 2000 microsoft-ds Denial of Service Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0025.html Reference: MSKB:Q320751 Reference: URL:http://support.microsoft.com/default.aspx?scid=kb;[LN];Q320751 Reference: XF:win2k-lanman-dos(8867) Reference: URL:http://www.iss.net/security_center/static/8867.php Reference: BID:4532 Reference: URL:http://www.securityfocus.com/bid/4532 LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445. Modifications: ADDREF MSKB:Q320751 Analysis -------- Vendor Acknowledgement: yes patch ACKNOWLEDGEMENT: a number of data sources suggest that KB article Q320751 addresses this issue, and Q320751 specifically credits KPMG for the discovery. INFERRED ACTION: CAN-2002-0597 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0598 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0598 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020419 KPMG-2002014: Foundstone Fscan Format String Bug Reference: URL:http://online.securityfocus.com/archive/1/268581 Reference: VULNWATCH:20020419 [VulnWatch] KPMG-2002014: Foundstone Fscan Format String Bug Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0030.html Reference: CONFIRM:http://www.foundstone.com/knowledge/fscan112_advisory.html Reference: XF:fscan-banner-format-string(8895) Reference: URL:http://www.iss.net/security_center/static/8895.php Reference: BID:4549 Reference: URL:http://www.securityfocus.com/bid/4549 Format string vulnerability in Foundstone FScan 1.12 with banner grabbing enabled allows remote attackers to execute arbitrary code on the scanning system via format string specifiers in the server banner. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: in an advisory dated April 24, 2002, Foundstone states "Using FScan with banner selected via the -b command line switch could cause a problem if the banner received from the remote host contained C-style printf format specifiers e.g. percent symbols that matched string or numeric format specifiers." INFERRED ACTION: CAN-2002-0598 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0599 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0599 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020428 Blahz-DNS: Authentication bypass vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0395.html Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=87004 Reference: BID:4618 Reference: URL:http://www.securityfocus.com/bid/4618 Reference: XF:blahzdns-auth-bypass(8951) Reference: URL:http://www.iss.net/security_center/static/8951.php Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuff.php instead of going through the login screen. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the fix for 0.25 says "Fixed the ability to bypass login security by sending commands directly to the backend php files." INFERRED ACTION: CAN-2002-0599 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0601 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0601 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020611 Assigned: 20020611 Category: SF Reference: ISS:20020430 Remote Denial of Service Vulnerability in RealSecure Network Sensor Reference: URL:http://www.iss.net/security_center/alerts/advise116.php Reference: BUGTRAQ:20020430 ISS Advisory: Remote Denial of Service Vulnerability in RealSecure Network Sensor Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0420.html Reference: XF:rs-ns-dhcp-dos(8961) Reference: URL:http://www.iss.net/security_center/static/8961.php Reference: BID:4649 Reference: URL:http://www.securityfocus.com/bid/4649 ISS RealSecure Network Sensor 5.x through 6.5 allows remote attackers to cause a denial of service (crash) via malformed DHCP packets that cause RealSecure to dereference a null pointer. Modifications: ADDREF XF:rs-ns-dhcp-dos(8961) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0601 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole MODIFY(1) Frech NOOP(2) Cox, Foat Voter Comments: Frech> XF:rs-ns-dhcp-dos(8961) ====================================================== Candidate: CAN-2002-0605 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0605 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020503 Macromedia Flash Activex Buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102039374017185&w=2 Reference: VULN-DEV:20020503 Macromedia Flash Activex Buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102038919414726&w=2 Reference: VULNWATCH:20020502 [VulnWatch] Macromedia Flash Activex Buffer overflow Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0051.html Reference: NTBUGTRAQ:20020503 Macromedia Flash Activex Buffer overflow Reference: CONFIRM:http://www.macromedia.com/support/flash/ts/documents/buf_ovflow_623.htm Reference: XF:flash-activex-movie-bo(8993) Reference: URL:http://www.iss.net/security_center/static/8993.php Reference: BID:4664 Reference: URL:http://online.securityfocus.com/bid/4664 Buffer overflow in Flash OCX for Macromedia Flash 6 revision 23 (6,0,23,0) allows remote attackers to execute arbitrary code via a long movie parameter. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: in an online advisory dated May 6, 2002, Macromedia states "Macromedia has verified a vulnerability in the parameter handling of the Macromedia Flash Player ActiveX control, version 6,0,23,0" and includes a reference to the discloser's original advisory. INFERRED ACTION: CAN-2002-0605 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Frech, Wall, Cole, Armstrong NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0613 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0613 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020611 Assigned: 20020611 Category: SF Reference: BUGTRAQ:20020428 dnstools: authentication bypass vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0390.html Reference: CONFIRM:http://www.dnstools.com/dnstools_2.0.1.tar.gz Reference: BID:4617 Reference: URL:http://www.securityfocus.com/bid/4617 Reference: XF:dnstools-auth-bypass(8948) Reference: URL:http://www.iss.net/security_center/static/8948.php dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user_logged_in or user_dnstools_administrator parameters. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the changelog.txt for Release 2.0 Beta 5 includes an entry dated 2002-04-27 which states: "Fixed major security hole in URL spoofing. No longer trusts the variables $is_logged_in or $user_dnstools_administrator." INFERRED ACTION: CAN-2002-0613 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0616 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0616 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: MS:MS02-031 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-031.asp Reference: XF:excel-inline-macro-execution(9397) Reference: URL:http://www.iss.net/security_center/static/9397.php Reference: BID:5063 Reference: URL:http://www.securityfocus.com/bid/5063 The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro to an object within an Excel workbook, aka the "Excel Inline Macros Vulnerability." Modifications: ADDREF XF:excel-inline-macro-execution(9397) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0616 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(1) Cox ====================================================== Candidate: CAN-2002-0617 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0617 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020612 Category: SF Reference: MS:MS02-031 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-031.asp The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by creating a hyperlink on a drawing shape in a source workbook that points to a destination workbook containing an autoexecute macro, aka "Hyperlinked Excel Workbook Macro Bypass." Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0617 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(1) Cox ====================================================== Candidate: CAN-2002-0618 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0618 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: NTBUGTRAQ:20020524 Excel XP xml stylesheet problems Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102256054320377&w=2 Reference: MISC:http://www.guninski.com/ex$el2.html Reference: MS:MS02-031 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-031.asp Reference: BID:4821 Reference: URL:http://online.securityfocus.com/bid/4821 Reference: XF:excel-xsl-script-execution(9399) Reference: URL:http://www.iss.net/security_center/static/9399.php The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code in the Local Computer zone by embedding HTML scripts within an Excel workbook that contains an XSL stylesheet, aka "Excel XSL Stylesheet Script Execution". Modifications: ADDREF XF:excel-xsl-script-execution(9399) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0618 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(1) Cox ====================================================== Candidate: CAN-2002-0619 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0619 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: BUGTRAQ:20020514 dH team & SECURITY.NNOV: A variant of "Word Mail Merge" vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102139136019862&w=2 Reference: MS:MS02-031 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-031.asp Reference: XF:word-mail-merge-variant(9077) Reference: URL:http://www.iss.net/security_center/static/9077.php Reference: BID:5066 Reference: URL:http://www.securityfocus.com/bid/5066 The Mail Merge Tool in Microsoft Word 2002 for Windows, when Microsoft Access is present on a system, allows remote attackers to execute Visual Basic (VBA) scripts within a mail merge document that is saved in HTML format, aka a "Variant of MS00-071, Word Mail Merge Vulnerability" (CVE-2000-0788). Modifications: DESC rephrase ADDREF XF:word-mail-merge-variant(9077) ADDREF BID:5066 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0619 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole MODIFY(1) Foat NOOP(2) Christey, Cox Voter Comments: Foat> The candidate is technically correct, but the wording is not grammatically correct. Suggest the following: An attacker's macro code can be run automatically if the user has Microsoft Access present on the system and choses to open a mail merge document that had been saved in HTML format, aka a "Variant of MS00-071, Word Mail Merge Vulnerabilty" (CVE-2000-0788). Christey> desc: missing "*WHEN* access is present..." ====================================================== Candidate: CAN-2002-0621 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0621 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: BUGTRAQ:20020703 Remotely Exploitable Buffer Overruns in Microsoft's Commerce Server 2000/2 (#NISRNISR03062002) Reference: MS:MS02-033 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-033.asp Reference: XF:mscs-owc-installer-bo(9424) Reference: URL:http://www.iss.net/security_center/static/9424.php Reference: BID:5108 Reference: URL:http://www.securityfocus.com/bid/5108 Buffer overflow in the Office Web Components (OWC) package installer used by Microsoft Commerce Server 2000 allows remote attackers to cause the process to fail or run arbitrary code in the LocalSystem security context via certain input to the OWC package installer. Modifications: DESC fix typos ADDREF XF:mscs-owc-installer-bo(9424) ADDREF BID:5108 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0621 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> XF:mscs-owc-installer-bo(9424) URL:http://www.iss.net/security_center/static/9424.php BID:5108 URL:http://www.securityfocus.com/bid/5108 Christey> "arbitray"? "by via"? ====================================================== Candidate: CAN-2002-0622 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0622 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: BUGTRAQ:20020703 Remotely Exploitable Buffer Overruns in Microsoft's Commerce Server 2000/2 (#NISRNISR03062002) Reference: MS:MS02-033 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-033.asp Reference: XF:mscs-owc-installer-permissions(9425) Reference: URL:http://www.iss.net/security_center/static/9425.php Reference: BID:5111 Reference: URL:http://www.securityfocus.com/bid/5111 The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000 allows remote attackers to execute commands by passing the commands as input to the OWC package installer, aka "OWC Package Command Execution". Modifications: ADDREF XF:mscs-owc-installer-permissions(9425) ADDREF BID:5111 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0622 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> XF:mscs-owc-installer-permissions(9425) URL:http://www.iss.net/security_center/static/9425.php BID:5111 URL:http://www.securityfocus.com/bid/5111 ====================================================== Candidate: CAN-2002-0623 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0623 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020612 Category: SF Reference: MS:MS02-033 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-033.asp Reference: BID:5112 Reference: URL:http://www.securityfocus.com/bid/5112 Reference: XF:mscs-authfilter-isapi-bo-variant(9426) Reference: URL:http://www.iss.net/security_center/static/9426.php Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002 allows remote attackers to execute arbitrary code via long authentication data, aka "New Variant of the ISAPI Filter Buffer Overrun". Modifications: ADDREF BID:5112 ADDREF XF:mscs-authfilter-isapi-bo-variant(9426) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0623 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> BID:5112 URL:http://www.securityfocus.com/bid/5112 XF:mscs-authfilter-isapi-bo-variant(9426) URL:http://www.iss.net/security_center/static/9426.php ====================================================== Candidate: CAN-2002-0631 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0631 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020621 Category: SF Reference: SGI:20020607-02-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20020607-02-I Reference: BID:5092 Reference: URL:http://www.securityfocus.com/bid/5092 Reference: XF:irix-nveventd-file-write(9418) Reference: URL:http://www.iss.net/security_center/static/9418.php Unknown vulnerability in nveventd in NetVisualyzer on SGI IRIX 6.5 through 6.5.16 allows local users to write arbitrary files and gain root privileges. Modifications: DESC fix typo ADDREF BID:5092 ADDREF XF:irix-nveventd-file-write(9418) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0631 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> fix typo: "root root" BID:5092 URL:http://www.securityfocus.com/bid/5092 XF:irix-nveventd-file-write(9418) URL:http://www.iss.net/security_center/static/9418.php ====================================================== Candidate: CAN-2002-0638 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0638 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020830 Assigned: 20020627 Category: SF Reference: VULNWATCH:20020729 [VulnWatch] RAZOR advisory: Linux util-linux chfn local root vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0357.html Reference: BUGTRAQ:20020729 RAZOR advisory: Linux util-linux chfn local root vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102795787713996&w=2 Reference: CERT-VN:VU#405955 Reference: URL:http://www.kb.cert.org/vuls/id/405955 Reference: REDHAT:RHSA-2002:132 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-132.html Reference: REDHAT:RHSA-2002:137 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-137.html Reference: CONECTIVA:CLA-2002:523 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000523 Reference: CALDERA:CSSA-2002-043.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-043.0.txt Reference: MANDRAKE:MDKSA-2002:047 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-047.php Reference: BUGTRAQ:20020730 TSLSA-2002-0064 - util-linux Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0396.html Reference: HP:HPSBTL0207-054 Reference: URL:http://online.securityfocus.com/advisories/4320 Reference: XF:utillinux-chfn-race-condition(9709) Reference: URL:http://www.iss.net/security_center/static/9709.php Reference: BID:5344 Reference: URL:http://www.securityfocus.com/bid/5344 setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh. Modifications: ADDREF REDHAT:RHSA-2002:137 ADDREF CONECTIVA:CLA-2002:523 ADDREF CALDERA:CSSA-2002-043.0 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0638 ACCEPT (5 accept, 4 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole MODIFY(1) Cox NOOP(1) Christey Voter Comments: Cox> ADDREF:RHSA-2002:137 Christey> CONECTIVA:CLA-2002:523 Christey> CALDERA:CSSA-2002-043.0 ====================================================== Candidate: CAN-2002-0639 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0639 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020726 Assigned: 20020628 Category: SF Reference: ISS:20020626 OpenSSH Remote Challenge Vulnerability Reference: BUGTRAQ:20020626 OpenSSH Security Advisory (adv.iss) Reference: BUGTRAQ:20020626 Revised OpenSSH Security Advisory (adv.iss) Reference: BUGTRAQ:20020627 How to reproduce OpenSSH Overflow. Reference: NETBSD:2002-005 Reference: CERT-VN:VU#369347 Reference: CERT:CA-2002-18 Reference: HP:HPSBUX0206-195 Reference: CALDERA:CSSA-2002-030.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt Reference: BUGTRAQ:20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.html Reference: CONECTIVA:CLA-2002:502 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 Reference: ENGARDE:ESA-20020702-016 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2177.html Reference: MANDRAKE:MDKSA-2002:040 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:040 Reference: BID:5093 Reference: XF:openssh-challenge-response-bo(9169) Reference: URL:http://www.iss.net/security_center/static/9169.php Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication. Modifications: ADDREF CALDERA:CSSA-2002-030.0 ADDREF BUGTRAQ:20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh) ADDREF CONECTIVA:CLA-2002:502 ADDREF ENGARDE:ESA-20020702-016 ADDREF MANDRAKE:MDKSA-2002:040 ADDREF XF:openssh-challenge-response-bo(9169) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0639 ACCEPT (4 accept, 6 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Foat, Cole NOOP(2) Christey, Wall Voter Comments: Christey> CALDERA:CSSA-2002-030.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt BUGTRAQ:20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh) URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.html CONECTIVA:CLA-2002:502 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 ENGARDE:ESA-20020702-016 URL:http://www.linuxsecurity.com/advisories/other_advisory-2177.html Christey> MANDRAKE:MDKSA-2002:040 ====================================================== Candidate: CAN-2002-0640 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0640 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-02 Proposed: 20020726 Assigned: 20020628 Category: SF Reference: BUGTRAQ:20020626 Revised OpenSSH Security Advisory (adv.iss) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102514631524575&w=2 Reference: BUGTRAQ:20020626 OpenSSH Security Advisory (adv.iss) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102514371522793&w=2 Reference: BUGTRAQ:20020627 How to reproduce OpenSSH Overflow. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102521542826833&w=2 Reference: BUGTRAQ:20020628 Sun statement on the OpenSSH Remote Challenge Vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102532054613894&w=2 Reference: CERT-VN:VU#369347 Reference: URL:http://www.kb.cert.org/vuls/id/369347 Reference: CERT:CA-2002-18 Reference: URL:http://www.cert.org/advisories/CA-2002-18.html Reference: DEBIAN:DSA-134 Reference: URL:http://www.debian.org/security/2002/dsa-134 Reference: HP:HPSBUX0206-195 Reference: BID:5093 Reference: URL:http://www.securityfocus.com/bid/5093 Reference: REDHAT:RHSA-2002:131 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-131.html Reference: CALDERA:CSSA-2002-030.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt Reference: CONECTIVA:CLA-2002:502 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 Reference: ENGARDE:ESA-20020702-016 Reference: URL:http://www.linuxsecurity.com/advisories/other_advisory-2177.html Reference: MANDRAKE:MDKSA-2002:040 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:040 Reference: SUSE:SuSE-SA:2002:024 Reference: URL:http://www.suse.de/de/security/2002_024_openssh_txt.html Reference: REDHAT:RHSA-2002:127 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-127.html Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt). Modifications: ADDREF REDHAT:RHSA-2002:131 ADDREF CALDERA:CSSA-2002-030.0 ADDREF CONECTIVA:CLA-2002:502 ADDREF ENGARDE:ESA-20020702-016 ADDREF SUSE:SuSE-SA:2002:024 ADDREF REDHAT:RHSA-2002:127 ADDREF MANDRAKE:MDKSA-2002:040 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0640 ACCEPT (4 accept, 7 ack, 0 review) Current Votes: ACCEPT(3) Baker, Foat, Cole MODIFY(1) Cox NOOP(2) Christey, Wall Voter Comments: Cox> ADDREF:RHSA-2002:131 Christey> CALDERA:CSSA-2002-030.0 URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt CONECTIVA:CLA-2002:502 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 ENGARDE:ESA-20020702-016 URL:http://www.linuxsecurity.com/advisories/other_advisory-2177.html SUSE:SuSE-SA:2002:024 URL:http://www.suse.de/de/security/2002_024_openssh_txt.html REDHAT:RHSA-2002:127 URL:http://www.redhat.com/support/errata/RHSA-2002-127.html Christey> MANDRAKE:MDKSA-2002:040 ====================================================== Candidate: CAN-2002-0642 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0642 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020628 Category: CF Reference: MS:MS02-034 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-034.asp Reference: CERT:CA-2002-22 Reference: URL:http://www.cert.org/advisories/CA-2002-22.html Reference: CERT-VN:VU#796313 Reference: URL:http://www.kb.cert.org/vuls/id/796313 Reference: XF:mssql-registry-insecure-permissions(9523) Reference: URL:http://www.iss.net/security_center/static/9523.php Reference: BID:5205 Reference: URL:http://www.securityfocus.com/bid/5205 The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key." Modifications: ADDREF XF:mssql-registry-insecure-permissions(9523) ADDREF BID:5205 ADDREF CERT:CA-2002-22 ADDREF CERT-VN:VU#796313 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0642 ACCEPT (6 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> XF:mssql-registry-insecure-permissions(9523) URL:http://www.iss.net/security_center/static/9523.php BID:5205 URL:http://www.securityfocus.com/bid/5205 CERT:CA-2002-22 CERT-VN:VU#796313 Frech> XF:mssql-registry-insecure-permissions(9523) ====================================================== Candidate: CAN-2002-0647 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0647 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020830 Assigned: 20020628 Category: SF Reference: MS:MS02-047 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-047.asp Reference: XF:ms-legacytext-activex-bo(9935) Reference: URL:http://www.iss.net/security_center/static/9935.php Reference: BID:5558 Reference: URL:http://www.securityfocus.com/bid/5558 Buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code, aka "Buffer Overrun in Legacy Text Formatting ActiveX Control". Modifications: ADDREF XF:ms-legacytext-activex-bo(9935) ADDREF BID:5558 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0647 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(1) Cox ====================================================== Candidate: CAN-2002-0648 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0648 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020830 Assigned: 20020628 Category: SF Reference: BUGTRAQ:20020823 Accessing remote/local content in IE (GM#009-IE) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103011639524314&w=2 Reference: MS:MS02-047 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-047.asp Reference: XF:ie-xml-redirect-read-files(9936) Reference: URL:http://www.iss.net/security_center/static/9936.php Reference: BID:5560 Reference: URL:http://www.securityfocus.com/bid/5560 The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file. Modifications: ADDREF XF:ie-xml-redirect-read-files(9936) ADDREF BID:5560 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0648 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Foat NOOP(1) Cox Voter Comments: Foat> The description varies somewhat from the detailed references provided. The description indicates that this could lead to compromise of local files, while the other references (including Microsoft) indicate the problem is broader in scope. Suggest modifying the description to replace "redirects to a local file" to "redirects to another domain". ====================================================== Candidate: CAN-2002-0650 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0650 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020628 Category: SF Reference: BUGTRAQ:20020725 Microsoft SQL Server 2000 Unauthenticated System Compromise (#NISR25072002) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102760196931518&w=2 Reference: NTBUGTRAQ:20020725 Microsoft SQL Server 2000 Unauthenticated System Compromise (#NISR25072002) Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102760479902411&w=2 Reference: MS:MS02-039 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-039.asp Reference: XF:mssql-resolution-keepalive-dos(9662) Reference: URL:http://www.iss.net/security_center/static/9662.php Reference: BID:5312 Reference: URL:http://www.securityfocus.com/bid/5312 The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Resolution Service (UDP port 1434) with a spoofed IP address of another SQL Server system, which causes the two servers to exchange packets in an infinite loop. Modifications: ADDREF XF:mssql-resolution-keepalive-dos(9662) ADDREF BID:5312 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0650 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> XF:mssql-resolution-keepalive-dos(9662) URL:http://www.iss.net/security_center/static/9662.php BID:5312 URL:http://www.securityfocus.com/bid/5312 Frech> XF:mssql-resolution-keepalive-dos(9662) ====================================================== Candidate: CAN-2002-0653 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Final-Decision: Interim-Decision: 20030326 Modified: 20020817-01 Proposed: 20020726 Assigned: 20020702 Category: SF Reference: VULN-DEV:20020622 Another flaw in Apache? Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102477330617604&w=2 Reference: BUGTRAQ:20020624 Apache mod_ssl off-by-one vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102513970919836&w=2 Reference: REDHAT:RHSA-2002:134 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-134.html Reference: CALDERA:CSSA-2002-031.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-031.0.txt Reference: MANDRAKE:MDKSA-2002:048 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-048.php Reference: DEBIAN:DSA-135 Reference: URL:http://www.debian.org/security/2002/dsa-135 Reference: ENGARDE:ESA-20020702-017 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102563469326072&w=2 Reference: SUSE:SuSE-SA:2002:028 Reference: URL:http://www.suse.de/de/security/2002_028_mod_ssl.html Reference: CONECTIVA:CLA-2002:504 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000504 Reference: BUGTRAQ:20020628 TSL-2002-0058 - apache/mod_ssl Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0350.html Reference: HP:HPSBTL0207-052 Reference: URL:http://archives.neohapsis.com/archives/hp/2002-q3/0018.html Reference: BID:5084 Reference: URL:http://online.securityfocus.com/bid/5084 Reference: XF:apache-modssl-htaccess-bo(9415) Reference: URL:http://www.iss.net/security_center/static/9415.php Off-by-one buffer overflow in rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries. Modifications: ADDREF MANDRAKE:MDKSA-2002:048 ADDREF DEBIAN:DSA-135 ADDREF ENGARDE:ESA-20020702-017 ADDREF SUSE:SuSE-SA:2002:028 ADDREF CONECTIVA:CLA-2002:504 ADDREF BID:5084 ADDREF VULN-DEV:20020622 Another flaw in Apache? ADDREF BUGTRAQ:20020628 TSL-2002-0058 - apache/mod_ssl ADDREF XF:apache-modssl-htaccess-bo(9415) ADDREF HP:HPSBTL0207-052 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0653 ACCEPT (3 accept, 5 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole NOOP(3) Christey, Cox, Foat Voter Comments: Christey> MANDRAKE:MDKSA-2002:048 Christey> ADDREF DEBIAN:DSA-135 ADDREF ENGARDE:ESA-20020702-017 ADDREF SUSE:SuSE-SA:2002:028 Add details to desc. ADDREF CONECTIVA:CLA-2002:504 ADDREF BID:5084 ADDREF VULN-DEV:20020622 Another flaw in Apache? BUGTRAQ:20020628 TSL-2002-0058 - apache/mod_ssl HP:HPSBTL0207-052 ====================================================== Candidate: CAN-2002-0658 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0658 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020830 Assigned: 20020702 Category: SF Reference: MANDRAKE:MDKSA-2002:045 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-045.php Reference: REDHAT:RHSA-2002:153 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-153.html Reference: REDHAT:RHSA-2002:154 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-154.html Reference: REDHAT:RHSA-2002:156 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-156.html Reference: REDHAT:RHSA-2002:164 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-164.html Reference: CALDERA:CSSA-2002-032.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-032.0.txt Reference: DEBIAN:DSA-137 Reference: URL:http://www.debian.org/security/2002/dsa-137 Reference: BUGTRAQ:20020730 [OpenPKG-SA-2002.007] OpenPKG Security Advisory (mm) Reference: HP:HPSBTL0208-056 Reference: URL:http://online.securityfocus.com/advisories/4392 Reference: FREEBSD:FreeBSD-SN-02:05 Reference: URL:http://online.securityfocus.com/advisories/4431 Reference: SUSE:SuSE-SA:2002:028 Reference: URL:http://www.suse.com/de/security/2002_028_mod_ssl.html Reference: XF:mm-tmpfile-symlink(9719) Reference: URL:http://www.iss.net/security_center/static/9719.php Reference: BID:5352 Reference: URL:http://online.securityfocus.com/bid/5352 OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack. Modifications: ADDREF REDHAT:RHSA-2002:156 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0658 ACCEPT (4 accept, 6 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole MODIFY(1) Cox NOOP(1) Foat Voter Comments: Cox> ADDREF:RHSA-2002:163 RHSA-2002:156 RHSA-2002:154 ====================================================== Candidate: CAN-2002-0663 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0663 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020702 Category: SF Reference: ATSTAKE:A071502-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a071502-1.txt Reference: VULNWATCH:20020715 Re: [VulnWatch] Advisory Name: Norton Personal Internet Firewall HTTP Proxy Vulnerability Reference: CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.07.15.html Reference: XF:norton-fw-http-bo(9579) Reference: URL:http://www.iss.net/security_center/static/9579.php Reference: BID:5237 Reference: URL:http://www.securityfocus.com/bid/5237 Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large outgoing HTTP request. Modifications: ADDREF XF:norton-fw-http-bo(9579) ADDREF BID:5237 ADDREF CONFIRM:http://securityresponse.symantec.com/avcenter/security/Content/2002.07.15.html Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0663 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Prosser, Baker, Cole, Armstrong MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:norton-fw-http-bo(9579) URL:http://www.iss.net/security_center/static/9579.php BID:5237 URL:http://www.securityfocus.com/bid/5237 Baker> http://securityresponse.symantec.com/avcenter/security/Content/2002.07.15.html Prosser> Validated with discovered and fixed by Symantec http://securityresponse.symantec.com/avcenter/security/Content/2002.07.15.html Frech> XF:norton-fw-http-bo(9579) ====================================================== Candidate: CAN-2002-0665 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0665 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020704 Category: SF Reference: BUGTRAQ:20020628 wp-02-0009: Macromedia JRun Admin Server Authentication Bypass Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102529402127195&w=2 Reference: VULNWATCH:20020628 [VulnWatch] wp-02-0009: Macromedia JRun Admin Server Authentication Bypass Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0133.html Reference: CONFIRM:http://www.macromedia.com/v1/handlers/index.cfm?ID=23164 Reference: XF:jrun-forwardslash-auth-bypass(9450) Reference: URL:http://www.iss.net/security_center/static/9450.php Reference: BID:5118 Reference: URL:http://www.securityfocus.com/bid/5118 Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. Modifications: ADDREF XF:jrun-forwardslash-auth-bypass(9450) ADDREF BID:5118 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0665 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:jrun-forwardslash-auth-bypass(9450) URL:http://www.iss.net/security_center/static/9450.php BID:5118 URL:http://www.securityfocus.com/bid/5118 ====================================================== Candidate: CAN-2002-0671 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0671 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020709 Category: SF Reference: ATSTAKE:A071202-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a071202-1.txt Reference: CONFIRM:http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp Reference: XF:pingtel-xpressa-dns-spoofing(9566) Reference: URL:http://www.iss.net/security_center/static/9566.php Reference: BID:5224 Reference: URL:http://www.securityfocus.com/bid/5224 Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing. Modifications: ADDREF XF:pingtel-xpressa-dns-spoofing(9566) ADDREF BID:5224 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0671 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole MODIFY(1) Frech NOOP(5) Cox, Balinsky, Wall, Foat, Armstrong Voter Comments: Frech> XF:pingtel-xpressa-dns-spoofing(9566) ====================================================== Candidate: CAN-2002-0676 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0676 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020709 Category: SF Reference: BUGTRAQ:20020706 MacOS X SoftwareUpdate Vulnerability Reference: MISC:http://www.cunap.com/~hardingr/projects/osx/exploit.html Reference: XF:macos-softwareupdate-no-auth(9502) Reference: URL:http://www.iss.net/security_center/static/9502.php Reference: BID:5176 Reference: URL:http://www.securityfocus.com/bid/5176 SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates. Modifications: ADDREF XF:macos-softwareupdate-no-auth(9502) ADDREF BID:5176 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0676 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Balinsky, Cole, Armstrong MODIFY(1) Frech NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:macos-softwareupdate-no-auth(9502) URL:http://www.iss.net/security_center/static/9502.php BID:5176 URL:http://www.securityfocus.com/bid/5176 Balinsky> Vendor addressed the vulnerable application. It isn't clear that this is the same problem, but it is likely. http://docs.info.apple.com/article.html?artnum=75304 Frech> XF:macos-softwareupdate-no-auth(9502) Christey> Since this CAN was reserved by Apple, I think we can safely say that they've acknowledged the bug ;-) ====================================================== Candidate: CAN-2002-0678 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0678 Final-Decision: Interim-Decision: 20030326 Modified: 20030321-01 Proposed: 20020726 Assigned: 20020709 Category: SF Reference: BUGTRAQ:20020710 [CORE-20020528] Multiple vulnerabilities in ToolTalk Database server Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102635906423617&w=2 Reference: CERT:CA-2002-20 Reference: URL:http://www.cert.org/advisories/CA-2002-20.html Reference: CERT-VN:VU#299816 Reference: URL:http://www.kb.cert.org/vuls/id/299816 Reference: HP:HPSBUX0207-199 Reference: URL:http://archives.neohapsis.com/archives/hp/2002-q3/0011.html Reference: AIXAPAR:IY32368 Reference: URL:http://archives.neohapsis.com/archives/aix/2002-q3/0002.html Reference: AIXAPAR:IY32370 Reference: URL:http://archives.neohapsis.com/archives/aix/2002-q3/0002.html Reference: CALDERA:CSSA-2002-SCO.28 Reference: URL:ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.28/CSSA-2002-SCO.28.txt Reference: SGI:20021101-01-P Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20021101-01-P Reference: XF:tooltalk-ttdbserverd-tttransaction-symlink(9527) Reference: URL:http://www.iss.net/security_center/static/9527.php Reference: BID:5083 Reference: URL:http://www.securityfocus.com/bid/5083 CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. Modifications: ADDREF XF:tooltalk-ttdbserverd-tttransaction-symlink(9527) ADDREF BID:5083 ADDREF AIXAPAR:IY32368 ADDREF AIXAPAR:IY32370 ADDREF HP:HPSBUX0207-199 ADDREF SGI:20021101-01-P Analysis -------- Vendor Acknowledgement: yes advisory MAPPING: while the HP advisory discusses "buffer overflows," it specifically mentions CA-2002-20, and the text of the advisory is included in vendor statements for the CERT-VU's for both ToolTalk issues covered by CA-2002-20. INFERRED ACTION: CAN-2002-0678 ACCEPT (5 accept, 6 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:tooltalk-ttdbserverd-tttransaction-symlink(9527) URL:http://www.iss.net/security_center/static/9527.php BID:5083 URL:http://www.securityfocus.com/bid/5083 HP:HPSBUX0207-199 URL:http://archives.neohapsis.com/archives/hp/2002-q3/0011.html Note: while the HP advisory discusses "buffer overflows," it specifically mentions CA-2002-20, and the text of the advisory is included in vendor statements for the CERT-VU's for both ToolTalk issues covered by CA-2002-20. AIXAPAR:IY32368 URL:http://archives.neohapsis.com/archives/aix/2002-q3/0002.html AIXAPAR:IY32370 URL:http://archives.neohapsis.com/archives/aix/2002-q3/0002.html Christey> HP:HPSBUX0207-199 URL:http://online.securityfocus.com/advisories/4290 Christey> SGI:20021101-01-P Frech> XF:tooltalk-ttdbserverd-tttransaction-symlink(9527) ====================================================== Candidate: CAN-2002-0679 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0679 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020709 Category: SF Reference: BUGTRAQ:20020812 ENTERCEPT RICOCHET ADVISORY: Multi-Vendor CDE ToolTalk Database Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102917002523536&w=2 Reference: CERT:CA-2002-26 Reference: URL:http://www.cert.org/advisories/CA-2002-26.html Reference: CERT-VN:VU#387387 Reference: URL:http://www.kb.cert.org/vuls/id/387387 Reference: CALDERA:CSSA-2002-SCO.28.1 Reference: COMPAQ:SSRT2274 Reference: AIXAPAR:IY32792 Reference: AIXAPAR:IY32793 Reference: HP:HPSBUX0207-199 Reference: URL:http://online.securityfocus.com/advisories/4290 Reference: CONFIRM:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F46366&zone_32=category%3Asecurity Reference: XF:tooltalk-ttdbserverd-ttcreatefile-bo(9822) Reference: URL:http://www.iss.net/security_center/static/9822.php Reference: BID:5444 Reference: URL:http://www.securityfocus.com/bid/5444 Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. Modifications: ADDREF XF:tooltalk-ttdbserverd-ttcreatefile-bo(9822) ADDREF BID:5444 ADDREF HP:HPSBUX0207-199 ADDREF CONFIRM:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F46366&zone_32=category%3Asecurity Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0679 ACCEPT (3 accept, 7 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:tooltalk-ttdbserverd-ttcreatefile-bo(9822) URL:http://www.iss.net/security_center/static/9822.php BID:5444 URL:http://www.securityfocus.com/bid/5444 HP:HPSBUX0207-199 URL:http://online.securityfocus.com/advisories/4290 CONFIRM:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F46366&zone_32=category%3Asecurity ====================================================== Candidate: CAN-2002-0685 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0685 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020711 Category: SF Reference: BUGTRAQ:20020710 EEYE: Remote PGP Outlook Encryption Plug-in Vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102634756815773&w=2 Reference: NTBUGTRAQ:20020710 EEYE: Remote PGP Outlook Encryption Plug-in Vulnerability Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102639521518942&w=2 Reference: CONFIRM:http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.04/hotfix/ReadMe.txt Reference: XF:pgp-outlook-heap-overflow(9525) Reference: URL:http://www.iss.net/security_center/static/9525.php Reference: BID:5202 Reference: URL:http://www.securityfocus.com/bid/5202 Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0.4, Personal Security 7.0.3, and Freeware 7.0.3, allows remote attackers to modify the heap and gain privileges via a large, malformed mail message. Modifications: ADDREF XF:pgp-outlook-heap-overflow(9525) ADDREF BID:5202 DESC Add "heap-based" to overflow term Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0685 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:pgp-outlook-heap-overflow(9525) URL:http://www.iss.net/security_center/static/9525.php BID:5202 URL:http://www.securityfocus.com/bid/5202 Frech> XF:pgp-outlook-heap-overflow(9525) ====================================================== Candidate: CAN-2002-0687 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0687 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020712 Category: SF Reference: CONFIRM:http://www.zope.org/Products/Zope/Hotfix_2002-04-15/security_alert Reference: REDHAT:RHSA-2002:060 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-060.html Reference: BID:5813 Reference: URL:http://www.securityfocus.com/bid/5813 Reference: XF:zope-inject-headers-dos(9621) Reference: URL:http://www.iss.net/security_center/static/9621.php The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. Modifications: ADDREF REDHAT:RHSA-2002:060 ADDREF BID:5813 ADDREF XF:zope-inject-headers-dos(9621) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0687 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Armstrong NOOP(3) Christey, Wall, Foat Voter Comments: Christey> REDHAT:RHSA-2002:060 URL:http://www.redhat.com/support/errata/RHSA-2002-060.html BID:5813 URL:http://www.securityfocus.com/bid/5813 ====================================================== Candidate: CAN-2002-0688 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0688 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020712 Category: SF Reference: CONFIRM:http://www.zope.org/Products/Zope/Hotfix_2002-06-14/security_alert Reference: REDHAT:RHSA-2002:060 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-060.html Reference: BID:5812 Reference: URL:http://www.securityfocus.com/bid/5812 Reference: XF:zope-zcatalog-index-bypass(9610) Reference: URL:http://www.iss.net/security_center/static/9610.php ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes. Modifications: ADDREF REDHAT:RHSA-2002:060 ADDREF BID:5812 ADDREF XF:zope-zcatalog-index-bypass(9610) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0688 ACCEPT_ACK (2 accept, 2 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> REDHAT:RHSA-2002:060 URL:http://www.redhat.com/support/errata/RHSA-2002-060.html BID:5812 URL:http://www.securityfocus.com/bid/5812 ====================================================== Candidate: CAN-2002-0691 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0691 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020712 Category: SF Reference: MS:MS02-047 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-047.asp Reference: XF:ie-local-resource-xss(9938) Reference: URL:http://www.iss.net/security_center/static/9938.php Reference: BID:5561 Reference: URL:http://www.securityfocus.com/bid/5561 Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a local HTML resource file, a variant of "Cross-Site Scripting in Local HTML Resource"as identified by CAN-2002-0189. Modifications: ADDREF XF:ie-local-resource-xss(9938) ADDREF BID:5561 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0691 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> XF:ie-local-resource-xss(9938) URL:http://www.iss.net/security_center/static/9938.php BID:5561 URL:http://www.securityfocus.com/bid/5561 ====================================================== Candidate: CAN-2002-0695 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0695 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020712 Category: SF Reference: MS:MS02-040 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-040.asp Reference: MISC:http://www.nextgenss.com/advisories/mssql-ors.txt Reference: XF:mssql-mdac-openrowset-bo(9734) Reference: URL:http://www.iss.net/security_center/static/9734.php Reference: BID:5372 Reference: URL:http://online.securityfocus.com/bid/5372 Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7.0 or 2000 allows remote attackers to execute arbitrary code via a query that calls the OpenRowSet command. Modifications: ADDREF XF:mssql-mdac-openrowset-bo(9734) ADDREF MISC:http://www.nextgenss.com/advisories/mssql-ors.txt ADDREF BID:5372 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0695 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Foat, Cole NOOP(2) Christey, Cox Voter Comments: Christey> XF:mssql-mdac-openrowset-bo(9734) URL:http://www.iss.net/security_center/static/9734.php MISC:http://www.nextgenss.com/advisories/mssql-ors.txt BID:5372 URL:http://online.securityfocus.com/bid/5372 ====================================================== Candidate: CAN-2002-0697 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0697 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020712 Category: SF Reference: MS:MS02-036 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS02-036.asp Reference: XF:mms-data-repository-access(9657) Reference: URL:http://www.iss.net/security_center/static/9657.php Reference: BID:5308 Reference: URL:http://www.securityfocus.com/bid/5308 Microsoft Metadirectory Services (MMS) 2.2 allows remote attackers to bypass authentication and modify sensitive data by using an LDAP client to directly connect to MMS and bypass the checks for MMS credentials. Modifications: ADDREF XF:mms-data-repository-access(9657) ADDREF BID:5308 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0697 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:mms-data-repository-access(9657) URL:http://www.iss.net/security_center/static/9657.php BID:5308 URL:http://www.securityfocus.com/bid/5308 CHANGE> [Armstrong changed vote from NOOP to ACCEPT] Frech> XF:mms-data-repository-access(9657) ====================================================== Candidate: CAN-2002-0698 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0698 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020712 Category: SF Reference: ISS:20020724 Remote Buffer Overflow Vulnerability in Microsoft Exchange Server Reference: URL:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20759 Reference: MSKB:Q326322 Reference: URL:http://support.microsoft.com/default.aspx?scid=kb;[LN];Q326322 Reference: MS:MS02-037 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-037.asp Reference: XF:exchange-imc-ehlo-bo(9658) Reference: URL:http://www.iss.net/security_center/static/9658.php Reference: BID:5306 Reference: URL:http://www.securityfocus.com/bid/5306 Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response. Modifications: ADDREF XF:exchange-imc-ehlo-bo(9658) ADDREF BID:5306 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0698 ACCEPT (5 accept, 3 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Cox Voter Comments: Christey> XF:exchange-imc-ehlo-bo(9658) URL:http://www.iss.net/security_center/static/9658.php BID:5306 URL:http://www.securityfocus.com/bid/5306 Frech> XF:exchange-imc-ehlo-bo(9658) ====================================================== Candidate: CAN-2002-0700 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0700 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020712 Category: SF Reference: MS:MS02-041 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-041.asp Reference: XF:mcms-authentication-bo(9783) Reference: URL:http://www.iss.net/security_center/static/9783.php Reference: BID:5420 Reference: URL:http://www.securityfocus.com/bid/5420 Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by authenticating to a web page that calls the function, aka "Unchecked Buffer in MDAC Function Could Enable SQL Server Compromise." Modifications: ADDREF XF:mcms-authentication-bo(9783) ADDREF BID:5420 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0700 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> XF:mcms-authentication-bo(9783) URL:http://www.iss.net/security_center/static/9783.php BID:5420 URL:http://www.securityfocus.com/bid/5420 ====================================================== Candidate: CAN-2002-0701 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0701 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020712 Category: SF Reference: FREEBSD:FreeBSD-SA-02:30 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102650797504351&w=2 Reference: OPENBSD:20020627 009: SECURITY FIX: June 27, 2002 Reference: URL:http://www.openbsd.org/errata.html#ktrace Reference: XF:openbsd-ktrace-gain-privileges(9474) Reference: URL:http://www.iss.net/security_center/static/9474.php Reference: BID:5133 Reference: URL:http://www.securityfocus.com/bid/5133 ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges. Modifications: ADDREF XF:openbsd-ktrace-gain-privileges(9474) ADDREF BID:5133 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0701 ACCEPT_ACK (2 accept, 2 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:openbsd-ktrace-gain-privileges(9474) URL:http://www.iss.net/security_center/static/9474.php BID:5133 URL:http://www.securityfocus.com/bid/5133 ====================================================== Candidate: CAN-2002-0703 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0703 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020716 Category: SF Reference: REDHAT:RHSA-2002:081 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-081.html Reference: MANDRAKE:MDKSA-2002:035 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-035.php Reference: XF:linux-utf8-incorrect-md5(9051) Reference: URL:http://www.iss.net/security_center/static/9051.php Reference: BID:4716 Reference: URL:http://www.securityfocus.com/bid/4716 An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from properly verifying the integrity of the data. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0703 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong NOOP(1) Foat ====================================================== Candidate: CAN-2002-0704 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0704 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020716 Category: SF Reference: BUGTRAQ:20020508 [CARTSA-20020402] Linux Netfilter NAT/ICMP code information leak Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102088521517722&w=2 Reference: REDHAT:RHSA-2002:086 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-086.html Reference: MANDRAKE:MDKSA-2002:030 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-030.php Reference: HP:HPSBTL0205-039 Reference: URL:http://online.securityfocus.com/advisories/4116 Reference: XF:linux-netfilter-information-leak(9043) Reference: URL:http://www.iss.net/security_center/static/9043.php Reference: BID:4699 Reference: URL:http://www.securityfocus.com/bid/4699 The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0704 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong NOOP(1) Foat ====================================================== Candidate: CAN-2002-0710 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0710 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020718 Category: SF Reference: BUGTRAQ:20020730 Directory traversal vulnerability in sendform.cgi Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102809084218422&w=2 Reference: VULNWATCH:20020731 [VulnWatch] Directory traversal vulnerability in sendform.cgi Reference: CONFIRM:http://www.scn.org/~bb615/scripts/sendform.html Reference: XF:sendform-blurbfile-directory-traversal(9725) Reference: URL:http://www.iss.net/security_center/static/9725.php Reference: BID:5286 Reference: URL:http://www.securityfocus.com/bid/5286 Directory traversal vulnerability in sendform.cgi 1.44 and earlier allows remote attackers to read arbitrary files by specifying the desired files in the BlurbFilePath parameter. Modifications: ADDREF XF:sendform-blurbfile-directory-traversal(9725) ADDREF BID:5286 Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: On the vendor's home page, an item dated July 22, 2002, says "New: security fix: This limits reading world-readable 'blurb' files (that can be used with HTML forms with this script) to certain directories defined in the script by the Web administrator." INFERRED ACTION: CAN-2002-0710 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:sendform-blurbfile-directory-traversal(9725) URL:http://www.iss.net/security_center/static/9725.php ====================================================== Candidate: CAN-2002-0714 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0714 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020720 Category: SF Reference: CONFIRM:http://www.squid-cache.org/Advisories/SQUID-2002_3.txt Reference: CONFIRM:http://www.squid-cache.org/Versions/v2/2.4/bugs/ Reference: REDHAT:RHSA-2002:051 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-051.html Reference: REDHAT:RHSA-2002:130 Reference: URL:http://rhn.redhat.com/errata/RHSA-2002-130.html Reference: SUSE:SuSE-SA:2002:025 Reference: CALDERA:CSSA-2002-046.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-046.0.txt Reference: CONECTIVA:CLA-2002:506 Reference: MANDRAKE:MDKSA-2002:044 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-044.php Reference: BUGTRAQ:20020715 TSLSA-2002-0062 - squid Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102674543407606&w=2 Reference: XF:squid-ftp-data-injection(9479) Reference: URL:http://www.iss.net/security_center/static/9479.php Reference: BID:5158 Reference: URL:http://www.securityfocus.com/bid/5158 FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses. Modifications: ADDREF XF:squid-ftp-data-injection(9479) ADDREF CALDERA:CSSA-2002-046.0 ADDREF REDHAT:RHSA-2002:051 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0714 ACCEPT (6 accept, 4 ack, 0 review) Current Votes: ACCEPT(5) Baker, Cox, Wall, Cole, Armstrong MODIFY(1) Frech NOOP(2) Christey, Foat Voter Comments: Frech> XF:squid-ftp-data-injection(9479) Christey> REDHAT:RHSA-2002:051 URL:http://rhn.redhat.com/errata/RHSA-2002-051.html ====================================================== Candidate: CAN-2002-0716 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0716 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020722 Category: SF Reference: BUGTRAQ:20020604 SRT Security Advisory (SRT2002-06-04-1711): SCO crontab Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102323070305101&w=2 Reference: VULN-DEV:20020604 SRT Security Advisory (SRT2002-06-04-1711): SCO crontab Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102323386107641&w=2 Reference: CALDERA:CSSA-2002-SCO.35 Reference: BID:4938 Reference: URL:http://www.securityfocus.com/bid/4938 Reference: XF:openserver-crontab-format-string(9271) Reference: URL:http://www.iss.net/security_center/static/9271.php Format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 allows local users to gain privileges via format string specifiers in the file name argument. Modifications: ADDREF BID:4938 ADDREF XF:openserver-crontab-format-string(9271) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0716 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BID:4938 URL:http://www.securityfocus.com/bid/4938 XF:openserver-crontab-format-string(9271) URL:http://www.iss.net/security_center/static/9271.php ====================================================== Candidate: CAN-2002-0718 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0718 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020722 Category: SF Reference: MS:MS02-041 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-041.asp Reference: BID:5421 Reference: URL:http://www.securityfocus.com/bid/5421 Reference: XF:mcms-authoring-file-execution(9784) Reference: URL:http://www.iss.net/security_center/static/9784.php Web authoring command in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content, by modifying the upload location, aka "Program Execution via MCMS Authoring Function." Modifications: ADDREF BID:5421 ADDREF XF:mcms-authoring-file-execution(9784) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0718 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> BID:5421 URL:http://www.securityfocus.com/bid/5421 XF:mcms-authoring-file-execution(9784) URL:http://www.iss.net/security_center/static/9784.php ====================================================== Candidate: CAN-2002-0719 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0719 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020722 Category: SF Reference: MS:MS02-041 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-041.asp Reference: BID:5422 Reference: URL:http://www.securityfocus.com/bid/5422 Reference: XF:mcms-resource-sql-injection(9785) Reference: URL:http://www.iss.net/security_center/static/9785.php SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for image files or other files. Modifications: ADDREF BID:5422 ADDREF XF:mcms-resource-sql-injection(9785) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0719 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> BID:5422 URL:http://www.securityfocus.com/bid/5422 XF:mcms-resource-sql-injection(9785) URL:http://www.iss.net/security_center/static/9785.php ====================================================== Candidate: CAN-2002-0720 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0720 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020722 Category: SF Reference: MS:MS02-042 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS02-042.asp Reference: XF:win2k-ncm-gain-privileges(9856) Reference: URL:http://www.iss.net/security_center/static/9856.php Reference: BID:5480 Reference: URL:http://www.securityfocus.com/bid/5480 A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code. Modifications: ADDREF XF:win2k-ncm-gain-privileges(9856) ADDREF BID:5480 DESC add OS Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0720 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> XF:win2k-ncm-gain-privileges(9856) URL:http://www.iss.net/security_center/static/9856.php BID:5480 URL:http://www.securityfocus.com/bid/5480 ====================================================== Candidate: CAN-2002-0722 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0722 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020722 Category: SF Reference: BUGTRAQ:20020828 Origin of downloaded files can be spoofed in MSIE Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103054692223380&w=2 Reference: MS:MS02-047 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-047.asp Reference: XF:ie-file-origin-spoofing(9937) Reference: URL:http://www.iss.net/security_center/static/9937.php Reference: BID:5559 Reference: URL:http://www.securityfocus.com/bid/5559 Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of a file in the File Download dialogue box to trick users into thinking that the file type is safe to download, aka "File Origin Spoofing." Modifications: ADDREF XF:ie-file-origin-spoofing(9937) ADDREF BID:5559 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0722 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> XF:ie-file-origin-spoofing(9937) URL:http://www.iss.net/security_center/static/9937.php BID:5559 URL:http://www.securityfocus.com/bid/5559 ====================================================== Candidate: CAN-2002-0726 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0726 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020722 Category: SF Reference: ATSTAKE:A082802-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a082802-1.txt Reference: MS:MS02-046 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-046.asp Reference: XF:ms-tsac-activex-bo(9934) Reference: URL:http://www.iss.net/security_center/static/9934.php Reference: BID:5554 Reference: URL:http://www.securityfocus.com/bid/5554 Buffer overflow in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to execute arbitrary code via a long server name field. Modifications: ADDREF XF:ms-tsac-activex-bo(9934) ADDREF BID:5554 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0726 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(2) Christey, Cox Voter Comments: Christey> XF:ms-tsac-activex-bo(9934) URL:http://www.iss.net/security_center/static/9934.php BID:5554 URL:http://www.securityfocus.com/bid/5554 ====================================================== Candidate: CAN-2002-0727 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0727 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020722 Category: SF Reference: MS:MS02-044 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-044.asp Reference: BUGTRAQ:20020408 Scripting for the scriptless with OWC in IE (GM#005-IE) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101829645415486&w=2 Reference: XF:owc-spreadsheet-host-script-execution (8777) Reference: URL:http://www.iss.net/security_center/static/8777.php Reference: BID:4449 Reference: URL:http://online.securityfocus.com/bid/4449 The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0727 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0733 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0733 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: VULNWATCH:20020417 Smalls holes on 5 products #1 Reference: URL:http://archives.neohapsis.com/archives/vuln-dev/2002-q2/0155.html Reference: CONFIRM:http://www.acme.com/software/thttpd/#releasenotes Reference: MISC:http://www.ifrance.com/kitetoua/tuto/5holes1.txt Reference: XF:thttpd-error-page-css(9029) Reference: URL:http://www.iss.net/security_center/static/9029.php Reference: BID:4601 Reference: URL:http://www.securityfocus.com/bid/4601 Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary script via a URL to a nonexistent page, which causes thttpd to insert the script into a 404 error message. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: In the release notes for 2.21, the vendor states "Fixed cross-site scripting bug relating to the built-in error pages." INFERRED ACTION: CAN-2002-0733 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0734 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0734 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020506 b2 php remote command execution Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0027.html Reference: CONFIRM:http://cafelog.com/ Reference: BID:4673 Reference: URL:http://www.securityfocus.com/bid/4673 Reference: XF:b2-b2inc-command-execution(9013) Reference: URL:http://www.iss.net/security_center/static/9013.php b2edit.showposts.php in B2 2.0.6pre2 and earlier does not properly load the b2config.php file in some configurations, which allows remote attackers to execute arbitrary PHP code via a URL that sets the $b2inc variable to point to a malicious program stored on a remote server. Modifications: DESC remove "Trojan horse" terminology Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: On the vendor's home page, an item dated "04.05.02" (May 4, 2002) states "Someone recently told me about a security hole in b2... The fix for the security hole is very simple: create a file named b2config.php and upload it in your b2-include folder." While this in itself doesn't include enough details to be certain that the vendor is fixing *this* problem, it would fix the problem, and later comments on the vendor's page would line up with the date of public announcement of this problem. INFERRED ACTION: CAN-2002-0734 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0736 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0736 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020416 Back Office Web Administrator Authentication Bypass (#NISR17042002A) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html Reference: MSKB:Q316838 Reference: URL:http://support.microsoft.com/support/kb/articles/q316/8/38.asp Reference: BID:4528 Reference: URL:http://www.securityfocus.com/bid/4528 Reference: XF:backoffice-bypass-authentication(8862) Reference: URL:http://www.iss.net/security_center/static/8862.php Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other systems, allows remote attackers to bypass authentication and access the administrative ASP pages via an HTTP request with an authorization type (auth_type) that is not blank. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0736 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Baker, Wall, Foat, Cole, Armstrong NOOP(1) Cox ====================================================== Candidate: CAN-2002-0737 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0737 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020417 KPMG-2002012: Sambar Webserver Serverside Fileparse Bypass Reference: URL:http://online.securityfocus.com/archive/1/268121 Reference: VULNWATCH:20020417 [VulnWatch] KPMG-2002012: Sambar Webserver Serverside Fileparse Bypass Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0026.html Reference: CONFIRM:http://www.sambar.com/security.htm Reference: XF:sambar-script-source-disclosure(8876) Reference: URL:http://www.iss.net/security_center/static/8876.php Reference: BID:4533 Reference: URL:http://www.securityfocus.com/bid/4533 Sambar web server before 5.2 beta 1 allows remote attackers to obtain source code of server-side scripts, or cause a denial of service (resource exhaustion) via DOS devices, using a URL that ends with a space and a null character. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: on the security page, last updated the day after the initial disclosure, the vendor states that "All releases prior to the 5.2 beta 1 release are vulnerable to having the source code associated with CGI scripts and JSP files exposed via an URL sequence." INFERRED ACTION: CAN-2002-0737 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0738 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0738 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020418 MHonArc v2.5.2 Script Filtering Bypass Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0260.html Reference: CONFIRM:http://www.mhonarc.org/MHonArc/CHANGES Reference: DEBIAN:DSA-163 Reference: URL:http://www.debian.org/security/2002/dsa-163 Reference: XF:mhonarc-script-filtering-bypass(8894) Reference: URL:http://www.iss.net/security_center/static/8894.php Reference: BID:4546 Reference: URL:http://www.securityfocus.com/bid/4546 MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax. Modifications: ADDREF DEBIAN:DSA-163 Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: In the changelog for 2002/04/18 (version 2.5.3), the vendor states "Beefed up HTML filtering in mhtxthtml.pl to eliminate some security exploits" and credits the Bugtraq researchers. INFERRED ACTION: CAN-2002-0738 ACCEPT (3 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> DEBIAN:DSA-163 ====================================================== Candidate: CAN-2002-0741 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0741 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020423 PsyBNC Remote Dos POC Reference: URL:http://online.securityfocus.com/archive/1/269131 Reference: BUGTRAQ:20020422 Re: psyBNC 2.3 DoS / Bug Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0322.html Reference: BID:4570 Reference: URL:http://www.securityfocus.com/bid/4570 Reference: XF:psybnc-long-password-dos(8912) Reference: URL:http://www.iss.net/security_center/static/8912.php psyBNC 2.3 allows remote attackers to cause a denial of service (CPU consumption and resource exhaustion) by sending a PASS command with a long password argument and quickly killing the connection, which is not properly terminated by psyBNC. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0741 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Cox, Wall, Foat, Armstrong ====================================================== Candidate: CAN-2002-0748 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0748 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020423 LabVIEW Web Server DoS Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-04/0323.html Reference: CONFIRM:http://digital.ni.com/public.nsf/websearch/4C3F86E655E5389886256BA00064B22F?OpenDocument Reference: XF:labview-http-get-dos(8919) Reference: URL:http://www.iss.net/security_center/static/8919.php Reference: BID:4577 Reference: URL:http://www.securityfocus.com/bid/4577 LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that ends in two newline characters, instead of the expected carriage return/newline combinations. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0748 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0754 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0754 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:07 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:07.k5su.asc Reference: BID:3919 Reference: URL:http://www.securityfocus.com/bid/3919 Reference: XF:kerberos5-k5su-elevate-privileges(7956) Reference: URL:http://www.iss.net/security_center/static/7956.php Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them. Modifications: DESC clarify Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0754 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> need to rewrite desc to make a little more clear. ====================================================== Candidate: CAN-2002-0755 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0755 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:24 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:24.k5su.asc Reference: BID:4777 Reference: URL:http://www.securityfocus.com/bid/4777 Reference: XF:freebsd-k5su-gain-privileges(9125) Reference: URL:http://www.iss.net/security_center/static/9125.php Kerberos 5 su (k5su) in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0755 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0758 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0758 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: SUSE:SuSE-SA:2002:016 Reference: URL:http://www.suse.de/de/support/security/2002_016_sysconfig_txt.html Reference: BID:4695 Reference: URL:http://www.securityfocus.com/bid/4695 Reference: XF:suse-sysconfig-command-execution(9040) Reference: URL:http://www.iss.net/security_center/static/9040.php ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0758 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0759 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0759 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:25 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc Reference: CALDERA:CSSA-2002-039.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt Reference: XF:bzip2-decompression-file-overwrite(9126) Reference: URL:http://www.iss.net/security_center/static/9126.php Reference: BID:4774 Reference: URL:http://www.securityfocus.com/bid/4774 bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive. Modifications: ADDREF CALDERA:CSSA-2002-039.0 DESC add OpenLinux to desc Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0759 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Armstrong NOOP(3) Christey, Wall, Foat Voter Comments: Christey> CALDERA:CSSA-2002-039.0 ====================================================== Candidate: CAN-2002-0760 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0760 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:25 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc Reference: CALDERA:CSSA-2002-039.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt Reference: BID:4775 Reference: URL:http://www.securityfocus.com/bid/4775 Reference: XF:bzip2-decompression-race-condition(9127) Reference: URL:http://www.iss.net/security_center/static/9127.php Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the files as they are being decompressed. Modifications: DESC add OpenLinux ADDREF CALDERA:CSSA-2002-039.0 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0760 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Armstrong NOOP(3) Christey, Wall, Foat Voter Comments: Christey> CALDERA:CSSA-2002-039.0 ====================================================== Candidate: CAN-2002-0761 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0761 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:25 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc Reference: CALDERA:CSSA-2002-039.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt Reference: XF:bzip2-compression-symlink(9128) Reference: URL:http://www.iss.net/security_center/static/9128.php Reference: BID:4776 Reference: URL:http://www.securityfocus.com/bid/4776 bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended. Modifications: DESC add OpenLinux ADDREF CALDERA:CSSA-2002-039.0 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0761 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Baker, Cox, Cole, Armstrong NOOP(3) Christey, Wall, Foat Voter Comments: Christey> CALDERA:CSSA-2002-039.0 ====================================================== Candidate: CAN-2002-0762 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0762 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: SUSE:SuSE-SA:2002:017 Reference: URL:http://www.suse.de/de/support/security/2002_17_shadow.html Reference: XF:suse-shadow-filesize-limits(9102) Reference: URL:http://www.iss.net/security_center/static/9102.php Reference: BID:4757 Reference: URL:http://www.securityfocus.com/bid/4757 shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some users by changing filesize limits before calling programs that modify the files. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0762 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0765 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0765 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020527 OpenSSH 3.2.3 released (fwd) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0235.html Reference: OPENBSD:20020522 004: SECURITY FIX: May 22, 2002 Reference: URL:http://www.openbsd.org/errata.html#sshbsdauth Reference: BID:4803 Reference: URL:http://www.securityfocus.com/bid/4803 Reference: XF:bsd-sshd-authentication-error(9215) Reference: URL:http://www.iss.net/security_center/static/9215.php sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0765 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0766 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0766 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: VULNWATCH:20020509 [VulnWatch] OpenBSD local DoS and root exploit Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0066.html Reference: BUGTRAQ:20020509 OpenBSD local DoS and root exploit Reference: URL:http://online.securityfocus.com/archive/1/271702 Reference: OPENBSD:20020508 003: SECURITY FIX: May 8, 2002 Reference: URL:http://www.openbsd.org/errata.html#fdalloc2 Reference: XF:openbsd-file-descriptor-dos(9048) Reference: URL:http://www.iss.net/security_center/static/9048.php OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0766 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0768 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0768 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: Reference: SUSE:SuSE-SA:2002:018 Reference: URL:http://www.suse.com/de/support/security/2002_18_lukemftp.html Reference: XF:lukemftp-pasv-bo(9130) Reference: URL:http://www.iss.net/security_center/static/9130.php Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0768 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0776 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0776 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020713 Hosting Controller Vulnerability Reference: URL:http://online.securityfocus.com/archive/1/282129 Reference: CONFIRM:http://hostingcontroller.com/english/logs/sp2log.html Reference: XF:hosting-controller-password-modification(9554) Reference: URL:http://www.iss.net/security_center/static/9554.php Reference: BID:5229 Reference: URL:http://www.securityfocus.com/bid/5229 getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter, as addressed by the "UpdateUser" hot fix. Modifications: ADDREF XF:hosting-controller-password-modification(9554) ADDREF BID:5229 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0776 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Balinsky, Cole MODIFY(1) Frech NOOP(4) Cox, Wall, Foat, Armstrong Voter Comments: Frech> XF:hosting-controller-password-modification(9554) ====================================================== Candidate: CAN-2002-0777 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0777 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020520 Foundstone Advisory - Buffer Overflow in Ipswitch Imail 7.1 and prior (fwd) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0172.html Reference: XF:imail-ldap-bo(9116) Reference: URL:http://www.iss.net/security_center/static/9116.php Reference: BID:4780 Reference: URL:http://www.securityfocus.com/bid/4780 Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long "bind DN" parameter. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: the only apparent information by the vendor that MAY be related to this issue is at http://support.ipswitch.com/kb/IM-20020703-DM01.htm; there are two comments related to overflows: "Removed a buffer overflow error in Web Calendaring" and "ILDAP: Fixed a buffer overflow which could be used for a DOS attack." While the latter phrase might be related to the LDAP issue, it is in direct conflict with Foundstone's claim that the problem is exploitable, which may indicate that this is not really the same vulnerability. Inquiry posted to http://www.ipswitch.com/cgi/askatech.pl?action=build on July 17, 2002. Tracking number: T200207180016. Vendor confirmed the issue via an E-mail reply from evalhelp@ipswitch.com on July 18: "Yes, this has been repaired... The conclusive evidence is in the knowledge base article." INFERRED ACTION: CAN-2002-0777 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0778 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0778 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: CF Reference: CISCO:20020528 Transparent Cache Engine and Content Engine TCP Relay Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/transparentcache-tcp-relay-vuln-pub.shtml Reference: XF:cisco-cache-content-tcp-forward(9082) Reference: URL:http://www.iss.net/security_center/static/9082.php Reference: BID:4751 Reference: URL:http://www.securityfocus.com/bid/4751 The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0778 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Foat, Cole, Armstrong NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0785 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0785 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020508 Hole in AOL Instant Messenger Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0086.html Reference: XF:aim-addbuddy-bo(9058) Reference: URL:http://www.iss.net/security_center/static/9058.php Reference: BID:4709 Reference: URL:http://www.securityfocus.com/bid/4709 AOL Instant Messenger (AIM) allows remote attackers to cause a denial of service (crash) via an "AddBuddy" link with the ScreenName parameter set to a large number of comma-separated values, possibly triggering a buffer overflow. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0785 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(4) Baker, Wall, Cole, Armstrong NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0788 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0788 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020508 NTFS and PGP interact to expose EFS encrypted data Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0052.html Reference: CONFIRM:http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1/hotfix/ReadMe.txt Reference: XF:pgp-ntfs-reveal-data(9044) Reference: URL:http://www.iss.net/security_center/static/9044.php Reference: BID:4702 Reference: URL:http://www.securityfocus.com/bid/4702 An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped or deleted due to strong permissions, which could allow certain local users or attackers with physical access to obtain cleartext information. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: In the release notes for the hotfix, the vendor states "There is a conflict between Microsoft's Encrypted File System (EFS) on Windows 2000 and PGP's file wiping feature. When you encrypt a file using EFS, Windows 2000 creates a temporary file that contains the cleartext of the encrypted file." INFERRED ACTION: CAN-2002-0788 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0789 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0789 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: BUGTRAQ:20020511 Bug in mnogosearch-3.1.19 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0092.html Reference: CONFIRM:http://www.mnogosearch.org/Download/mnogosearch-3.1.20.tar.gz Reference: MISC:http://www.mnogosearch.org/history.html#log31 Reference: BID:4724 Reference: URL:http://www.securityfocus.com/bid/4724 Reference: XF:mnogosearch-search-cgi-bo(9060) Reference: URL:http://www.iss.net/security_center/static/9060.php Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: a vague comment in the product history page includes an item for version 3.1.20 dated "27 Jun 2002," which states "Security bug has been fixed." This is not sufficient proof that the vendor has fixed *this* issue. HOWEVER, the ChangeLog in the source code for 3.1.20 includes an item dated 27 Jun 2002, which says "A security bug (trap on too long queries) fixed," which *does* qualify as sufficient proof. INFERRED ACTION: CAN-2002-0789 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0790 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0790 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: AIXAPAR:IY24556 Reference: URL:http://techsupport.services.ibm.com/server/aix.uhuic_getrec?args=DVsteamboat.boulder.ibm.com+DBAIX2+DA6854+STIY24556+USbin clchkspuser and clpasswdremote in AIX expose an encrypted password in the cspoc.log file, which could allow local users to gain privileges. Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0790 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Cox, Wall, Foat, Armstrong ====================================================== Candidate: CAN-2002-0794 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0794 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:26 Reference: URL:http://archives.neohapsis.com/archives/freebsd/2002-05/0349.html Reference: BID:4879 Reference: URL:http://www.securityfocus.com/bid/4879 Reference: XF:freebsd-accept-filter-dos(9209) Reference: URL:http://www.iss.net/security_center/static/9209.php The accept_filter mechanism in FreeBSD 4 through 4.5 does not properly remove entries from the incomplete listen queue when adding a syncache, which allows remote attackers to cause a denial of service (network service availability) via a large number of connection attempts, which fills the queue. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0794 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0795 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0795 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: FREEBSD:FreeBSD-SA-02:27 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:27.rc.asc Reference: XF:freebsd-rc-delete-directories(9217) Reference: URL:http://www.iss.net/security_center/static/9217.php Reference: BID:4880 Reference: URL:http://www.securityfocus.com/bid/4880 The rc system startup script for FreeBSD 4 through 4.5 allows local users to delete arbitrary files via a symlink attack on X Windows lock files. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0795 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0801 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0801 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020726 Assigned: 20020725 Category: SF Reference: VULNWATCH:20020529 [VulnWatch] FW: Macromedia JRUN Buffer overflow vulnerability (#NISR29052002) Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0085.html Reference: BUGTRAQ:20020529 Addendum to advisory #NISR29052002 (JRun buffer overflow) Reference: URL:http://online.securityfocus.com/archive/1/274601 Reference: BUGTRAQ:20020529 Macromedia JRUN Buffer overflow vulnerability (#NISR29052002) Reference: URL:http://online.securityfocus.com/archive/1/274528 Reference: CERT-VN:VU#703835 Reference: URL:http://www.kb.cert.org/vuls/id/703835 Reference: CERT:CA-2002-14 Reference: URL:http://www.cert.org/advisories/CA-2002-14.html Reference: XF:jrun-isapi-host-bo(9194) Reference: URL:http://www.iss.net/security_center/static/9194.php Reference: BID:4873 Reference: URL:http://www.securityfocus.com/bid/4873 Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0801 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Wall NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0802 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0802 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: MISC:http://marc.theaimsgroup.com/?l=postgresql-general&m=102032794322362 Reference: REDHAT:RHSA-2002:149 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-149.html Reference: XF:postgresql-sqlascii-sql-injection(10328) Reference: URL:http://www.iss.net/security_center/static/10328.php The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted, which could remove an escape character from the query and make the application subject to SQL injection attacks. Modifications: ADDREF REDHAT:RHSA-2002:149 ADDREF XF:postgresql-sqlascii-sql-injection(10328) Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0802 ACCEPT (7 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Jones MODIFY(2) Frech, Cox NOOP(1) Foat Voter Comments: Cox> ADDREF:REDHAT:RHSA-2002:149 Frech> XF:postgresql-sqlascii-sql-injection(10328) ====================================================== Candidate: CAN-2002-0804 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0804 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 Prior To 2.14.2, 2.16 Prior To 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=129466 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-reversedns-hostname-spoof(9301) Reference: URL:http://www.iss.net/security_center/static/9301.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname. Modifications: ADDREF XF:bugzilla-reversedns-hostname-spoof(9301) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0804 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:bugzilla-reversedns-hostname-spoof(9301) ====================================================== Candidate: CAN-2002-0805 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0805 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=134575 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-world-writable-dir(9302) Reference: URL:http://www.iss.net/security_center/static/9302.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions, which allows local users to modify the files and execute code. Modifications: ADDREF XF:bugzilla-world-writable-dir(9302) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0805 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:bugzilla-world-writable-dir(9302) ====================================================== Candidate: CAN-2002-0806 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0806 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=141557 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-edituser-user-delete(9303) Reference: URL:http://www.iss.net/security_center/static/9303.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option. Modifications: ADDREF XF:bugzilla-edituser-user-delete(9303) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0806 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:bugzilla-edituser-user-delete(9303) ====================================================== Candidate: CAN-2002-0808 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0808 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=107718 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-masschange-change-groupset(9305) Reference: URL:http://www.iss.net/security_center/static/9305.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently cause insecure groupset permissions to be assigned to some bugs. Modifications: ADDREF XF:bugzilla-masschange-change-groupset(9305) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0808 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:bugzilla-masschange-change-groupset(9305) ====================================================== Candidate: CAN-2002-0809 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0809 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=148674 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-group-permissions-removal(10141) Reference: URL:http://www.iss.net/security_center/static/10141.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names. Modifications: ADDREF XF:bugzilla-group-permissions-removal(10141) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0809 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF: bugzilla-group-permissions-removal(10141) ====================================================== Candidate: CAN-2002-0810 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0810 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020729 Category: SF Reference: BUGTRAQ:20020608 [BUGZILLA] Security Advisory For Versions of Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html Reference: CONFIRM:http://bugzilla.mozilla.org/show_bug.cgi?id=92263 Reference: REDHAT:RHSA-2002:109 Reference: BID:4964 Reference: URL:http://online.securityfocus.com/bid/4964 Reference: XF:bugzilla-shadow-database-information(9306) Reference: URL:http://www.iss.net/security_center/static/9306.php Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails. Modifications: ADDREF XF:bugzilla-shadow-database-information(9306) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0810 ACCEPT (4 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall MODIFY(1) Frech NOOP(1) Foat Voter Comments: Frech> XF:bugzilla-shadow-database-information(9306) ====================================================== Candidate: CAN-2002-0813 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0813 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020730 Category: SF Reference: BUGTRAQ:20020727 Phenoelit Advisory, 0815 ++ * - Cisco_tftp Reference: URL:http://online.securityfocus.com/archive/1/284634 Reference: CISCO:20020730 TFTP Long Filename Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/ios-tftp-long-filename-pub.shtml Reference: BUGTRAQ:20020822 Cisco IOS exploit PoC Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103002169829669&w=2 Reference: XF:cisco-tftp-filename-bo(9700) Reference: URL:http://www.iss.net/security_center/static/9700.php Reference: BID:5328 Reference: URL:http://www.securityfocus.com/bid/5328 Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of service (reset) or modify configuration via a long filename. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0813 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0814 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0814 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020730 Category: SF Reference: BUGTRAQ:20020724 VMware GSX Server Remote Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102752511030425&w=2 Reference: BUGTRAQ:20020726 Re: VMware GSX Server Remote Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102765223418716&w=2 Reference: NTBUGTRAQ:20020805 VMware GSX Server 2.0.1 Release and Security Alert Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0057.html Reference: CONFIRM:http://www.vmware.com/download/gsx_security.html Reference: XF:vmware-gsx-auth-bo(9663) Reference: URL:http://www.iss.net/security_center/static/9663.php Reference: BID:5294 Reference: URL:http://www.securityfocus.com/bid/5294 Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0814 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Foat NOOP(2) Cox, Wall ====================================================== Candidate: CAN-2002-0816 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0816 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020731 Category: SF Reference: BUGTRAQ:20020719 tru64 proof of concept /bin/su non-exec bypass Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102709593117171&w=2 Reference: COMPAQ:SSRT2257 Reference: URL:http://archives.neohapsis.com/archives/tru64/2002-q3/0019.html Reference: BID:5272 Reference: URL:http://online.securityfocus.com/bid/5272 Reference: XF:tru64-su-bo(9640) Reference: URL:http://www.iss.net/security_center/static/9640.php Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0816 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Cole, Baker NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0817 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0817 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020801 Category: SF Reference: BUGTRAQ:20020731 The SUPER Bug Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102812622416695&w=2 Reference: VULNWATCH:20020730 The SUPER Bug Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0045.html Reference: DEBIAN:DSA-139 Reference: URL:http://www.debian.org/security/2002/dsa-139 Reference: XF:super-syslog-format-string(9741) Reference: URL:http://www.iss.net/security_center/static/9741.php Reference: BID:5367 Reference: URL:http://www.securityfocus.com/bid/5367 Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument. Modifications: ADDREF VULNWATCH:20020730 [VulnWatch] The SUPER Bug ADDREF XF:super-syslog-format-string(9741) ADDREF BID:5367 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0817 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Wall NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:super-syslog-format-string(9741) URL:http://www.iss.net/security_center/static/9741.php VULNWATCH:20020730 [VulnWatch] The SUPER Bug URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0045.html BID:5367 URL:http://www.securityfocus.com/bid/5367 ====================================================== Candidate: CAN-2002-0818 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0818 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020801 Category: SF Reference: BUGTRAQ:20020718 wwwoffle-2.7b and prior segfaults with negative Content-Length value Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0194.html Reference: SUSE:SuSE-SA:2002:029 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102821890317683&w=2 Reference: DEBIAN:DSA-144 Reference: URL:http://www.debian.org/security/2002/dsa-144 Reference: CALDERA:CSSA-2002-048.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-048.0.txt Reference: XF:wwwoffle-neg-length-bo(9619) Reference: URL:http://www.iss.net/security_center/static/9619.php Reference: BID:5260 Reference: URL:http://www.securityfocus.com/bid/5260 wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value. Modifications: ADDREF CALDERA:CSSA-2002-048.0 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0818 ACCEPT (3 accept, 3 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> CALDERA:CSSA-2002-048.0 ====================================================== Candidate: CAN-2002-0823 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0823 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020802 Category: SF Reference: BUGTRAQ:20020801 Winhelp32 Remote Buffer Overrun Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102822806329440&w=2 Reference: NTBUGTRAQ:20020801 Winhlp32.exe Remote BufferOverrun Reference: MSKB:Q293338 Reference: URL:http://support.microsoft.com/default.aspx?scid=kb;en-us;q293338 Reference: XF:htmlhelp-item-bo(9746) Reference: URL:http://www.iss.net/security_center/static/9746.php Reference: BID:4857 Reference: URL:http://www.securityfocus.com/bid/4857 Buffer overflow in Winhlp32.exe allows remote attackers to execute arbitrary code via an HTML document that calls the HTML Help ActiveX control (HHCtrl.ocx) with a long pathname in the Item parameter. Modifications: ADDREF XF:htmlhelp-item-bo(9746) ADDREF BID:4857 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0823 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Wall NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:htmlhelp-item-bo(9746) URL:http://www.iss.net/security_center/static/9746.php BID:4857 URL:http://www.securityfocus.com/bid/4857 MSKB:Q293338 URL:http://support.microsoft.com/default.aspx?scid=kb;[LN];Q293338 ====================================================== Candidate: CAN-2002-0824 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0824 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020803 Category: SF Reference: FREEBSD:FreeBSD-SA-02:32.pppd Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102812546815606&w=2 Reference: NETBSD:NetBSD-SA2002-010 Reference: URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-010.txt.asc Reference: OPENBSD:20020729 011: SECURITY FIX: July 29, 2002 Reference: URL:http://www.openbsd.org/errata31.html Reference: XF:pppd-race-condition(9738) Reference: URL:http://www.iss.net/security_center/static/9738.php Reference: BID:5355 Reference: URL:http://www.securityfocus.com/bid/5355 BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device. Modifications: DESC Add "BSD" ADDREF XF:pppd-race-condition(9738) ADDREF BID:5355 ADDREF OPENBSD:20020729 011: SECURITY FIX: July 29, 2002 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0824 ACCEPT (3 accept, 3 ack, 0 review) Current Votes: ACCEPT(2) Cole, Baker MODIFY(1) Cox NOOP(3) Christey, Wall, Foat Voter Comments: Cox> change to "BSD pppd" Christey> XF:pppd-race-condition(9738) URL:http://www.iss.net/security_center/static/9738.php BID:5355 URL:http://www.securityfocus.com/bid/5355 ====================================================== Candidate: CAN-2002-0826 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0826 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020806 Category: SF Reference: ATSTAKE:A080802-1 Reference: URL:http://www.atstake.com/research/advisories/2002/a080802-1.txt Reference: CONFIRM:http://www.ipswitch.com/Support/WS_FTP-Server/patch-upgrades.html Reference: XF:wsftp-site-cpwd-bo(9794) Reference: URL:http://www.iss.net/security_center/static/9794.php Reference: BID:5427 Reference: URL:http://www.securityfocus.com/bid/5427 Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command. Modifications: ADDREF XF:wsftp-site-cpwd-bo(9794) ADDREF BID:5427 Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor's patches/upgrades page includes an item for 3.1.2 that "corrects a security issue relating to the processing of the SITE CPWD command... Fixed buffer overrun in CPWD command" INFERRED ACTION: CAN-2002-0826 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Wall NOOP(3) Christey, Cox, Foat Voter Comments: Christey> XF:wsftp-site-cpwd-bo(9794) URL:http://www.iss.net/security_center/static/9794.php BID:5427 URL:http://www.securityfocus.com/bid/5427 ====================================================== Candidate: CAN-2002-0829 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0829 Final-Decision: Interim-Decision: 20030326 Modified: 20030324-01 Proposed: 20020830 Assigned: 20020806 Category: SF Reference: FREEBSD:FreeBSD-SA-02:35.ffs Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102865404413458&w=2 Reference: XF:freebsd-ffs-integer-overflow(9771) Reference: URL:http://www.iss.net/security_center/static/9771.php Reference: BID:5399 Reference: URL:http://www.securityfocus.com/bid/5399 Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system. Modifications: ADDREF XF:freebsd-ffs-integer-overflow(9771) ADDREF BID:5399 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0829 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:freebsd-ffs-integer-overflow(9771) URL:http://www.iss.net/security_center/static/9771.php BID:5399 URL:http://www.securityfocus.com/bid/5399 ====================================================== Candidate: CAN-2002-0830 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0830 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020806 Category: SF Reference: FREEBSD:FreeBSD-SA-02:36.nfs Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102865517214722&w=2 Reference: CONFIRM:http://www.info.apple.com/usen/security/security_updates.html Reference: NETBSD:NetBSD-SA2002-013 Reference: URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-013.txt.asc Network File System (NFS) in FreeBSD 4.6.1 RELEASE-p7 and earlier, NetBSD 1.5.3 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service (hang) via an RPC message with a zero length payload, which causes NFS to reference a previous payload and enter an infinite loop. Modifications: ADDREF CONFIRM:http://www.info.apple.com/usen/security/security_updates.html ADDREF NETBSD:NetBSD-SA2002-013 DESC include other OSes Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: Apple acknowledges this in its security update dated 2002-11-21 (a direct reference could not be found). INFERRED ACTION: CAN-2002-0830 ACCEPT (3 accept, 3 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> CONFIRM:http://www.info.apple.com/usen/security/security_updates.html (Apple says "This is FreeBSD-SA-02:36.nfs") Christey> NETBSD:NetBSD-SA2002-013 URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-013.txt.asc ====================================================== Candidate: CAN-2002-0831 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0831 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020806 Category: SF Reference: FREEBSD:FreeBSD-SA-02:37.kqueue Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102865142610126&w=2 Reference: XF:freebsd-kqueue-dos(9774) Reference: URL:http://www.iss.net/security_center/static/9774.php Reference: BID:5405 Reference: URL:http://www.securityfocus.com/bid/5405 The kqueue mechanism in FreeBSD 4.3 through 4.6 STABLE allows local users to cause a denial of service (kernel panic) via a pipe call in which one end is terminated and an EVFILT_WRITE filter is registered for the other end. Modifications: ADDREF XF:freebsd-kqueue-dos(9774) ADDREF BID:5405 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0831 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> XF:freebsd-kqueue-dos(9774) URL:http://www.iss.net/security_center/static/9774.php BID:5405 URL:http://www.securityfocus.com/bid/5405 ====================================================== Candidate: CAN-2002-0845 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0845 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020809 Category: SF Reference: BUGTRAQ:20020808 EEYE: Sun(TM) ONE / iPlanet Web Server 4.1 and 6.0 Remote Buffer Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102890933623192&w=2 Reference: CONFIRM:http://www.sun.com/service/support/software/iplanet/alerts/transferencodingalert-23july2002.html Reference: XF:iplanet-chunked-encoding-bo(9799) Reference: URL:http://www.iss.net/security_center/static/9799.php Reference: BID:5433 Reference: URL:http://www.securityfocus.com/bid/5433 Buffer overflow in Sun ONE / iPlanet Web Server 4.1 and 6.0 allows remote attackers to execute arbitrary code via an HTTP request using chunked transfer encoding. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0845 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Baker, Wall, Foat NOOP(1) Cox ====================================================== Candidate: CAN-2002-0846 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0846 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020809 Category: SF Reference: BUGTRAQ:20020808 EEYE: Macromedia Shockwave Flash Malformed Header Overflow Reference: BUGTRAQ:20020830 RE: Macromedia Shockwave Flash Malformed Header Overflow Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103072708329280&w=2 Reference: CONFIRM:http://www.macromedia.com/v1/handlers/index.cfm?ID=23293 Reference: XF:flash-swf-header-bo(9798) Reference: URL:http://www.iss.net/security_center/static/9798.php Reference: BID:5430 Reference: URL:http://www.securityfocus.com/bid/5430 The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length. Modifications: ADDREF BUGTRAQ:20020830 RE: Macromedia Shockwave Flash Malformed Header Overflow ADDREF XF:flash-swf-header-bo(9798) ADDREF BID:5430 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0846 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Baker, Cox, Wall NOOP(2) Christey, Foat Voter Comments: Christey> BUGTRAQ:20020830 RE: Macromedia Shockwave Flash Malformed Header Overflow URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103072708329280&w=2 Christey> XF:flash-swf-header-bo(9798) URL:http://www.iss.net/security_center/static/9798.php BID:5430 URL:http://www.securityfocus.com/bid/5430 ====================================================== Candidate: CAN-2002-0847 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0847 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020809 Category: SF Reference: DEBIAN:DSA-145 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102874450402924&w=2 Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=88790 Reference: XF:tinyproxy-memory-corruption(9079) Reference: URL:http://www.iss.net/security_center/static/9079.php Reference: BID:4731 Reference: URL:http://www.securityfocus.com/bid/4731 tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free). Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: the vendor's changelog for 1.5.0 states: "Fixed a bunch of memory leaks, and situations where memory was being freed twice (a potential security problem.)" INFERRED ACTION: CAN-2002-0847 ACCEPT (3 accept, 2 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-0848 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0848 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020809 Category: SF Reference: CISCO:20020807 Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/vpn5k-radius-pap-vuln-pub.shtml Reference: XF:cisco-vpn5000-plaintext-password(9781) Reference: URL:http://www.iss.net/security_center/static/9781.php Reference: BID:5417 Reference: URL:http://www.securityfocus.com/bid/5417 Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol (PAP) or Challenge, sends the user password in cleartext in a validation retry request, which could allow remote attackers to steal passwords via sniffing. Modifications: ADDREF XF:cisco-vpn5000-plaintext-password(9781) ADDREF BID:5417 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0848 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Baker, Wall, Foat NOOP(2) Christey, Cox Voter Comments: Christey> XF:cisco-vpn5000-plaintext-password(9781) URL:http://www.iss.net/security_center/static/9781.php BID:5417 URL:http://www.securityfocus.com/bid/5417 ====================================================== Candidate: CAN-2002-0851 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0851 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020810 Category: SF Reference: VULNWATCH:20020809 Local Root Exploit Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0068.html Reference: SUSE:SuSE-SA:2002:030 Reference: XF:isdn4linux-ipppd-format-string(9811) Reference: URL:http://www.iss.net/security_center/static/9811.php Reference: BID:5437 Reference: URL:http://www.securityfocus.com/bid/5437 Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0851 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Wall NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0853 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0853 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020812 Category: SF Reference: CISCO:20020812 Cisco VPN Client Multiple Vulnerabilities Reference: URL:http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml Reference: CERT-VN:VU#287771 Reference: URL:http://www.kb.cert.org/vuls/id/287771 Reference: XF:cisco-vpn-zerolength-dos(9821) Reference: URL:http://www.iss.net/security_center/static/9821.php Reference: BID:5440 Reference: URL:http://www.securityfocus.com/bid/5440 Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload. Modifications: ADDREF CERT-VN:VU#287771 ADDREF XF:cisco-vpn-zerolength-dos(9821) ADDREF BID:5440 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0853 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Baker, Wall, Foat NOOP(2) Christey, Cox Voter Comments: Christey> CERT-VN:VU#287771 URL:http://www.kb.cert.org/vuls/id/287771 XF:cisco-vpn-zerolength-dos(9821) URL:http://www.iss.net/security_center/static/9821.php BID:5440 URL:http://www.securityfocus.com/bid/5440 ====================================================== Candidate: CAN-2002-0856 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0856 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020813 Category: SF Reference: ISS:20020813 Remote Denial of Service Vulnerability in Oracle9i SQL*NET Reference: URL:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20941 Reference: VULNWATCH:20020813 ISS Security Brief: Remote Denial of Service Vulnerability in Oracle9i SQL*NET Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0072.html Reference: CONFIRM:http://otn.oracle.com/deploy/security/pdf/2002alert38rev1.pdf Reference: XF:oracle-listener-debug-dos(9237) Reference: URL:http://www.iss.net/security_center/static/9237.php Reference: BID:5457 Reference: URL:http://www.securityfocus.com/bid/5457 SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature. Modifications: ADDREF BID:5457 ADDREF VULNWATCH:20020813 ISS Security Brief: Remote Denial of Service Vulnerability in Oracle9i SQL*NET Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0856 ACCEPT_ACK (2 accept, 2 ack, 0 review) Current Votes: ACCEPT(2) Armstrong, Baker NOOP(5) Cole, Christey, Cox, Wall, Foat Voter Comments: Christey> BID:5457 URL:http://www.securityfocus.com/bid/5457 VULNWATCH:20020813 ISS Security Brief: Remote Denial of Service Vulnerability in Oracle9i SQL*NET URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0072.html ====================================================== Candidate: CAN-2002-0859 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0859 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020815 Category: SF Reference: BUGTRAQ:20020619 Microsoft SQL Server 2000 OpenDataSource Buffer Overflow (#NISR19062002) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102450188620081&w=2 Reference: MISC:http://www.nextgenss.com/advisories/mssql-ods.txt Reference: XF:mssql-jet-ods-bo(9375) Reference: URL:http://www.iss.net/security_center/static/9375.php Reference: BID:5057 Reference: URL:http://www.securityfocus.com/bid/5057 Reference: MSKB:Q282010 Reference: URL:http://support.microsoft.com/default.aspx?scid=kb;[LN];Q282010 Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code. Modifications: ADDREF XF:mssql-jet-ods-bo(9375) ADDREF MSKB:Q282010 ADDREF BID:5057 ADDREF MISC:http://www.nextgenss.com/advisories/mssql-ods.txt Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: the KB article referenced by NGSSoftware does not explicitly acknowledge the issue; however, Microsoft did acknowledge the issue via an email inquiry. INFERRED ACTION: CAN-2002-0859 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Green, Baker, Wall MODIFY(1) Frech NOOP(2) Cox, Foat Voter Comments: Frech> XF:mssql-jet-ods-bo(9375) ====================================================== Candidate: CAN-2002-0860 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0860 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020815 Category: SF Reference: MS:MS02-044 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms02-044.asp Reference: BUGTRAQ:20020408 Reading local files with OWC in IE (GM#006-IE) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=101829911018463&w=2 Reference: XF:owc-spreadsheet-loadtext-read-files (8778) Reference: URL:http://www.iss.net/security_center/static/8778.php Reference: BID:4453 Reference: URL:http://online.securityfocus.com/bid/4453 The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0860 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Wall NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0871 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0871 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: DEBIAN:DSA-151 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102927065426172&w=2 Reference: MANDRAKE:MDKSA-2002:053 Reference: URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-053.php Reference: REDHAT:RHSA-2002:196 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-196.html Reference: BUGTRAQ:20020814 GLSA: xinetd Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102935383506155&w=2 Reference: XF:xinetd-signal-leak-dos(9844) Reference: URL:http://www.iss.net/security_center/static/9844.php Reference: BID:5458 Reference: URL:http://www.securityfocus.com/bid/5458 xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe. Modifications: DESC fix typo ADDREF MANDRAKE:MDKSA-2002:053 ADDREF XF:xinetd-signal-leak-dos(9844) ADDREF BID:5458 ADDREF REDHAT:RHSA-2002:196 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0871 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Baker, Cox, Foat NOOP(2) Christey, Wall Voter Comments: Christey> MANDRAKE:MDKSA-2002:053 URL:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-053.php XF:xinetd-signal-leak-dos(9844) URL:http://www.iss.net/security_center/static/9844.php BID:5458 URL:http://www.securityfocus.com/bid/5458 Christey> typo: "allow those services cause" Christey> REDHAT:RHSA-2002:196 fix typo: say "to cause" ====================================================== Candidate: CAN-2002-0872 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0872 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020813 New l2tpd release 0.68 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0102.html Reference: DEBIAN:DSA-152 Reference: URL:http://www.debian.org/security/2002/dsa-152 Reference: BID:5451 Reference: URL:http://www.securityfocus.com/bid/5451 Reference: XF:l2tpd-rand-number-predictable(9845) Reference: URL:http://www.iss.net/security_center/static/9845.php l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions. Modifications: ADDREF BUGTRAQ:20020813 New l2tpd release 0.68 ADDREF BID:5451 ADDREF XF:l2tpd-rand-number-predictable(9845) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0872 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BUGTRAQ:20020813 New l2tpd release 0.68 URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0102.html BID:5451 URL:http://www.securityfocus.com/bid/5451 XF:l2tpd-rand-number-predictable(9845) URL:http://www.iss.net/security_center/static/9845.php ====================================================== Candidate: CAN-2002-0873 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0873 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020813 New l2tpd release 0.68 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102925612907148&w=2 Reference: DEBIAN:DSA-152 Reference: URL:http://www.debian.org/security/2002/dsa-152 Reference: XF:l2tpd-vendor-field-bo(10460) Reference: URL:http://www.iss.net/security_center/static/10460.php Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via a buffer overflow. Modifications: ADDREF XF:l2tpd-vendor-field-bo(10460) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0873 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> Consider deleting the Bugtraq reference, as it doesn't seem to mention this issue, unless it's the one with the title "Fix some off by 6 errors in avp handling" ====================================================== Candidate: CAN-2002-0875 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0875 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: DEBIAN:DSA-154 Reference: URL:http://www.debian.org/security/2002/dsa-154 Reference: SGI:20000301-03-I Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20000301-03-I Reference: FREEBSD:FreeBSD-SN-02:05 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc Reference: BID:5487 Reference: URL:http://online.securityfocus.com/bid/5487 Reference: XF:sgi-fam-insecure-permissions(9880) Reference: URL:http://www.iss.net/security_center/static/9880.php Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group. Modifications: ADDREF SGI:20000301-03-I ADDREF FREEBSD:FreeBSD-SN-02:05 ADDREF BID:5487 ADDREF XF:sgi-fam-insecure-permissions(9880) Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0875 ACCEPT (3 accept, 3 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> SGI:20000301-03-I FREEBSD:FreeBSD-SN-02:05 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc BID:5487 URL:http://online.securityfocus.com/bid/5487 XF:sgi-fam-insecure-permissions(9880) URL:http://www.iss.net/security_center/static/9880.php ====================================================== Candidate: CAN-2002-0887 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0887 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20010522 [SRT2001-10] - scoadmin /tmp issues Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=99057164129869&w=2 Reference: CALDERA:CSSA-2002-SCO.22 Reference: URL:ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.22/CSSA-2002-SCO.22.txt Reference: BID:4875 Reference: URL:http://www.securityfocus.com/bid/4875 Reference: XF:openserver-scoadmin-symlink(9210) Reference: URL:http://www.iss.net/security_center/static/9210.php scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files. Modifications: DESC clarify role of log files Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: The Caldera advisory credits "Kevin Finisterre (dotslash@snosoft.com)" with this issue, and he is credited by the original poster to Bugtraq. INFERRED ACTION: CAN-2002-0887 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Frech MODIFY(1) Jones NOOP(2) Cox, Foat Voter Comments: Jones> Suggest removing "log" from CVE description (i.e., "... on temporary files."). Caldera indicates "temporary files", which could be other than log files; log file was used by discoverer as a proof-of-concept, but problem is application's creation and use of temporary files in general. ====================================================== Candidate: CAN-2002-0889 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0889 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: VULN-DEV:20020428 QPopper 4.0.4 buffer overflow Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102003707432457&w=2 Reference: BUGTRAQ:20020428 QPopper 4.0.4 buffer overflow Reference: URL:http://online.securityfocus.com/archive/1/269969 Reference: CALDERA:CSSA-2002-SCO.20 Reference: URL:ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.20/CSSA-2002-SCO.20.txt Reference: XF:qpopper-bulldir-bo(8949) Reference: URL:http://www.iss.net/security_center/static/8949.php Reference: BID:4614 Reference: URL:http://www.securityfocus.com/bid/4614 Buffer overflow in Qpopper (popper) 4.0.4 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a long bulldir argument in the user's .qpopper-options configuration file. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0889 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(6) Cole, Armstrong, Alderson, Baker, Frech, Jones NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-0891 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0891 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020527 Netscreen 25 unauthorised reboot issue Reference: URL:http://online.securityfocus.com/archive/1/274240 Reference: CONFIRM:http://www.netscreen.com/support/ns25_reboot.html Reference: XF:netscreen-screenos-username-dos(9186) Reference: URL:http://www.iss.net/security_center/static/9186.php Reference: BID:4842 Reference: URL:http://www.securityfocus.com/bid/4842 The web interface (WebUI) of NetScreen ScreenOS before 2.6.1r8, and certain 2.8.x and 3.0.x versions before 3.0.3r1, allows remote attackers to cause a denial of service (crash) via a long user name. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0891 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Frech MODIFY(1) Jones NOOP(3) Christey, Cox, Foat Voter Comments: Jones> Per NetScreen Alert, vulnerable versions should be: "versions prior to 2.6.1r8, 2.8.0r2, 2.8.1r1, 3.0.1r2, 3.0.2r3, and 3.0.3r1." Christey> The NetScreen alert referenced in the CONFIRM URL, dated June 3, 2002, says that the problem was "addressed in all versions of ScreenOS released after April 23, 2002. This list includes versions 2.6.1r8 and later, 2.8.0r2 and later, 2.8.1r1 and later, 3.0.1r2 and later, 3.0.2r3 and later, 3.0.3r1 and later" I've modified the description to reflect these ranges, though not to the level of detail covered by the advisory. ====================================================== Candidate: CAN-2002-0892 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0892 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: CF Reference: BUGTRAQ:20020522 Multiple vulnerabilities in NewAtlanta ServletExec ISAPI 4.1 Reference: URL:http://online.securityfocus.com/archive/1/273615 Reference: VULNWATCH:20020522 [VulnWatch] Multiple vulnerabilities in NewAtlanta ServletExec ISAPI 4.1 Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0077.html Reference: CONFIRM:http://www.newatlanta.com/do/findFaq?faq_id=151 Reference: BID:4793 Reference: URL:http://www.securityfocus.com/bid/4793 Reference: XF:servletexec-jsp10servlet-path-disclosure(9139) Reference: URL:http://www.iss.net/security_center/static/9139.php The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: The ServletExec FAQ item 151 has the question "If I request a JSP page that does not exist I receive a response in my browser which discloses the absolute path to my web server's document root or to the document root of my web application. Isn't this a security risk?" The response is: "Use the errorPage init parameter with the JSP10Servlet so that the JSP10Servlet will no longer use the default response which discloses the path." INFERRED ACTION: CAN-2002-0892 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Frech MODIFY(1) Jones NOOP(2) Cox, Foat Voter Comments: Jones> CVE description should read "... via a direct request to /servlet/com.newatlanta.servletexec.JSP10Servlet/ without ..." ====================================================== Candidate: CAN-2002-0897 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0897 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: VULNWATCH:20020524 [SecurityOffice] LocalWeb2000 Web Server Protected File Access Vulnerability Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0079.html Reference: BUGTRAQ:20020524 [SecurityOffice] LocalWeb2000 Web Server Protected File Access Vulnerability Reference: URL:http://online.securityfocus.com/archive/1/274020 Reference: BID:4820 Reference: URL:http://www.securityfocus.com/bid/4820 Reference: XF:localweb2k-protection-bypass(9165) Reference: URL:http://www.iss.net/security_center/static/9165.php LocalWEB2000 2.1.0 web server allows remote attackers to bypass access restrictions for restricted files via a URL that contains the "/./" directory. Modifications: CHANGEREF VULNWATCH [normalize] Analysis -------- Vendor Acknowledgement: ACKNOWLEDGEMENT: email inquiry sent to bugalert@intranet-server.co.uk on July 28, 2002. INFERRED ACTION: CAN-2002-0897 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Alderson, Frech, Jones NOOP(4) Cole, Armstrong, Cox, Foat ====================================================== Candidate: CAN-2002-0898 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0898 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: NTBUGTRAQ:20020527 Reading ANY local file in Opera (GM#001-OP) Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102256058220402&w=2 Reference: BUGTRAQ:20020527 Reading ANY local file in Opera (GM#001-OP) Reference: URL:http://online.securityfocus.com/archive/1/274202 Reference: CONFIRM:http://www.opera.com/windows/changelog/log603.html Reference: BID:4834 Reference: URL:http://www.securityfocus.com/bid/4834 Reference: XF:opera-browser-file-retrieval(9188) Reference: URL:http://www.iss.net/security_center/static/9188.php Opera 6.0.1 and 6.0.2 allows a remote web site to upload arbitrary files from the client system, without prompting the client, via an input type=file tag whose value contains a newline. Modifications: DESC fix typo Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the change log for Opera 6.0.3 says "Fixed security issue with file upload, as reported by GreyMagic Software," the discoverers of the issue. INFERRED ACTION: CAN-2002-0898 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Frech MODIFY(1) Jones NOOP(2) Cox, Foat Voter Comments: Jones> "arbiotrary" should be "arbitrary". ====================================================== Candidate: CAN-2002-0900 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0900 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020524 pks public key server DOS and remote execution Reference: URL:http://online.securityfocus.com/archive/1/274107 Reference: CONFIRM:http://www.rubin.ch/pgp/src/patch_buffoverflow20020525 Reference: BID:4828 Reference: URL:http://www.securityfocus.com/bid/4828 Reference: XF:pgp-pks-search-bo(9171) Reference: URL:http://www.iss.net/security_center/static/9171.php Buffer overflow in pks PGP public key web server before 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long search argument to the lookup capability. Modifications: ADDREF CONFIRM:http://www.rubin.ch/pgp/src/patch_buffoverflow20020525 Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: The PKS developer, Richard Laager, sent an email February 25, 2003, saying that a patch was available. He also said that 0.9.5 and later versions were fixed. INFERRED ACTION: CAN-2002-0900 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Alderson, Frech NOOP(6) Foat, Cole, Armstrong, Christey, Cox, Jones Voter Comments: Jones> Unclear which versions are vulnerable. Christey> The PKS developer, Richard Laager, sent an email February 25, 2003, saying that a patch was available. CONFIRM:http://www.rubin.ch/pgp/src/patch_buffoverflow20020525 He also says that 0.9.5 and later versions were fixed. ====================================================== Candidate: CAN-2002-0904 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0904 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: VULN-DEV:20020529 New Kismet Packages available - SayText() and suid kismet_server issues Reference: URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102269718506080&w=2 Reference: BUGTRAQ:20020528 New Kismet Packages available - SayText() and suid kismet_server issues Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0259.html Reference: CONFIRM:http://www.kismetwireless.net/CHANGELOG Reference: BID:4883 Reference: URL:http://www.securityfocus.com/bid/4883 Reference: XF:kismet-saytext-command-execution(9213) Reference: URL:http://www.iss.net/security_center/static/9213.php SayText function in Kismet 2.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters (backtick or pipe) in the essid argument. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: In the vendor changelog, an entry dated "May 27 2002" says "Fixed remote-exploitable hole (ack!) with specially crafted SSID's" INFERRED ACTION: CAN-2002-0904 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(6) Cole, Armstrong, Alderson, Baker, Frech, Jones NOOP(2) Foat, Cox ====================================================== Candidate: CAN-2002-0906 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0906 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: CERT-VN:VU#814627 Reference: URL:http://www.kb.cert.org/vuls/id/814627 Reference: CONFIRM:http://www.sendmail.org/8.12.5.html Reference: BID:5122 Reference: URL:http://www.securityfocus.com/bid/5122 Reference: XF:sendmail-dns-txt-bo(9443) Reference: URL:http://www.iss.net/security_center/static/9443.php Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malicious DNS server. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0906 ACCEPT (7 accept, 2 ack, 0 review) Current Votes: ACCEPT(7) Foat, Cole, Green, Baker, Frech, Cox, Wall ====================================================== Candidate: CAN-2002-0911 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0911 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: CALDERA:CSSA-2002-024.0 Reference: URL:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-024.0.txt Reference: BID:4923 Reference: URL:http://www.securityfocus.com/bid/4923 Reference: XF:volution-manager-plaintext-password(9240) Reference: URL:http://www.iss.net/security_center/static/9240.php Caldera Volution Manager 1.1 stores the Directory Administrator password in cleartext in the slapd.conf file, which could allow local users to gain privileges. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0911 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0914 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0914 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020601 SECURITY.NNOV: Courier CPU exhaustion + bonus on imap-uw Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0295.html Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=93065 Reference: BID:4908 Reference: URL:http://www.securityfocus.com/bid/4908 Reference: XF:courier-mta-year-dos(9228) Reference: URL:http://www.iss.net/security_center/static/9228.php Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year, which causes a tight loop. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the changelog includes an item dated 2002-05-20 that says "rfc822_parsedt.c (rfc822_parsedt): Ignore obviously invalid years (someone else can worry about Y10K)." INFERRED ACTION: CAN-2002-0914 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0916 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0916 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: VULNWATCH:20020603 [VulnWatch] [DER #11] - Remotey exploitable fmt string bug in squid Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0087.html Reference: BUGTRAQ:20020604 [DER #11] - Remotey exploitable fmt string bug in squid Reference: URL:http://online.securityfocus.com/archive/1/275347 Reference: CONFIRM:http://www.squid-cache.org/Versions/v2/2.4/diff-2.4.STABLE6-2.4.STABLE7.gz Reference: BID:4929 Reference: URL:http://www.securityfocus.com/bid/4929 Reference: XF:msntauth-squid-format-string(9248) Reference: URL:http://www.iss.net/security_center/static/9248.php Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call. Analysis -------- Vendor Acknowledgement: yes diff ACKNOWLEDGEMENT: while there are no vendor advisories that explicitly mention the format string issues, it is obvious from the diff (and via e-mail confirmation) that major changes were made to the code, which addressed the format string and buffer overflow issues as originally reported. It should be noted that the Squid distribution is fixed, but the original Stellar-X is not (as of July 29). INFERRED ACTION: CAN-2002-0916 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0935 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0935 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: VULNWATCH:20020620 [VulnWatch] KPMG-2002025: Apache Tomcat Denial of Service Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0120.html Reference: BUGTRAQ:20020620 KPMG-2002025: Apache Tomcat Denial of Service Reference: URL:http://online.securityfocus.com/archive/1/277940 Reference: XF:tomcat-null-thread-dos(9396) Reference: URL:http://www.iss.net/security_center/static/9396.php Reference: BID:5067 Reference: URL:http://www.securityfocus.com/bid/5067 Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. Analysis -------- Vendor Acknowledgement: unknown discloser-claimed INFERRED ACTION: CAN-2002-0935 ACCEPT (4 accept, 0 ack, 0 review) Current Votes: ACCEPT(4) Cole, Green, Baker, Frech NOOP(3) Foat, Cox, Wall Voter Comments: Green> - SECURITYTRACKER REPORTS THAT THE ISSUE HAS BEEN ACKNOWLEDGED BY APACHE ====================================================== Candidate: CAN-2002-0938 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0938 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020614 XSS in CiscoSecure ACS v3.0 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0156.html Reference: BUGTRAQ:20020621 Re: XSS in CiscoSecure ACS v3.0 Reference: URL:http://online.securityfocus.com/archive/1/278222 Reference: BID:5026 Reference: URL:http://www.securityfocus.com/bid/5026 Reference: XF:ciscosecure-web-css(9353) Reference: URL:http://www.iss.net/security_center/static/9353.php Cross-site scripting vulnerability in CiscoSecure ACS 3.0 allows remote attackers to execute arbitrary script or HTML as other web users via the action argument in a link to setup.exe. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0938 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Green, Baker, Frech, Wall NOOP(2) Foat, Cox ====================================================== Candidate: CAN-2002-0941 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0941 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020617 nCipher Advisory #4: Console Java apps can leak passphrases on Windows Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0172.html Reference: BID:5024 Reference: URL:http://www.securityfocus.com/bid/5024 Reference: XF:ncipher-consolecallback-passphrase-leak(9354) Reference: URL:http://www.iss.net/security_center/static/9354.php The ConsoleCallBack class for nCipher running under JRE 1.4.0 and 1.4.0_01, as used by the TrustedCodeTool and possibly other applications, may leak a passphrase when the user aborts an application that is prompting for the passphrase, which could allow attackers to gain privileges. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0941 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Green, Baker, Frech NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-0945 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0945 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020608 SeaNox Devwex - Denial of Service and Directory traversal Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0056.html Reference: CONFIRM:http://www.seanox.de/projects.devwex.php Reference: XF:devwex-get-bo(9298) Reference: URL:http://www.iss.net/security_center/static/9298.php Reference: BID:4979 Reference: URL:http://www.securityfocus.com/bid/4979 Buffer overflow in SeaNox Devwex allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: The vendor's "Historie" page (accessible on the left hand menu) has an item dated June 1, 2002, which states (based on a Google translation): "the directory handling [was] revised around a safe and errortolerant path processing. The ms Java could be brought by ueberladene [long?] Requests to VM to [cause a] crash." INFERRED ACTION: CAN-2002-0945 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0946 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0946 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020608 SeaNox Devwex - Denial of Service and Directory traversal Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0056.html Reference: CONFIRM:http://www.seanox.de/projects.devwex.php Reference: BID:4978 Reference: URL:http://www.securityfocus.com/bid/4978 Reference: XF:devwex-dotdot-directory-traversal(9299) Reference: URL:http://www.iss.net/security_center/static/9299.php Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files via ..\ (dot dot) sequences in an HTTP request. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: The vendor's "Historie" page (accessible on the left hand menu) has an item dated June 1, 2002, which states (based on a Google translation): "the directory handling [was] revised around a safe and errortolerant path processing. The ms Java could be brought by ueberladene [long?] Requests to VM to [cause a] crash." INFERRED ACTION: CAN-2002-0946 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0947 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0947 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020612 Oracle Reports Server Buffer Overflow (#NISR12062002B) Reference: URL:http://online.securityfocus.com/archive/1/276524 Reference: VULNWATCH:20020612 [VulnWatch] Oracle Reports Server Buffer Overflow (#NISR12062002B) Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0097.html Reference: CERT-VN:VU#997403 Reference: URL:http://www.kb.cert.org/vuls/id/997403 Reference: CONFIRM:http://technet.oracle.com/deploy/security/pdf/reports6i_alert.pdf Reference: MISC:http://www.nextgenss.com/vna/ora-reports.txt Reference: BID:4848 Reference: URL:http://www.securityfocus.com/bid/4848 Reference: XF:oracle-reports-server-bo(9289) Reference: URL:http://www.iss.net/security_center/static/9289.php Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long database name parameter. Modifications: DESC clarify role of Oracle9iAS Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0947 ACCEPT (6 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Cole, Armstrong, Alderson, Baker, Frech MODIFY(1) Jones NOOP(2) Foat, Cox Voter Comments: Jones> Suggest description read "...for Oracle Reports Server 6i Release 6.0.8.18.0 and earlier...", removing "9iAS" since Oracle advisory states "any Oracle product" containing vulnerable version of the reports server. ====================================================== Candidate: CAN-2002-0952 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0952 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: CISCO:20020619 Cisco ONS15454 IP TOS Bit Vulnerability Reference: URL:http://www.cisco.com/warp/public/707/ons-tos-vuln-pub.shtml Reference: XF:cisco-ons-tcc-dos(9377) Reference: URL:http://www.iss.net/security_center/static/9377.php Reference: BID:5058 Reference: URL:http://www.securityfocus.com/bid/5058 Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0952 ACCEPT (5 accept, 1 ack, 0 review) Current Votes: ACCEPT(5) Cole, Green, Baker, Frech, Wall NOOP(2) Foat, Cox ====================================================== Candidate: CAN-2002-0953 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0953 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020617 PHP source injection in PHPAddress Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0182.html Reference: BUGTRAQ:20020619 Source Injection into PHPAddress Reference: URL:http://online.securityfocus.com/archive/1/277987 Reference: XF:phpaddress-include-remote-files(9379) Reference: URL:http://www.iss.net/security_center/static/9379.php Reference: BID:5039 Reference: URL:http://www.securityfocus.com/bid/5039 globals.php in PHP Address before 0.2f, with the PHP allow_url_fopen and register_globals variables enabled, allows remote attackers to execute arbitrary PHP code via a URL to the code in the LangCookie parameter. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-0953 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Green, Baker, Frech NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-0958 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0958 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020606 [ARL02-A12] PHP(Reactor) Cross Site Scripting Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0034.html Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=91877 Reference: XF:phpreactor-browse-xss(9280) Reference: URL:http://www.iss.net/security_center/static/9280.php Reference: BID:4952 Reference: URL:http://www.securityfocus.com/bid/4952 Cross-site scripting vulnerability in browse.php for PHP(Reactor) 1.2.7 allows remote attackers to execute script as other users via the go parameter in the comments section. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor changelog for 1.2.7p1 says "fixed 2 XSS errors." A source code diff of inc/global.inc.php in phpreactor-1.2.7 and phpreactor-1.2.7p1 shows that the only change was a call to strip_tags() when setting the $go variable. INFERRED ACTION: CAN-2002-0958 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0964 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0964 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020620 Half-life fake players bug Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0248.html Reference: XF:halflife-mulitple-player-dos(9412) Reference: URL:http://www.iss.net/security_center/static/9412.php Reference: BID:5076 Reference: URL:http://www.securityfocus.com/bid/5076 Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to the initial challenge with different cd_key values, which reaches the player limit and prevents other players from connecting until the original responses have timed out. Analysis -------- Vendor Acknowledgement: INFERRED ACTION: CAN-2002-0964 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Green, Baker, Frech NOOP(4) Foat, Cole, Cox, Wall ====================================================== Candidate: CAN-2002-0965 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0965 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020612 Oracle TNS Listener Buffer Overflow (#NISR12062002A) Reference: URL:http://online.securityfocus.com/archive/1/276526 Reference: VULNWATCH:20020612 [VulnWatch] Oracle TNS Listener Buffer Overflow (#NISR12062002A) Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0096.html Reference: CONFIRM:http://otn.oracle.com/deploy/security/pdf/net9_dos_alert.pdf Reference: BID:4845 Reference: URL:http://www.securityfocus.com/bid/4845 Reference: XF:oracle-listener-servicename-bo(9288) Reference: URL:http://www.iss.net/security_center/static/9288.php Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file. Modifications: DESC fix affected versions ADDREF XF:oracle-listener-servicename-bo(9288) Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: while the Oracle advisory itself does not explicitly mention a buffer overflow, the link to this document on Oracle's advisory page says "Buffer Overflow Vulnerability in Oracle Net (Oracle9i Database Server)." This, combined with the acknowledgement to the disclosers and correlated dates, provides sufficient information to indicate acknowledgement. INFERRED ACTION: CAN-2002-0965 ACCEPT (6 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Alderson, Baker MODIFY(2) Frech, Jones NOOP(2) Foat, Cox Voter Comments: Jones> Oracle 9i Database Server on Windows systems and Oracle 8 on VM allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when forming an error message prior to writing to a log file." Frech> XF:oracle-listener-servicename-bo(9288) ====================================================== Candidate: CAN-2002-0967 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0967 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020606 eDonkey 2000 ed2k: URL Buffer Overflow Reference: URL:http://online.securityfocus.com/archive/1/275708 Reference: CONFIRM:http://www.edonkey2000.com/ Reference: XF:edonkey2000-ed2k-filename-bo(9278) Reference: URL:http://www.iss.net/security_center/static/9278.php Reference: BID:4951 Reference: URL:http://www.securityfocus.com/bid/4951 Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long "ed2k:" URL. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: on the vendor's home page, an item dated 6.5.02 states "An security exploit in the windows GUI client has been fixed... Thanks to Shane Hird [the notifier] for pointing it out to us." INFERRED ACTION: CAN-2002-0967 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(2) Foat, Wall ====================================================== Candidate: CAN-2002-0968 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0968 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020816 Category: SF Reference: BUGTRAQ:20020613 Remote DoS in AnalogX SimpleServer:www 1.16 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0106.html Reference: BUGTRAQ:20020702 Re: Remote DoS in AnlaogX SimpleServer:www 1.16 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102563702928443&w=2 Reference: CONFIRM:http://www.analogx.com/contents/download/network/sswww.htm Reference: BID:5006 Reference: URL:http://www.securityfocus.com/bid/5006 Reference: XF:analogx-simpleserver-at-dos(9338) Reference: URL:http://www.iss.net/security_center/static/9338.php Buffer overflow in AnalogX SimpleServer:WWW 1.16 and earlier allows remote attackers to cause a denial of service (crash) and execute code via a long HTTP request method name. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the change log for version 1.23 says "Fixed possible exploit with large string commands." INFERRED ACTION: CAN-2002-0968 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Cole, Green, Baker, Frech NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-0981 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0981 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020822 Category: SF Reference: CALDERA:CSSA-2002-SCO.36 Reference: URL:ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.36/CSSA-2002-SCO.36.txt Reference: XF:openunix-unixware-ndcfg-bo(9945) Reference: URL:http://www.iss.net/security_center/static/9945.php Reference: BID:5551 Reference: URL:http://www.securityfocus.com/bid/5551 Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line. Modifications: ADDREF XF:openunix-unixware-ndcfg-bo(9945) ADDREF BID:5551 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0981 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Foat, Christey, Cox, Wall Voter Comments: Christey> XF:openunix-unixware-ndcfg-bo(9945) URL:http://www.iss.net/security_center/static/9945.php BID:5551 URL:http://www.securityfocus.com/bid/5551 ====================================================== Candidate: CAN-2002-0984 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0984 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020823 Category: SF Reference: BUGTRAQ:20020822 Light Security Advisory: Remotely-exploitable code execution Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0231.html Reference: DEBIAN:DSA-156 Reference: URL:http://www.debian.org/security/2002/dsa-156 Reference: XF:light-channel-execute-script(9943) Reference: URL:http://www.iss.net/security_center/static/9943.php Reference: BID:5555 Reference: URL:http://www.securityfocus.com/bid/5555 The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code. Modifications: ADDREF BUGTRAQ:20020822 Light Security Advisory: Remotely-exploitable code execution ADDREF XF:light-channel-execute-script(9943) ADDREF BID:5555 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0984 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(4) Foat, Christey, Cox, Wall Voter Comments: Christey> XF:light-channel-execute-script(9943) URL:http://www.iss.net/security_center/static/9943.php BID:5555 URL:http://www.securityfocus.com/bid/5555 Christey> BUGTRAQ:20020822 Light Security Advisory: Remotely-exploitable code execution URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0231.html XF:light-channel-execute-script(9943) URL:http://www.iss.net/security_center/static/9943.php BID:5555 URL:http://www.securityfocus.com/bid/5555 ====================================================== Candidate: CAN-2002-0987 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0987 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020826 Category: SF Reference: CALDERA:CSSA-2002-SCO.38 Reference: URL:ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38 Reference: XF:openunix-unixware-xsco-privileges(9976) Reference: URL:http://www.iss.net/security_center/static/9976.php Reference: BID:5575 Reference: URL:http://www.securityfocus.com/bid/5575 X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges. Modifications: ADDREF XF:openunix-unixware-xsco-privileges(9976) ADDREF BID:5575 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0987 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-0988 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0988 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020826 Category: SF Reference: CALDERA:CSSA-2002-SCO.38 Reference: URL:ftp://ftp.sco.com/pub/updates/OpenUNIX/CSSA-2002-SCO.38 Reference: XF:openunix-unixware-xsco-bo(9977) Reference: URL:http://www.iss.net/security_center/static/9977.php Reference: BID:5577 Reference: URL:http://www.securityfocus.com/bid/5577 Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities. Modifications: ADDREF XF:openunix-unixware-xsco-bo(9977) ADDREF BID:5577 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-0988 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Armstrong, Baker NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-0989 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0989 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020827 Category: SF Reference: CONFIRM:http://gaim.sourceforge.net/ChangeLog Reference: DEBIAN:DSA-158 Reference: URL:http://www.debian.org/security/2002/dsa-158 Reference: CONFIRM:http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=72728 Reference: MANDRAKE:MDKSA-2002:054 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:054 Reference: REDHAT:RHSA-2002:189 Reference: URL:http://www.redhat.com/support/errata/RHSA-2002-189.html Reference: CONECTIVA:CLA-2002:521 Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000521 Reference: HP:HPSBTL0209-067 Reference: URL:http://online.securityfocus.com/advisories/4471 Reference: FREEBSD:FreeBSD-SN-02:06 Reference: URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:06.asc Reference: BUGTRAQ:20020827 GLSA: gaim Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=103046442403404&w=2 Reference: BID:5574 Reference: URL:http://www.securityfocus.com/bid/5574 Reference: XF:gaim-url-handler-command-execution(9978) Reference: URL:http://www.iss.net/security_center/static/9978.php The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link. Modifications: ADDREF MANDRAKE:MDKSA-2002:054 ADDREF REDHAT:RHSA-2002:189 ADDREF CONECTIVA:CLA-2002:521 ADDREF HP:HPSBTL0209-067 ADDREF FREEBSD:FreeBSD-SN-02:06 ADDREF XF:gaim-url-handler-command-execution(9978) ADDREF BID:5574 Analysis -------- Vendor Acknowledgement: yes INFERRED ACTION: CAN-2002-0989 ACCEPT (4 accept, 5 ack, 0 review) Current Votes: ACCEPT(4) Cole, Armstrong, Baker, Cox NOOP(3) Foat, Christey, Wall Voter Comments: Christey> ADDREF MANDRAKE:MDKSA-2002:054 Christey> REDHAT:RHSA-2002:189 URL:http://www.redhat.com/support/errata/RHSA-2002-189.html Christey> CONECTIVA:CLA-2002:521 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000521 BID:5574 URL:http://www.securityfocus.com/bid/5574 HP:HPSBTL0209-067 URL:http://online.securityfocus.com/advisories/4471 FREEBSD:FreeBSD-SN-02:06 URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:06.asc XF:gaim-url-handler-command-execution(9978) URL:http://www.iss.net/security_center/static/9978.php ====================================================== Candidate: CAN-2002-0995 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0995 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020702 PHPAuction bug Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0014.html Reference: CONFIRM:http://www.phpauction.org/viewnew.php?id=5 Reference: XF:phpauction-admin-account-creation(9462) Reference: URL:http://www.iss.net/security_center/static/9462.php Reference: BID:5141 Reference: URL:http://www.securityfocus.com/bid/5141 login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: the vendor's web site includes an advisory dated the day after the initial Bugtraq post, which states "This fix addresses the admin/login.php file and the possible security breach that could occur without this change. It now has certain security checks added for a safer admin back-end." INFERRED ACTION: CAN-2002-0995 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Cole, Baker, Frech NOOP(3) Foat, Cox, Wall ====================================================== Candidate: CAN-2002-1000 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1000 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020626 Foundstone Advisory - Buffer Overflow in AnalogX SimpleServer:Shout (fwd) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0338.html Reference: CONFIRM:http://www.analogx.com/contents/download/network/ssshout.htm Reference: BID:5104 Reference: URL:http://www.securityfocus.com/bid/5104 Reference: XF:analogx-simpleserver-shout-bo(9427) Reference: URL:http://www.iss.net/security_center/static/9427.php Buffer overflow in AnalogX SimpleServer:Shout 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long request to TCP port 8001. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the changelog on the vendor web site includes an entry for version 1.02 that "Fixed assert error found by Foundstone [the discloser]." INFERRED ACTION: CAN-2002-1000 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1002 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1002 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020812 NOVL-2002-2963081 - Novell iManager (eMFrame 1.2.1) DoS Attack Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0093.html Reference: BUGTRAQ:20020627 Cluestick Advisory #001 Reference: URL:http://online.securityfocus.com/archive/1/279683 Reference: XF:netware-imanage-username-dos(9444) Reference: URL:http://www.iss.net/security_center/static/9444.php Reference: BID:5117 Reference: URL:http://www.securityfocus.com/bid/5117 Buffer overflow in Novell iManager (eMFrame 1.2.1) allows remote attackers to cause a denial of service (crash) via a long user name. Analysis -------- Vendor Acknowledgement: yes followup INFERRED ACTION: CAN-2002-1002 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Green, Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1004 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1004 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020703 Argosoft Mail Server Plus/Pro Webmail Reverse Directory Traversal Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0029.html Reference: CONFIRM:http://www.argosoft.com/applications/mailserver/changelist.asp Reference: BID:5144 Reference: URL:http://www.securityfocus.com/bid/5144 Reference: XF:argosoft-dotdot-directory-traversal(9477) Reference: URL:http://www.iss.net/security_center/static/9477.php Directory traversal vulnerability in webmail feature of ArGoSoft Mail Server Plus or Pro 1.8.1.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in a URL. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor's change log includes an entry for 1.8.1.6 dated July 03, 2002, which states "Fixed security problem with the Webmail Reverse Directory Traversal, discovered by team n. finity [the discloser]." INFERRED ACTION: CAN-2002-1004 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1006 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1006 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020701 PTL-2002-03 Betsie XSS Vuln Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0002.html Reference: CONFIRM:http://www.bbc.co.uk/education/betsie/parser.pl.txt Reference: BID:5135 Reference: URL:http://www.securityfocus.com/bid/5135 Reference: XF:betsie-parserl-xss(9468) Reference: URL:http://www.iss.net/security_center/static/9468.php Cross-site scripting (XSS) vulnerability in BBC Education Text to Speech Internet Enhancer (Betsie) 1.5.11 and earlier allows remote attackers to execute arbitrary web script via parserl.pl. Modifications: DESC add "XSS" acronym Analysis -------- Vendor Acknowledgement: yes patch ACKNOWLEDGEMENT: the comments inside the parserl.pl script itself (version 1.5.12 on August 18, 2002) include a statement to "Beat cross-site scripting vulnerability," and the original Bugtraq poster is thanked at the top of the page. INFERRED ACTION: CAN-2002-1006 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1013 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1013 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020702 CORE-20020620: Inktomi Traffic Server Buffer Overflow Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0023.html Reference: CONFIRM:http://support.inktomi.com/kb/070202-003.html Reference: BID:5098 Reference: URL:http://www.securityfocus.com/bid/5098 Reference: XF:inktomi-trafficserver-manager-bo(9465) Reference: URL:http://www.iss.net/security_center/static/9465.php Buffer overflow in traffic_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.0.4 allows local users to gain root privileges via a long -path argument. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1013 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Frech> CONFIRM is now http://support.inktomi.com/kb/Private/070202-003.html, and is only available to customers with a current support contract. Christey> I will keep the original CONFIRM URL to indicate that, at one point in time, the entire public could access a confirmation note. ====================================================== Candidate: CAN-2002-1014 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1014 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020712 [SPSadvisory#48]RealONE Player Gold / RealJukebox2 Buffer Overflow Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0127.html Reference: CONFIRM:http://service.real.com/help/faq/security/bufferoverrun07092002.html Reference: XF:realplayer-rjs-controlnimage-bo(9538) Reference: URL:http://www.iss.net/security_center/static/9538.php Reference: BID:5217 Reference: URL:http://www.securityfocus.com/bid/5217 Buffer overflow in RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary code via an RFS skin file whose skin.ini contains a long value in a CONTROLnImage argument, such as CONTROL1Image. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1014 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1015 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1015 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020712 [SPSadvisory#47]RealONE Player Gold / RealJukebox2 skin file download vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0130.html Reference: CONFIRM:http://service.real.com/help/faq/security/bufferoverrun07092002.html Reference: XF:realplayer-rjs-file-download(9539) Reference: URL:http://www.iss.net/security_center/static/9539.php Reference: BID:5210 Reference: URL:http://www.securityfocus.com/bid/5210 RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local computer zone by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted, which is parsed as HTML by Internet Explorer or other Microsoft-based web readers. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1015 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1024 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1024 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: CERT-VN:VU#290140 Reference: URL:http://www.kb.cert.org/vuls/id/290140 Reference: CISCO:20020627 Scanning for SSH Can Cause a Crash Reference: URL:http://www.cisco.com/warp/public/707/SSH-scanning.shtml Reference: XF:cisco-ssh-scan-dos(9437) Reference: URL:http://www.iss.net/security_center/static/9437.php Reference: BID:5114 Reference: URL:http://www.securityfocus.com/bid/5114 Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet that was designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144). Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1024 ACCEPT (5 accept, 2 ack, 0 review) Current Votes: ACCEPT(5) Green, Baker, Frech, Wall, Cole NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-1025 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1025 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: VULNWATCH:20020701 [VulnWatch] KPMG-2002026: Jrun sourcecode Disclosure Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0138.html Reference: BUGTRAQ:20020701 KPMG-2002026: Jrun sourcecode Disclosure Reference: URL:http://online.securityfocus.com/archive/1/280062 Reference: CONFIRM:http://www.macromedia.com/v1/handlers/index.cfm?ID=23164 Reference: BID:5134 Reference: URL:http://www.securityfocus.com/bid/5134 Reference: XF:jrun-null-view-source(9459) Reference: URL:http://www.iss.net/security_center/static/9459.php JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1025 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1030 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1030 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: VULNWATCH:20020708 [VulnWatch] KPMG-2002029: Bea Weblogic Performance Pack Denial of Service Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html Reference: BUGTRAQ:20020708 KPMG-2002029: Bea Weblogic Performance Pack Denial of Service Reference: URL:http://online.securityfocus.com/archive/1/281046 Reference: CONFIRM:http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications&path=components%2Fdev2dev%2Fresourcelibrary%2Fadvisoriesnotifications%2Fadvisory_BEA02-19.htm Reference: BID:5159 Reference: URL:http://www.securityfocus.com/bid/5159 Reference: XF:weblogic-race-condition-dos(9486) Reference: URL:http://www.iss.net/security_center/static/9486.php Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections. Analysis -------- Vendor Acknowledgement: yes advisory ACKNOWLEDGEMENT: the advisory credits KPMG (the discloser) for discovering the issue. INFERRED ACTION: CAN-2002-1030 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1031 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1031 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020707 KF Web Server version 1.0.2 shows file and directory content Reference: URL:http://online.securityfocus.com/archive/1/281102 Reference: VULNWATCH:20020707 [VulnWatch] KF Web Server version 1.0.2 shows file and directory content Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0007.html Reference: CONFIRM:http://www.keyfocus.net/kfws/support/ Reference: BID:5177 Reference: URL:http://www.securityfocus.com/bid/5177 Reference: XF:kfwebserver-null-view-dir(9500) Reference: URL:http://www.iss.net/security_center/static/9500.php KeyFocus (KF) web server 1.0.2 allows remote attackers to list directories and read restricted files via an HTTP request containing a %00 (null) character. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor's change log for 1.0.3, dated July 4, 2002, states: "Security vulnerability - %00. If the requested URL contains a %00 after a directory name, then the server used to generate an index of the files in the directory." INFERRED ACTION: CAN-2002-1031 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1035 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1035 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: BUGTRAQ:20020701 BufferOverflow in OmniHTTPd 2.09 Reference: URL:http://online.securityfocus.com/archive/1/280132 Reference: XF:omnihttpd-http-version-bo(9457) Reference: URL:http://www.iss.net/security_center/static/9457.php Reference: BID:5136 Reference: URL:http://www.securityfocus.com/bid/5136 Omnicron OmniHTTPd 2.09 allows remote attackers to cause a denial of service (crash) via an HTTP request with a long, malformed HTTP 1version number. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: an email inquiry was sent to support@omnicron.ca on August 22, 2002, and the vendor replied on August 24 that the vulnerability was fixed in version 2.10. INFERRED ACTION: CAN-2002-1035 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1039 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1039 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020827 Category: SF Reference: VULNWATCH:20020714 [VulnWatch] Double Choco Latte multiple vulnerabilities Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0022.html Reference: BUGTRAQ:20020714 Double Choco Latte multiple vulnerabilities Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102668783632589&w=2 Reference: CONFIRM:http://dcl.sourceforge.net/index.php Reference: XF:dcl-dotdot-directory-traversal(9743) Reference: URL:http://www.iss.net/security_center/static/9743.php Directory traversal vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to read arbitrary files via .. (dot dot) sequences when downloading files from the Projects: Attachments feature. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor's changelog, dated July 6, 2002, states: "Fix to prevent file download spoofing." INFERRED ACTION: CAN-2002-1039 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1046 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1046 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020827 Category: SF Reference: VULNWATCH:20020709 KPMG-2002030: Watchguard Firebox Dynamic VPN Configuration Protocol DoS Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0012.html Reference: BID:5186 Reference: URL:http://www.securityfocus.com/bid/5186 Reference: XF:firebox-dvcp-dos(9509) Reference: URL:http://www.iss.net/security_center/static/9509.php Dynamic VPN Configuration Protocol service (DVCP) in Watchguard Firebox firmware 5.x.x allows remote attackers to cause a denial of service (crash) via a malformed packet containing tab characters to TCP port 4110. Modifications: CHANGEREF VULNWATCH [normalize] Analysis -------- Vendor Acknowledgement: unknown discloser-claimed INFERRED ACTION: CAN-2002-1046 ACCEPT (3 accept, 0 ack, 0 review) Current Votes: ACCEPT(3) Baker, Frech, Foat NOOP(3) Cox, Wall, Cole ====================================================== Candidate: CAN-2002-1049 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1049 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020729 HylaFAX - Various Vulnerabilities Fixed Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0358.html Reference: DEBIAN:DSA-148 Reference: URL:http://www.debian.org/security/2002/dsa-148 Reference: MANDRAKE:MDKSA-2002:055 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:055 Reference: SUSE:SuSE-SA:2002:035 Reference: URL:http://www.suse.de/de/security/2002_035_hylafax.html Reference: CONFIRM:http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=300 Reference: BID:5348 Reference: URL:http://www.securityfocus.com/bid/5348 Reference: XF:hylafax-faxgetty-tsi-dos(9728) Reference: URL:http://www.iss.net/security_center/static/9728.php Format string vulnerability in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service (crash) via the TSI data element. Modifications: ADDREF MANDRAKE:MDKSA-2002:055 ADDREF SUSE:SuSE-SA:2002:035 Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1049 ACCEPT_ACK (2 accept, 3 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> MANDRAKE:MDKSA-2002:055 Christey> SUSE:SuSE-SA:2002:035 ====================================================== Candidate: CAN-2002-1050 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1050 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020729 HylaFAX - Various Vulnerabilities Fixed Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0358.html Reference: DEBIAN:DSA-148 Reference: URL:http://www.debian.org/security/2002/dsa-148 Reference: CONFIRM:http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=312 Reference: MANDRAKE:MDKSA-2002:055 Reference: URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:055 Reference: SUSE:SuSE-SA:2002:035 Reference: URL:http://www.suse.de/de/security/2002_035_hylafax.html Reference: BID:5349 Reference: URL:http://www.securityfocus.com/bid/5349 Reference: XF:hylafax-faxgetty-image-bo(9729) Reference: URL:http://www.iss.net/security_center/static/9729.php Buffer overflow in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long line of image data. Modifications: ADDREF MANDRAKE:MDKSA-2002:055 ADDREF SUSE:SuSE-SA:2002:035 DESC fix typo Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1050 ACCEPT_ACK (2 accept, 3 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> MANDRAKE:MDKSA-2002:055 Christey> SUSE:SuSE-SA:2002:035 Close off parenthesis in desc. Christey> fix typo (extra parenthesis) ====================================================== Candidate: CAN-2002-1051 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1051 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020606 Format String bug in TrACESroute 6.0 GOLD Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-06/0040.html Reference: BUGTRAQ:20020721 Nanog traceroute format string exploit. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102737546927749&w=2 Reference: BUGTRAQ:20020723 Re: Nanog traceroute format string exploit. Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0254.html Reference: BUGTRAQ:20020724 Re: Nanog traceroute format string exploit. Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102753136231920&w=2 Reference: SUSE:SuSE-SA:2000:041 Reference: URL:http://www.suse.de/de/security/2000_041_traceroute_txt.html Reference: BID:4956 Reference: URL:http://www.securityfocus.com/bid/4956 Reference: XF:tracesroute-t-format-string(9291) Reference: URL:http://www.iss.net/security_center/static/9291.php Format string vulnerability in TrACESroute 6.0 GOLD (aka NANOG traceroute) allows local users to execute arbitrary code via the -T (terminator) command line argument. Analysis -------- Vendor Acknowledgement: yes followup NOTE: Debian confirmed via email that it is not vulnerable. INFERRED ACTION: CAN-2002-1051 ACCEPT (4 accept, 1 ack, 0 review) Current Votes: ACCEPT(4) Baker, Frech, Foat, Cole NOOP(1) Wall ====================================================== Candidate: CAN-2002-1053 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1053 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020817 W3C Jigsaw Proxy Server: Cross-Site Scripting Vulnerability (REPOST) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0190.html Reference: CONFIRM:http://www.w3.org/Jigsaw/RelNotes.html#2.2.1 Reference: BID:5506 Reference: URL:http://www.securityfocus.com/bid/5506 Reference: XF:jigsaw-http-proxy-xss(9914) Reference: URL:http://www.iss.net/security_center/static/9914.php Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a URL that contains a reference to a nonexistent host followed by the script, which is included in the resulting error message. Modifications: DESC add "XSS" term Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the vendor's changelog for 2.2.1 says "Added a flag to remove the URI from default error pages as well as the proxy module (SECURITY FIX: avoiding cross scripting attacks)." INFERRED ACTION: CAN-2002-1053 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1054 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1054 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020722 Pablo Sofware Solutions FTP server Directory Traversal Vulnerability Reference: URL:http://online.securityfocus.com/archive/1/283665 Reference: VULNWATCH:20020722 [VulnWatch] Pablo Sofware Solutions FTP server Directory Traversal Vulnerability Reference: URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0035.html Reference: CONFIRM:http://www.pablovandermeer.nl/ftpserversrc.zip Reference: BID:5283 Reference: URL:http://www.securityfocus.com/bid/5283 Reference: XF:pablo-ftp-directory-traversal(9647) Reference: URL:http://www.iss.net/security_center/static/9647.php Directory traversal vulnerability in Pablo FTP server 1.0 build 9 and earlier allows remote authenticated users to list arbitrary directories via "..\" (dot-dot backslash) sences in a LIST command. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the Release/whatsnew.txt file in the source code includes an item dated [07/21/2002], Version 1.10, states "Fixed security hole in GetDirectoryList (LIST \..\) (thanks to: http://www.sec uriteinfo.com) [the discloser]" INFERRED ACTION: CAN-2002-1054 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1057 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1057 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020723 MailMax security advisory/exploit/patch Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0245.html Reference: BID:5285 Reference: URL:http://www.securityfocus.com/bid/5285 Reference: XF:mailmax-pop3max-user-bo(9651) Reference: URL:http://www.iss.net/security_center/static/9651.php Buffer overflow in SmartMax MailMax POP3 daemon (popmax) 4.8 allows remote attackers to execute arbitrary code via a long USER command. Analysis -------- Vendor Acknowledgement: yes via-email ACKNOWLEDGEMENT: e-mail inquiry sent on August 28, 2002, via interface at https://supportcenteronline.com/ics/support/default.asp?deptID=468. Vendor acknowledged the issue on August 29: "This report is accurate and we have a patch fixing the issue available for our customers." INFERRED ACTION: CAN-2002-1057 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1059 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1059 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020723 Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102744150718462&w=2 Reference: BUGTRAQ:20020723 Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102746007908689&w=2 Reference: CONFIRM:http://www.vandyke.com/products/securecrt/security07-25-02.html Reference: XF:securecrt-ssh1-identifier-bo(9650) Reference: URL:http://www.iss.net/security_center/static/9650.php Reference: BID:5287 Reference: URL:http://www.securityfocus.com/bid/5287 Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string. Analysis -------- Vendor Acknowledgement: yes advisory INFERRED ACTION: CAN-2002-1059 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1060 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1060 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020724 CacheFlow CacheOS Cross-site Scripting Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0283.html Reference: CONFIRM:http://download.cacheflow.com/release/CA/4.1.00-docs/CACacheOS41fixes.htm Reference: BID:5305 Reference: URL:http://www.securityfocus.com/bid/5305 Reference: XF:cacheos-unresolved-error-xss(9674) Reference: URL:http://www.iss.net/security_center/static/9674.php Cross-site scripting (XSS) vulnerability in CacheFlow CacheOS 4.1.06 and earlier allows remote attackers to insert arbitrary HTML, including script, via a URL to a nonexistent hostname that includes the HTML, which is inserted into the resulting error message. Modifications: DESC add XSS term Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the changelog, dated 07/15/2002, includes the following item for V4.1.07(build 18110): "Modified default user-configurable error pages to eliminate cross-site scripting attack." INFERRED ACTION: CAN-2002-1060 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(3) Cox, Wall, Foat ====================================================== Candidate: CAN-2002-1076 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1076 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020725 IPSwitch IMail ADVISORY/EXPLOIT/PATCH Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0326.html Reference: BUGTRAQ:20020729 Hoax Exploit Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0363.html Reference: BUGTRAQ:20020729 Re: Hoax Exploit (2c79cbe14ac7d0b8472d3f129fa1df55 RETURNS) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0368.html Reference: CONFIRM:http://support.ipswitch.com/kb/IM-20020731-DM02.htm Reference: CONFIRM:http://support.ipswitch.com/kb/IM-20020729-DM01.htm Reference: BID:5323 Reference: URL:http://www.securityfocus.com/bid/5323 Reference: XF:imail-web-messaging-bo(9679) Reference: URL:http://www.iss.net/security_center/static/9679.php Buffer overflow in the Web Messaging daemon for Ipswitch IMail before 7.12 allows remote attackers to execute arbitrary code via a long HTTP GET request for HTTP/1.0. Analysis -------- Vendor Acknowledgement: yes changelog ACKNOWLEDGEMENT: the release notes for version 7.12 say "Fixed a buffer over-run which could result in a vulnerability (bugtraq id 5323)." INFERRED ACTION: CAN-2002-1076 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Wall, Cole NOOP(2) Cox, Foat ====================================================== Candidate: CAN-2002-1079 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1079 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020822 Abyss 1.0.3 directory traversal and administration bugs Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0229.html Reference: CONFIRM:http://www.aprelium.com/news/patch1033.html Reference: XF:abyss-get-directory-traversal(9941) Reference: URL:http://www.iss.net/security_center/static/9941.php Reference: XF:abyss-http-directory-traversal(9940) Reference: URL:http://www.iss.net/security_center/static/9940.php Reference: BID:5547 Reference: URL:http://www.securityfocus.com/bid/5547 Directory traversal vulnerability in Abyss Web Server 1.0.3 allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in an HTTP GET request. Modifications: ADDREF BID:5547 Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: the vendor includes a statement dated August 19, 2002, of a patch for 1.03 regarding "two bugs related to URLs decoding (thanks to Auriemma Luigi)," the original discloser. INFERRED ACTION: CAN-2002-1079 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BID:5547 URL:http://www.securityfocus.com/bid/5547 ====================================================== Candidate: CAN-2002-1081 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1081 Final-Decision: Interim-Decision: 20030326 Modified: 20030325-01 Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020822 Abyss 1.0.3 directory traversal and administration bugs Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-08/0229.html Reference: CONFIRM:http://www.aprelium.com/news/patch1033.html Reference: XF:abyss-plus-file-disclosure(9956) Reference: URL:http://www.iss.net/security_center/static/9956.php Reference: BID:5549 Reference: URL:http://www.securityfocus.com/bid/5549 The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP request to a target file that ends in a "+" character. Modifications: ADDREF BID:5549 Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: the vendor includes a statement dated August 19, 2002, of a patch for 1.03 regarding "two bugs related to URLs decoding (thanks to Auriemma Luigi)," the original discloser. INFERRED ACTION: CAN-2002-1081 ACCEPT (3 accept, 1 ack, 0 review) Current Votes: ACCEPT(3) Baker, Cole, Armstrong NOOP(4) Christey, Cox, Wall, Foat Voter Comments: Christey> BID:5549 URL:http://www.securityfocus.com/bid/5549 ====================================================== Candidate: CAN-2002-1088 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1088 Final-Decision: Interim-Decision: 20030326 Modified: Proposed: 20020830 Assigned: 20020830 Category: SF Reference: BUGTRAQ:20020725 Novell GroupWise 6.0.1 Support Pack 1 Bufferoverflow Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-07/0296.html Reference: CONFIRM:http://support.novell.com/servlet/tidfinder/2963273 Reference: BID:5313 Reference: URL:http://www.securityfocus.com/bid/5313 Reference: XF:groupwise-rcpt-bo(9671) Reference: URL:http://www.iss.net/security_center/static/9671.php Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1 allows remote attackers to execute arbitrary code via a long RCPT TO command. Analysis -------- Vendor Acknowledgement: yes ACKNOWLEDGEMENT: while the Novell TID does not itself contain vendor acknowledgement, the vendor's security advisory page has a link to the TID with the phrase "Buffer overflow in Novell GroupWise 6.0.1 Support Pack 1." INFERRED ACTION: CAN-2002-1088 ACCEPT_ACK (2 accept, 1 ack, 0 review) Current Votes: ACCEPT(2) Baker, Cole NOOP(3) Cox, Wall, Foat
- Prev by Date: [PROPOSAL] Cluster UNIX-2003a - 35 candidates
- Prev by thread: [PROPOSAL] Cluster UNIX-2003a - 35 candidates
- Index(es):
