ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets. http://www.openbsd.org/errata23.html#tcpfix Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems. 19981006-01-I J-006 121 Execute commands as root via buffer overflow in Tooltalk database server (rpc.ttdbserverd). 19981101-01-A 19981101-01-PX 122 MIME buffer overflow in email clients, e.g. Solaris mailtool and Outlook. MS98-008 Arbitrary command execution via IMAP buffer overflow in authenticate command. 00177 130 Buffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command. 19980801-01-I 133 Information from SSL-encrypted sessions via PKCS #1. MS98-002 Buffer overflow in NIS+, in Sun's rpc.nisd program. 00170 Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. 19980603-01-PX 00180 134 HPSBUX9808-083 Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages. 19980603-01-PX HPSBUX9808-083 Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer. 19980603-01-PX 00180 HPSBUX9808-083 Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names. Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user. Unauthorized privileged access or denial of service via dtappgather program in CDE. 00185 HPSBUX9801-075 Teardrop IP denial of service. oval:org.mitre.oval:def:5579 Land IP denial of service. HPSBUX9801-076 FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce. Buffer overflow in statd allows root privileges. 127 Delete or create a file via rpc.statd, due to invalid information. 00135 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0032. Reason: This candidate is a duplicate of CVE-1999-0032. Notes: All CVE users should reference CVE-1999-0032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Arbitrary command execution via buffer overflow in Count.cgi (wwwcount) cgi-bin program. 128 Local user gains root privileges via buffer overflow in rdist, via expstr() function. 00179 Local user gains root privileges via buffer overflow in rdist, via lookup() function. DNS cache poisoning via BIND, by predictable query IDs. root privileges via buffer overflow in df command on SGI IRIX systems. CA-1997-21 VU#20851 346 df-bo(440) root privileges via buffer overflow in pset command on SGI IRIX systems. root privileges via buffer overflow in eject command on SGI IRIX systems. root privileges via buffer overflow in login/scheme command on SGI IRIX systems. root privileges via buffer overflow in ordist command on SGI IRIX systems. root privileges via buffer overflow in xlock command on SGI IRIX systems. JavaScript in Internet Explorer 3.x and 4.x, and Netscape 2.x, 3.x and 4.x, allows remote attackers to monitor a user's web activities, aka the Bell Labs vulnerability. HPSBUX9707-065 Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option. 19980402-01-PX I-042 707 Command execution in Sun systems via buffer overflow in the at program. Buffer overflow in suidperl (sperl), Perl 4.x and 5.x. Race condition in signal handling routine in ftpd, allowing read/write arbitrary files. IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files. 19970508-02-PX H-106 sgi-lockout(557) Arbitrary command execution via metamail package using message headers, when user processes attacker's message using metamail. Buffer overflow in xlock program allows local users to execute commands as root. webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter. 19970501-02-PX CA-1997-12 374 http-sgi-webdist(333) Buffer overflow in Xt library of X Windowing System allows local users to execute commands with root privileges. Buffer overflow in NLS (Natural Language Service). Buffer overflow in University of Washington's implementation of IMAP and POP servers. Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and "rmgroup" control messages, and others. fsdump command in IRIX allows local users to obtain root access by modifying sensitive files. 19970301-01-P List of arbitrary files on Web host via nph-test-cgi script. Buffer overflow of rlogin program using TERM environmental variable. MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. 685 Talkd, when given corrupt DNS information, can be used to execute arbitrary commands with root privileges. 00147 Csetup under IRIX allows arbitrary file creation or overwriting. Buffer overflow in HP-UX newgrp program. Arbitrary file creation and program execution using FLEXlm LicenseManager, from versions 4.0 to 5.0, in IRIX. IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash. freebsd-ip-frag-dos(1389) TCP RST denial of service in FreeBSD. Sun's ftpd daemon can be subjected to a denial of service. 00171 Buffer overflows in Sun libnsl allow root access. 00172 IX80543 Buffer overflow in Sun's ping program can give root access to local users. 00174 Vacation program allows command execution by remote users through a sendmail command. HPSBUX9811-087 Buffer overflow in PHP cgi program, php.cgi allows shell access. 712 IRIX fam service allows an attacker to obtain a list of all files on the server. 353 irix-fam(325) Attackers can cause a denial of service in Ascend MAX and Pipeline routers with a malformed packet to the discard port, which is used by the Java Configurator tool. File creation and deletion, and remote execution, in the BSD line printer daemon (lpd). The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage. Cisco IOS 12.0 and other versions can be crashed by malicious UDP packets to the syslog port. Buffer overflow in AIX lquerylv program gives root access to local users. Multiple buffer overflows in how dtmail handles attachments allows a remote attacker to execute commands. 00181 AnyForm CGI remote execution. 719 phf CGI program allows remote command execution through shell metacharacters. CA-1996-06 629 CGI PHP mylog script allows an attacker to read any file on the target server. 713 Solaris ufsrestore buffer overflow. 00169 test-cgi program allows an attacker to list files on the server. Apache httpd cookie buffer overflow for versions 1.1.1 and earlier. Buffer overflow in AIX xdat gives root access to local users. Telnet allows a remote client to specify environment variables including LD_LIBRARY_PATH, allowing an attacker to bypass the normal system libraries and gain root access. Listening TCP ports are sequentially allocated, allowing spoofing attacks. PASV core dump in wu-ftpd daemon when attacker uses a QUOTE PASV command after specifying a username and password. Buffer overflow in wu-ftp from PASV command causes a core dump. Predictable TCP sequence numbers allow spoofing. tcp-seq-predict(139) pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call. Remote attackers can cause a denial of service in FTP by issuing multiple PASV commands, causing the server to run out of available ports. Certain configurations of wu-ftp FTP server 2.4 use a _PATH_EXECPATH setting to a directory with dangerous commands, such as /bin, which allows remote authenticated users to gain root access via the "site exec" command. wu-ftp allows files to be overwritten via the rnfr command. CWD ~root command in ftpd allows root access. Improving the Security of Your Site by Breaking Into it getcwd() file descriptor leak in FTP. Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0. nfs-mknod(78) Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname. rwhod-vuln(118) rwhod(119) AIX routed allows remote users to modify sensitive files. Denial of service in AIX telnet can freeze a system and prevent users from accessing the server. IRIX and AIX automountd services (autofsd) allow remote users to execute root commands. Buffer overflow in AIX libDtSvc library can allow local users to gain root access. Buffer overflow in AIX rcp command allows local users to obtain root access. Buffer overflow in AIX writesrv command allows local users to obtain root access. Various vulnerabilities in the AIX portmir command allows local users to obtain root access. AIX nslookup command allows local users to obtain root access by not dropping privileges correctly. AIX piodmgrsu command allows local users to gain additional group privileges. The debug command in Sendmail is enabled, allowing attackers to execute commands as root. 20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149) [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit [oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit 1 Sendmail decode alias can be used to overwrite sensitive files. 00122 The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character). Buffer overflow in SMTP HELO command in Sendmail allows a remote attacker to hide activities. Buffer overflow in syslog utility allows local or remote attackers to gain root privileges. Remote access in AIX innd 1.5.1, using control messages. Buffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names. H-13 Buffer overflow in SLmail 3.x allows attackers to execute commands using a large FROM line. Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm. https://ics-cert.us-cert.gov/advisories/ICSMA-18-233-01 A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2. 80175 oval:org.mitre.oval:def:5743 finger allows recursive searches by using a long string of @ symbols. Finger redirection allows finger bombs. Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters. The printers program in IRIX has a buffer overflow that gives root access to local users. 19970527 another day, another buffer overflow.... Buffer overflow in ffbconfig in Solaris 2.5.1. 00140 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0315. Reason: This candidate's original description had a typo that delayed it from being detected as a duplicate of CVE-1999-0315. Notes: All CVE users should reference CVE-1999-0315 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. RIP v1 is susceptible to spoofing. Buffer overflow in AIX dtterm program for the CDE. dtterm-bo(878) Some implementations of rlogin allow root access if given a -froot parameter. 458 Local users can execute commands as other users, and read other users' files, through the filter command in the Elm elm-2.4 mail package using a symlink attack. AIX bugfiler program allows local users to gain root access. 1800 Denial of service when an attacker sends many SYN packets to create multiple connections without ever sending an ACK to complete the connection, aka SYN flood. 19961202-01-PX 00136 AIX passwd allows local users to gain root access. AIX infod allows local users to gain root access through an X display. 19981119 RSI.0011.11-09-98.AIX.INFOD Windows NT 4.0 beta allows users to read and delete shares. Sun/Solaris utmp file allows local users to gain root access if it is writable by users other than root. 00126 Buffer overflow in dtaction command gives root access. Buffer overflow in AIX lchangelv gives root access. Race condition in Linux mailx command allows local users to read user files. Vulnerabilities in UMN gopher and gopher+ versions 1.12 and 2.0x allow an intruder to read any files that can be accessed by the gopher daemon. Buffer overflow in SGI IRIX mailx program. 19980605-01-PX SGI IRIX buffer overflow in xterm and Xaw allows root access. J-010 swinstall and swmodify commands in SD-UX package in HP-UX systems allow local users to create or overwrite arbitrary files to gain root access. Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death. Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file. Local users can start Sendmail in daemon mode and gain root privileges. 716 Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users. 717 Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access. CA-1996-19 expreserve(401) fm_fls license server for Adobe Framemaker allows local users to overwrite arbitrary files and gain root access. vold in Solaris 2.x allows local users to gain root access. admintool in Solaris allows a local user to write to arbitrary files and gain root access. Kodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access. The dip program on many Linux systems allows local users to gain root access via a buffer overflow. The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access. Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access. Denial of service in RAS/PPTP on NT systems. Java Bytecode Verifier allows malicious applets to execute arbitrary commands as the user of the applet. 00134 The Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts. Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys. Denial of service in Qmail by specifying a large number of recipients with the RCPT command. http://cr.yp.to/qmail/venema.html 19970612 qmail-dos-2.c, another denial of service attack 19970612 Re: Denial of service (qmail-smtpd) http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/threads.html 2237 qmail-rcpt(208) Sendmail WIZ command enabled, allowing root access. 20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149) Improving the Security of Your Site by Breaking Into it CA-1990-11 CA-1993-14 [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit [oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit 19950206 sendmail wizard thing... The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string, as demonstrated by reading the password file. 1975 http-cgi-campas(298) The aglimpse CGI program of the Glimpse package allows remote execution of arbitrary commands. The handler CGI program in IRIX allows arbitrary command execution. 19970501-02-PX 380 The wrap CGI program in IRIX allows remote attackers to view arbitrary directory listings via a .. (dot dot) attack. 19970501-02-PX 373 http-sgi-wrap(290) The Perl fingerd program allows arbitrary command execution from remote users. The SATAN session key may be disclosed if the user points the web browser to other sites, possibly allowing root access. The DG/UX finger daemon allows remote command execution through shell metacharacters. Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke. IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL. The ghostscript command with the -dSAFER option allows remote attackers to execute commands. wu-ftpd FTP daemon allows any user and password combination. Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service. Cisco PIX firewall manager (PFM) on Windows NT allows attackers to connect to port 8080 on the PFM server and retrieve any file whose name and location is known. 20010913 Cisco PIX Firewall Manager File Exposure Attackers can crash a Cisco IOS router or device, provided they can get to an interactive prompt (such as a login). This applies to some IOS 9.x, 10.x, and 11.x releases. Some classic Cisco IOS devices have a vulnerability in the PPP CHAP authentication to establish unauthorized PPP connections. In Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering. The "established" keyword in some Cisco IOS software allowed an attacker to bypass filtering. In older versions of Sendmail, an attacker could use a pipe character to execute root commands. A race condition in the Solaris ps command allows an attacker to overwrite critical files. NFS cache poisoning. NFS allows users to use a "cd .." command to access other directories besides the exported file system. In SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system. The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place. For example, NFS file systems could be mounted through the portmapper despite export restrictions. NFS allows attackers to read and write any file on the system by specifying a false UID. Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list. Denial of service in syslog by sending it a large number of superfluous messages. FormMail CGI program allows remote execution of commands. FormMail CGI program can be used by web servers other than the host server that the program resides on. The view-source CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack. The convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by the web server. The Webgais program allows a remote user to execute arbitrary commands. The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs. Buffer overflow in the win-c-sample program (win-c-sample.exe) in the WebSite web server 1.1e allows remote attackers to execute arbitrary code via a long query string. 19970106 Re: signal handling 2078 http-website-winsample(295) Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share. Q140818 in.rshd allows users to login with a NULL username and execute commands. The wall daemon can be used for denial of service, social engineering attacks, or to execute remote commands. Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password. H-110 Linux implementations of TFTP would allow access to files outside the restricted directory. When compiled with the -DALLOW_UPDATES option, bind allows dynamic updates to the DNS server, allowing for malicious modification of DNS records. In SunOS or Solaris, a remote user could connect from an FTP server's data port to an rlogin server on a host that trusts the FTP server, allowing remote command execution. 00156 In Solaris, an SNMP subagent has a default community string that allows remote attackers to execute arbitrary commands as root, or modify system parameters. http://support.novell.com/cgi-bin/search/searchtid.cgi?/10080762.htm ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0022. Reason: This candidate is a duplicate of CVE-1999-0022. Notes: All CVE users should reference CVE-1999-0022 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. The passwd command in Solaris can be subjected to a denial of service. 00182 Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111. 00142 Solaris rpcbind can be exploited to overwrite arbitrary files and gain root access. 00167 IIS newdsn.exe CGI script allows remote users to overwrite files. Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable. Denial of service in Ascend and 3com routers, which can be rebooted by sending a zero length TCP option. Denial of service in in.comsat allows attackers to generate messages. Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1. websendmail in Webgais 1.0 allows a remote user to access arbitrary files and execute arbitrary code via the receiver parameter ($VAR_receiver variable). 2077 finger 0@host on some systems may print information on some user accounts. finger .@host on some systems may print information on some user accounts. Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password. A quote cwd command on FTP servers can reveal the full path of the home directory of the "ftp" user. The GNU tar command, when used in FTP sessions, may allow an attacker to execute arbitrary commands. In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a program. Sendmail 8.6.9 allows remote attackers to execute root commands, using ident. Denial of service in Sendmail 8.6.11 and 8.6.12. MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command. rpc.ypupdated (NIS) allows remote users to execute arbitrary commands. The SunView (SunTools) selection_svc facility allows remote users to read files. 8 Automount daemon automountd allows local or remote users to gain privileges via shell metacharacters. 19971126 Solaris 2.5.1 automountd exploit (fwd) 19990103 SUN almost has a clue! (automountd) CA-99-05 235 HPSBUX9910-104 Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone. 24 Solaris rpc.mountd generates error messages that allow a remote attacker to determine what files are on the server. I-048 libnsl in Solaris allowed an attacker to perform a denial of service of rpcbind. Denial of service by sending forged ICMP unreachable packets. Routed allows attackers to append data to files. 19981004-01-PX J-012 Denial of service of inetd on Linux through SYN and RST packets. Malicious option settings in UDP packets could force a reboot in SunOS 4.1.3 systems. Livingston portmaster machines could be rebooted via a series of commands. Buffer overflow in FTP Serv-U 2.5 allows remote authenticated users to cause a denial of service (crash) via a long (1) CWD or (2) LS (list) command. 19990503 Buffer overflows in FTP Serv-U 2.5 19990504 Re: Buffer overflows in FTP Serv-U 2.5 269 ftp-servu(205) Attackers can do a denial of service of IRC by crashing the server. Denial of service of Ascend routers through port 150 (remote administration). Denial of service in Cisco IOS web server allows attackers to reboot the router using a long URL. Solaris syslogd crashes when receiving a message from a host that doesn't have an inverse DNS entry. http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?patchid=103291&collection=fpatches 1878 Denial of service in Windows NT messenger service through a long username. Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size. Q180963 19980214 Windows NT Logon Denial of Service Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service. Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service. Q154087 Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT. Q162567 Denial of service in Windows NT IIS server using ..\.. Buffer overflow in Cisco 7xx routers through the telnet service. Buffer overflow in IP-Switch IMail and Seattle Labs Slmail 2.6 packages using a long VRFY command, causing a denial of service and possibly remote access. Buffer overflow in NCSA WebServer (version 1.5c) gives remote access. IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files. Q148188 Q155056 Bash treats any character with a value of 255 as a command separator. Buffer overflow in NCSA WebServer (1.4.1 and below) gives remote access. ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. Remote execution of arbitrary commands through Guestbook CGI program. php.cgi allows attackers to read any file on the system. Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET. Some filters or firewalls allow fragmented SYN packets with IP reserved bits in violation of their implemented policy. Guessable magic cookies in X Windows allows remote attackers to execute commands, e.g. through xterm. Remote attackers can access mail files via POP3 in some Linux systems that are using shadow passwords. Linux cfingerd could be exploited to gain root access. Livingston RADIUS code has a buffer overflow which can allow remote execution of commands as root. Some configurations of NIS+ in Linux allowed attackers to log in as the user "+". HP Remote Watch allows a remote user to gain root access. Buffer overflow in nnrpd program in INN up to version 1.6 allows remote users to execute arbitrary commands. 19970721 INN news server vulnerabilities 1443 A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials. http://oliver.efri.hr/~crv/security/bugs/mUNIXes/ssh2.html http://www.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-6.html#ss6.1 Windows NT RSHSVC program allows remote users to execute arbitrary commands. Denial of service in Qmail through long SMTP commands. http://cr.yp.to/qmail/venema.html 19970612 qmail-dos-2.c, another denial of service attack http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/threads.html Denial of service in talk program allows remote attackers to disrupt a user's display. Buffer overflow in listserv allows arbitrary command execution. IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a . (dot) in the URL. A hidden SNMP community string in HP OpenView allows remote attackers to modify MIB tables and obtain sensitive information. Buffer overflow in ircd allows arbitrary command execution. Buffer overflow in War FTP allows remote execution of commands. Nestea variation of teardrop IP fragmentation denial of service. Bonk variation of teardrop IP fragmentation denial of service. cfingerd lists all users on a system via search.**@target. The jj CGI program allows command execution via shell metacharacters. Netmanager Chameleon SMTPd has several buffer overflows that cause a crash. http://www.insecure.org/sploits/netmanage.chameleon.overflows.html Hylafax faxsurvey CGI script on Linux allows remote attackers to execute arbitrary commands via shell metacharacters in the query string. 2056 http-cgi-faxsurvey(1532) Solaris SUNWadmap can be exploited to obtain root access. 00173 htmlscript CGI program allows remote read access to files. ICMP redirect messages may crash or lock up a host. Q154174 The info2www CGI script allows remote file access or remote command execution. 1995 Buffer overflow in NCSA HTTP daemon v1.3 allows remote command execution. MetaInfo MetaWeb web server allows users to upload, execute, and read scripts. Netscape Enterprise servers may list files through the PageServices query. Directory traversal vulnerability in pfdispaly.cgi program (sometimes referred to as "pfdisplay") for SGI's Performer API Search Tool (performer_tools) allows remote attackers to read arbitrary files. 19980401-01-P I-041 64 sgi-pfdispaly(810) Progressive Networks Real Video server (pnserver) can be crashed remotely. Denial of service in Slmail v2.5 through the POP3 port. Denial of service through Solaris 2.5.1 telnet by sending ^D characters. Denial of service in Windows NT DNS servers through malicious packet which contains a response to a query that wasn't made. Denial of service in Windows NT DNS servers by flooding port 53 with too many characters. mSQL v2.0.1 and below allows remote execution through a buffer overflow. The WorkMan program can be used to overwrite any file to get root access. In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. MS98-003 oval:org.mitre.oval:def:913 Excite for Web Servers (EWS) allows remote command execution via shell metacharacters. Remote command execution in Microsoft Internet Explorer using .lnk and .url files. Denial of service in IIS using long URLs. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-1584, CVE-1999-1586. Reason: This candidate combined references from one issue with the description from another issue. Notes: Users should consult CVE-1999-1584 and CVE-1999-1586 to obtain the appropriate name. All references and descriptions in this candidate have been removed to prevent accidental usage. The Java Web Server would allow remote users to obtain the source code for CGI programs. 19970716 Viewable .jhtml source with JavaWebServer Denial of service to NT mail servers including Ipswitch, Mdaemon, and Exchange through a buffer overflow in the SMTP HELO command. Denial of service in telnet from the Windows NT Resource Kit, by opening then immediately closing a connection. In some NT web servers, appending a space at the end of a URL may allow attackers to read source code for active pages. Vulnerability in the Wguest CGI program. The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service), as demonstrated via a flood of random packets. http://safenetworks.com/Windows/wins.html nt-winsupd-fix(1233) The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL. The WinGate telnet proxy allows remote attackers to cause a denial of service via a large number of connections to localhost. The WinGate proxy is installed without a password, which allows remote attackers to redirect connections without authentication. Denial of service through Winpopup using large user names. AAA authentication on Cisco systems allows attackers to execute commands without authorization. All records in a WINS database can be deleted through SNMP for a denial of service. Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges. 00157 Solaris volrmmount program allows attackers to read any file. 00162 Buffer overflow in Vixie Cron library up to version 3.0 allows local users to obtain root access via a long environmental variable. ypbind with -ypset and -ypsetme options activated in Linux Slackware and SunOS allows local and remote attackers to overwrite files via a .. (dot dot) attack. 19970205 Vulnerabilities in Ypbind when run with -ypset/-ypsetme Buffer overflow in FreeBSD lpd through long DNS hostnames. nis_cachemgr for Solaris NIS+ allows attackers to add malicious NIS+ servers. 00155 Buffer overflow in SunOS/Solaris ps command. 00149 SunOS/Solaris FTP clients can be forced to execute arbitrary commands from a malicious FTP server. 00176 Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. mmap function in BSD allows local attackers in the kmem group to modify memory through devices. The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set, which allows remote attackers to spoof TCP connections. http://www.openbsd.org/advisories/sourceroute.txt bsd-sourceroute(736) buffer overflow in HP xlock program. Buffer overflow in HP-UX cstm program allows local users to gain root privileges. HP-UX gwind program allows users to modify arbitrary files. HPSBUX9410-018 HP-UX vgdisplay program gives root access to local users. HPSBUX9702-056 SSH 1.2.25 on HP-UX allows access to new user accounts. fpkg2swpk in HP-UX allows local users to gain root access. HPSBUX9612-042 HP ypbind allows attackers with root privileges to modify NIS data. disk_bandwidth on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames. 19980701-01-P http://www.securityfocus.com/bid/213/exploit 214 sgi-disk-bandwidth(1441) ioconfig on SGI IRIX 6.4 S2MP for Origin/Onyx2 allows local users to gain root access using relative pathnames. 19980701-01-P 213 http://www.securityfocus.com/bid/213/exploit sgi-ioconfig(1199) Buffer overflow in Solaris fdformat command gives root access to local users. 00138 Buffer overflow in Linux splitvt command gives root access to local users. Buffer overflow in Linux su command gives root access to local users. Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable. Buffer overflow in xmcd 2.1 allows local users to gain access through a user resource setting. SunOS rpc.cmsd allows attackers to obtain root access by overwriting arbitrary files. Buffer overflow in Solaris kcms_configure command allows local users to gain root access. The open() function in FreeBSD allows local attackers to write to arbitrary files. FreeBSD mmap function allows users to modify append-only or immutable files. 1998-003 ppl program in HP-UX allows local users to create root files through symlinks. HPSBUX9702-053 vhe_u_mnt program in HP-UX allows local users to create root files through symlinks. HPSBUX9406-013 Vulnerability in HP-UX mediainit program. HPSBUX9710-071 SGI syserr program allows local users to corrupt files. 19971103-01-PX SGI permissions program allows local users to gain root privileges. 19971103-01-PX SGI mediad program allows local users to gain root access. 19980602-01-PX Linux bdash game has a buffer overflow that allows local users to gain root access. Buffer overflow in Internet Explorer 4.0(1). Buffer overflow in NetMeeting allows denial of service and remote command execution. Q184346 HP OpenView Omniback allows remote execution of commands as root via spoofing, and local users can gain root access via a symlink attack. In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access. DEPRECATED. This entry has been deprecated. It is a duplicate of CVE-1999-0032. Buffer overflow in mstm in HP-UX allows local users to gain root access. AIX batch queue (bsh) allows local and remote users to gain additional privileges when network printing is enabled. AIX Licensed Program Product performance tools allow local users to gain root access. Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, possibly root access. Buffer overflow in Linux Slackware crond program allows local users to gain root access. Buffer overflow in the Linux mail program "deliver" allows local users to gain root access. Linux PAM modules allow local users to gain root access using temporary files. A malicious Palace server can force a client to execute arbitrary programs. NT users can gain debug-level access on a system process using the Sechole exploit. Q190288 MS98-009 Jolt ICMP attack causes a denial of service in Windows 95 and Windows NT systems. CGI PHP mlog script allows an attacker to read any file on the target server. 713 Internet Explorer 4.01 allows remote attackers to read local files and spoof web pages via a "%01" character in an "about:" Javascript URL, which causes Internet Explorer to use the domain specified after the character. 19990126 Javascript ecurity bug in Internet Explorer 19990126 Javascript ecurity bug in Internet Explorer IIS ASP caching problem releases sensitive information when two virtual servers share the same physical directory. Q197003 A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arbitrary commands. Q188348 IIS Remote FTP Exploit/DoS Attack MS99-003 Race condition in the db_loader program in ClearCase gives local users root access by setting SUID bits. FTP PASV "Pizza Thief" denial of service and unauthorized data access. Attackers can steal data by connecting to a port that was intended for use by a client. http://attrition.org/security/advisory/misc/infowar/iw_sec_01.txt pasv-pizza-thief-dos(3389) ControlIT 4.5 and earlier (aka Remotely Possible) has weak password encryption. rpc.pcnfsd in HP gives remote root access by changing the permissions on the main printer spool directory. J-026 HPSBUX9902-091 Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the IE client through the Word 97 template, which doesn't warn the user that the template contains executable content. Also applies to Outlook when the client views a malicious email message. MS99-002 Local or remote users can force ControlIT 4.5 to reboot or force a user to log out, resulting in a denial of service. ControlIT v4.5 and earlier uses weak encryption to store usernames and passwords in an address book. Windows 98 and other operating systems allows remote attackers to cause a denial of service via crafted "oshare" packets, possibly involving invalid fragmentation offsets. Digital Unix 4.0 has a buffer overflow in the inc program of the mh package. J-027 19990125 Digital Unix 4.0 exploitable buffer overflows ptylogin in Unix systems allows users to perform a denial of service by locking out modems, dial out with that modem, or obtain passwords. MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely. 19990130 Security Advisory for Internet Information Server 4 with Site NetWare version of LaserFiche stores usernames and passwords unencrypted, and allows administrative changes without logging. WS_FTP server remote denial of service through cwd command. AD02021999 217 SuSE 5.2 PLP lpc program has a buffer overflow that leads to root compromise. 328 Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data. 19990204 Microsoft Access 97 Stores Database Password as Plaintext The metamail package allows remote command execution using shell metacharacters that are not quoted in a mailcap entry. In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value. Q214840 MS99-004 NetBSD netstat command allows local users to access kernel memory. Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto. The Sun sdtcm_convert calendar utility for OpenWindows has a buffer overflow which can gain root access. 00183 In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files. 165 Lynx allows a local user to overwrite sensitive files through /tmp symlinks. The installer for BackOffice Server includes account names and passwords in a setup file (reboot.ini) which is not deleted. Q217004 MS99-005 Buffer overflow in the "Super" utility in Debian GNU/Linux, and other operating systems, allows local users to execute commands as root. Debian GNU/Linux cfengine package is susceptible to a symlink attack. Buffer overflow in webd in Network Flight Recorder (NFR) 2.0.2-Research allows remote attackers to execute commands. Local users in Windows NT can obtain administrator privileges by changing the KnownDLLs list to reference malicious programs. MS99-006 Process table attack in Unix systems allows a remote attacker to perform a denial of service by filling a machine's process tables through multiple connections to network services. 1033881 InterScan VirusWall for Solaris doesn't scan files for viruses when a single HTTP request includes two GET commands. Microsoft Taskpads allows remote web sites to execute commands on the visiting user's machine via certain methods that are marked as Safe for Scripting. 498 MS99-007 SLMail 3.1 and 3.2 allows local users to access any file in the NTFS file system when the Remote Administration Service (RAS) is enabled by setting a user's Finger File to point to the target file, then running finger on the user. 19990225 ALERT: SLMail 3.2 (and 3.1) with the Remote Administration Service 199902225 ALERT: SLMail 3.2 (and 3.1) with the Remote Administration Service SLmail 3.2 Build 3113 (Web Administration Security Fix) 497 slmail-ras-ntfs-bypass(5392) super 3.11.6 and other versions have a buffer overflow in the syslog utility which allows a local user to gain root access. 342 19990225 SUPER buffer overflow The screen saver in Windows NT does not verify that its security context has been changed properly, allowing attackers to run programs with elevated privileges. MS99-008 ACC Tigris allows public access without a login. 183 The Forms 2.0 ActiveX control (included with Visual Basic for Applications 5.0) can be used to read text from a user's clipboard when the user accesses documents with ActiveX content. MS99-001 The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands. MS99-009 Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using a nonstandard URL. MS99-010 A legacy credential caching mechanism used in Windows 95 and Windows 98 systems allows attackers to read plaintext network passwords. Q168115 829 MS99-052 DataLynx suGuard trusts the PATH environment variable to execute the ps command, allowing local users to execute commands as root. Buffer overflow in the bootp server in the Debian Linux netstd package. 324 Buffer overflow in Dosemu Slang library in Linux. CSSA-1999-006.1 187 The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user. Buffer overflow in Thomas Boutell's cgic library version up to 1.05. Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers. 19990121 Sendmail 8.8.x/8.9.x bugware DPEC Online Courseware allows an attacker to change another user's password without knowing the original password. A race condition in the BackWeb Polite Agent Protocol allows an attacker to spoof a BackWeb server. 19990118 Vulnerability in the BackWeb Polite Agent Protocol A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service. The demo version of the Quakenbush NT Password Appraiser sends passwords across the network in plaintext. In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login. The DCC server command in the Mirc 5.5 client doesn't filter characters from file names properly, allowing remote attackers to place a malicious file in a different location, possibly allowing the attacker to execute commands. Denial of service in Linux 2.2.0 running the ldd command on a core file. 344 A race condition in Linux 2.2.1 allows local users to read arbitrary memory from /proc files. wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself. A bug in Cyrix CPUs on Linux allows local users to perform a denial of service. 19990204 Cyrix bug: freeze in hell, badboy Buffer overflow in the Mail-Max SMTP server for Windows systems allows remote command execution. A buffer overflow in lsof allows local users to obtain root privilege. Digital Unix Networker program nsralist has a buffer overflow which allows local users to obtain root privilege. By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system. 19990209 ALERT: IIS4 allows proxied password attacks over NetBIOS 19990209 Re: IIS4 allows proxied password attacks over NetBIOS Files created from interactive shell sessions in Cobalt RaQ microservers (e.g. .bash_history) are world readable, and thus are accessible from the web server. 337 Buffer overflow in gnuplot in Linux version 3.5 allows local users to obtain root access. 319 The cancel command in Solaris 2.6 (i386) has a buffer overflow that allows local users to obtain root access. 293 Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p, including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a symlink attack, allowing a local user to gain root access. In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension. 501 A buffer overflow in the SGI X server allows local users to gain root access through the X server font path. 19990301-01-PX In Linux before version 2.0.36, remote attackers can spoof a TCP connection and pass data to the application layer before fully establishing the connection. The HTTP server in Cisco 7xx series routers 3.2 through 4.2 is enabled by default, which allows remote attackers to change the router's configuration. J-034 19990311 Cisco 7xx TCP and HTTP Vulnerabilities Vulnerability in Cisco 7xx series routers allows a remote attacker to cause a system reload via a TCP connection to the router's TELNET port. J-034 19990311 Cisco 7xx TCP and HTTP Vulnerabilities 64 bit Solaris 7 procfs allows local users to perform a denial of service. 448 Denial of service in SMTP applications such as Sendmail, when a remote attacker (e.g. spammer) uses many "RCPT TO" commands in the same connection. 19990308 SMTP server account probing When the Microsoft SMTP service attempts to send a message to a server and receives a 4xx error code, it quickly and repeatedly attempts to redeliver the message, causing a denial of service. umapfs allows local users to gain root privileges by changing their uid through a malicious mount_umap program. During a reboot after an installation of Linux Slackware 3.6, a remote attacker can obtain root access by logging in to the root account without a password. 338 In some cases, NetBSD 1.3.3 mount allows local users to execute programs in some file systems that have the "noexec" flag set. Vulnerability in hpterm on HP-UX 10.20 allows local users to gain additional privileges. HPSBUX9903-093 talkback in Netscape 4.5 allows a local user to overwrite arbitrary files of another user whose Netscape crashes. talkback in Netscape 4.5 allows a local user to kill an arbitrary process of another user whose Netscape crashes. The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing. Eudora 4.1 allows remote attackers to perform a denial of service by sending attachments with long file names. OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference. 19990323 19990324 Re: LNotes encryption 19990326 Lotus Notes Encryption Bug 19990326 Re: Lotus Notes security advisory Cisco Catalyst LAN switches running Catalyst 5000 supervisor software allows remote attackers to perform a denial of service by forcing the supervisor module to reload. Linux 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation attack, causing a denial of service. This problem was fixed in Linux kernel 2.2.4 and later releases. ftp on HP-UX 11.00 allows local users to gain privileges. HPSBUX9903-094 XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service. XFree86 xfs command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service. 359 MC/ServiceGuard and MC/LockManager in HP-UX allows local users to gain privileges through SAM. Domain Enterprise Server Management System (DESMS) in HP-UX allows local users to gain privileges. HPSBUX9903-095 Remote attackers can perform a denial of service in WebRamp systems by sending a malicious string to the HTTP port. Remote attackers can perform a denial of service in WebRamp systems by sending a malicious UDP packet to port 5353, changing its IP address. Buffer overflow in procmail before version 3.12 allows remote or local attackers to execute commands via expansions in the procmailrc configuration file. The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages. http://java.sun.com/pr/1999/03/pr990329-01.html 19990405 Security Hole in Java 2 (and JDK 1.1.x) 1939 Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service. AD02221999 509 Solaris ff.core allows local users to modify files. 327 Patrol management software allows a remote attacker to conduct a replay attack to steal the administrator password. 19990409 Patrol security bugs Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up log files. In Cisco routers under some versions of IOS 12.0 running NAT, some packets may not be filtered by input access list filters. Local users can perform a denial of service in NetBSD 1.3.3 and earlier versions by creating an unusual symbolic link with the ln command, triggering a bug in VFS. Local users can gain privileges using the debug utility in the MPE/iX operating system. HPSBMP9904-006 IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request. The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts. 193 In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe). 194 Denial of service in Linux 2.0.36 allows local users to prevent any server from listening on any non-privileged port. 343 A service or application has a backdoor password that was placed there by the developer. An attacker can identify a CISCO device by sending a SYN packet to port 1999, which is for the Cisco Discovery Protocol (CDP). Please see the following link for more information: http://seclists.org/bugtraq/1999/Jan/0215.html A remote attacker can sometimes identify the operating system of a host based on how it reacts to some IP or ICMP packets, using a tool such as nmap or queso. The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does not restrict access to the server properly. 115 Linux ftpwatch program allows local users to gain root privileges. 317 L0phtcrack 2.5 used temporary files in the system TEMP directory which could contain password information. Local users can perform a denial of service in Alpha Linux, using MILO to force a reboot. Buffer overflow in Linux autofs module through long directory names allows local users to perform a denial of service. 312 Versions of rpcbind including Linux, IRIX, and Wietse Venema's rpcbind allow a remote attacker to insert and delete entries by spoofing a source address. suidperl in Linux Perl does not check the nosuid mount option on file systems, allowing local users to gain root access by placing a setuid script in a mountable file system, e.g. a CD-ROM or floppy disk. 339 Remote attackers can perform a denial of service using IRIX fcagent. 19981201-01-PX Local users can perform a denial of service in Tripwire 1.2 and earlier using long filenames. 19990104 Tripwire mess.. http://marc.info/?l=bugtraq&m=91592136122066&w=2 Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter. The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associated with that device. The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a remote attacker to read arbitrary files using the "template" parameter. Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component. MS99-012 Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client. A weak encryption algorithm is used for passwords in Novell Remote.NLM, allowing them to be easily decrypted. 482 The remote proxy server in Winroute allows a remote attacker to reconfigure the proxy without authentication through the "cancel" button. The SNMP default community name "public" is not properly removed in NetApps C630 Netcache, even if the administrator tries to disable it. The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transferred. 145 The ICQ Webserver allows remote attackers to use .. to access arbitrary files outside of the user's personal directory. A race condition in how procmail handles .procmailrc files allows a local user to read arbitrary files available to the user who is running procmail. A weak encryption algorithm is used for passwords in SCO TermVision, allowing them to be easily decrypted by a local user. The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly. 115 Denial of service in HP-UX sendmail 8.8.6 related to accepting connections. HPSBUX9904-097 Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems. HPSBUX9903-092 Local attackers can conduct a denial of service in Midnight Commander 4.x with a symlink attack. Denial of service in "poll" in OpenBSD. OpenBSD kernel crash through TSS handling, as caused by the crashme program. OpenBSD crash using nlink value in FFS and EXT2FS filesystems. Buffer overflow in OpenBSD ping. Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD. Denial of service in AOL Instant Messenger when a remote attacker sends a malicious hyperlink to the receiving client, potentially causing a system crash. The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files. MS99-011 Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different security context using malicious URLs, a variant of the "cross frame" vulnerability. MS99-012 MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste a file name into the file upload intrinsic control, a variant of "untrusted scripted paste" as described in MS:MS98-013. MS99-015 MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to learn information about a local user's files via an IMG SRC tag. MS99-012 The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute. 119 The ffingerd 1.19 allows remote attackers to identify users on the target system based on its responses. rpc.statd allows remote attackers to forward RPC calls to the local operating system via the SM_MON and SM_NOTIFY commands, which in turn could be used to remotely exploit other bugs such as in automountd. 19990103 SUN almost has a clue! (automountd) 00186 CA-99-05 J-045 450 Denial of service in WinGate proxy through a buffer overflow in POP3. A remote attacker can gain access to a file system using .. (dot dot) when accessing SMB shares. A Windows NT 4.0 user can gain administrative rights by forcing NtOpenProcessToken to succeed regardless of the user's permissions, aka GetAdmin. Q146965 Anonymous FTP is enabled. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. Anonymous FTP is an unsecured protocol for Internet facing systems and should only be used on a limited basis to provide a specific functional requirement, otherwise disabled. The software should be patched and configured properly. TFTP is not running in a restricted directory, allowing a remote attacker to access sensitive information such as password files. NETBIOS share information may be published through SNMP registry keys in NT. A Unix account has a guessable password. A Unix account has a default, null, blank, or missing password. A Windows NT local user or administrator account has a guessable password. A Windows NT local user or administrator account has a default, null, blank, or missing password. A Windows NT domain user or administrator account has a guessable password. A Windows NT domain user or administrator account has a default, null, blank, or missing password. An account on a router, firewall, or other network device has a guessable password. An account on a router, firewall, or other network device has a default, null, blank, or missing password. Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands. A router or firewall allows source routed packets from arbitrary hosts. IP forwarding is enabled on a machine which is not a router or firewall. A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers. ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. UDP messages to broadcast addresses are allowed, allowing for a Fraggle attack that can cause a denial of service by flooding the target. An unrestricted remote trust relationship for Unix systems has been set up, e.g. by using a + sign in /etc/hosts.equiv. An SNMP community name is guessable. An SNMP community name is the default (e.g. public), null, or missing. A NETBIOS/SMB share password is guessable. A NETBIOS/SMB share password is the default, null, or missing. A system-critical NETBIOS/SMB share has inappropriate access control. An NIS domain name is easily guessable. The permissions for a system-critical NIS+ table (e.g. passwd) are inappropriate. ICMP echo (ping) is allowed from arbitrary hosts. ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts. http://descriptions.securescout.com/tc/11010 http://descriptions.securescout.com/tc/11011 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1434 icmp-netmask(306) icmp-timestamp(322) https://kc.mcafee.com/corporate/index?page=content&id=SB10053 IP traceroute is allowed from arbitrary hosts. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. An X server's access control is disabled (e.g. through an "xhost +" command) and allows anyone to connect to the server. VU#704969 The permissions for system-critical data in an anonymous FTP account are inappropriate. For example, the root directory is writeable by world, a real password file is obtainable, or executable commands such as "ls" can be overwritten. A router or firewall forwards external packets that claim to come from inside the network that the router/firewall is in front of. A router or firewall forwards packets that claim to come from IANA reserved or private addresses, e.g. 10.x.x.x, 127.x.x.x, 217.x.x.x, etc. A system is operating in "promiscuous" mode which allows it to perform packet sniffing. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "An SMTP service supports EXPN, VRFY, HELP, ESMTP, and/or EHLO." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. This functionality should be disabled, because these commands can be used for attack reconnaissance. A DNS server allows zone transfers. A DNS server allows inverse queries. A Windows NT user has inappropriate rights or privileges, e.g. Act as System, Add Workstation, Backup, Change System Time, Create Pagefile, Create Permanent Object, Create Token Name, Debug, Generate Security Audit, Increase Priority, Increase Quota, Load Driver, Lock Memory, Profile Single Process, Remote Shutdown, Replace Process Token, Restore, System Environment, Take Ownership, or Unsolicited Input. A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness. A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of active content such as ActiveX, Java, Javascript, etc. A trust relationship exists between two Unix hosts. A password for accessing a WWW URL is guessable. The Windows NT guest account is enabled. An SSH server allows authentication through the .rhosts file. A superfluous NFS server is running, but it is not importing or exporting any file systems. Windows NT automatically logs in an administrator upon rebooting. A router's routing tables can be obtained from arbitrary hosts. HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests. HPSBUX9804-078 NFS exports system-critical data to the world, e.g. / or a password file. A Unix account with a name other than "root" has UID 0, i.e. root privileges. Two or more Unix accounts have the same UID. A system-critical Unix file or directory has inappropriate permissions. A system-critical Windows NT file or directory has inappropriate permissions. IIS has the #exec function enabled for Server Side Include (SSI) files. The registry in Windows NT can be accessed remotely by users who are not administrators. oval:org.mitre.oval:def:1023 An attacker can force a printer to print arbitrary documents (e.g. if the printer doesn't require a password) or to become disabled. A Sendmail alias allows input to be piped to a program. An attacker can write to syslog files from any location, causing a denial of service by filling up the logs, and hiding activities. rpc.admind in Solaris is not running in a secure mode. A URL for a WWW directory allows auto-indexing, which provides a list of all files in that directory if it does not contain an index.html file. Windows NT is not using a password filter utility, e.g. PASSFILT.DLL. A router's configuration service or management interface (such as a web server or telnet) is configured to allow connections from arbitrary hosts. .reg files are associated with the Windows NT registry editor (regedit), making the registry susceptible to Trojan Horse attacks. A Windows NT system's user audit policy does not log an event success or failure, e.g. for Logon and Logoff, File and Object Access, Use of User Rights, User and Group Management, Security Policy Changes, Restart, Shutdown, and System, and Process Tracking. A Windows NT system's file audit policy does not log an event success or failure for security-critical files or directories. A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories. A Windows NT system's registry audit policy does not log an event success or failure for security-critical registry keys. A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys. The HKEY_LOCAL_MACHINE key in a Windows NT system has inappropriate, system-critical permissions. The HKEY_CLASSES_ROOT key in a Windows NT system has inappropriate, system-critical permissions. A Windows NT account policy has inappropriate, security-critical settings for lockout, e.g. lockout duration, lockout after bad logon attempts, etc. There is a one-way or two-way trust relationship between Windows NT domains. A Windows NT file system is not NTFS. A Windows NT administrator account has the default name of Administrator. A network service is running on a nonstandard port. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. A WWW server is not running in a restricted file system, e.g. through a chroot, thus allowing access to system-critical data. A filter in a router or firewall allows unusual fragmented packets. A system-critical Windows NT registry key has inappropriate permissions. A system does not present an appropriate legal message or warning to a user who is accessing it. An event log in Windows NT has inappropriate access permissions. The Logon box of a Windows NT system displays the name of the last user who logged in. The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in. http://technet.microsoft.com/en-us/library/cc722469.aspx http://www.microsoft.com/technet/archive/winntas/deploy/confeat/06wntpcc.mspx?mfr=true nt-shutdown-without-logon(1291) A Windows NT system does not restrict access to removable media drives such as a floppy disk drive or CDROM drive. A Windows NT system does not clear the system page file during shutdown, which might allow sensitive information to be recorded. A Windows NT log file has an inappropriate maximum size or retention period. A Windows NT account policy does not forcibly disconnect remote users from the server when their logon hours expire. A network intrusion detection system (IDS) does not properly handle packets that are sent out of order, allowing an attacker to escape detection. A network intrusion detection system (IDS) does not properly handle packets with improper sequence numbers. A network intrusion detection system (IDS) does not verify the checksum on a packet. A network intrusion detection system (IDS) does not properly handle data within TCP handshake packets. A network intrusion detection system (IDS) does not properly reassemble fragmented packets. In Windows NT, an inappropriate user is a member of a group, e.g. Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators, etc. An incorrect configuration of the WebStore 1.0 shopping cart CGI program "web_store.cgi" could disclose private information. 19990420 Shopping Carts exposing CC data An incorrect configuration of the Order Form 1.0 shopping cart CGI program could disclose private information. 19990420 Shopping Carts exposing CC data An incorrect configuration of the EZMall 2000 shopping cart CGI program "mall2000.cgi" could disclose private information. 19990420 Shopping Carts exposing CC data quikstore.cgi in QuikStore shopping cart stores quikstore.cfg under the web document root with insufficient access control, which allows remote attackers to obtain the cleartext administrator password and gain privileges. 19990420 Shopping Carts exposing CC data An incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information. 19990420 Shopping Carts exposing CC data http://www.pdgsoft.com/Security/security.html. pdgsoftcart-misconfig(3857) An incorrect configuration of the SoftCart CGI program "SoftCart.exe" could disclose private information. 19990420 Shopping Carts exposing CC data An incorrect configuration of the Webcart CGI program could disclose private information. 19990420 Shopping Carts exposing CC data A system-critical Windows NT registry key has an inappropriate value. A version of finger is running that exposes valid user information to any entity on the network. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The FTP Service should be disabled because it could reveal information about a host's users, which could be used as reconnaissance information for attacks. The rpc.sprayd service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. rpc.sprayd is an unsecured protocol for Internet facing systems and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The FTP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The FTP Service is an unsecured protocol for Internet facing systems and should only be used on a limited basis to provide a specific functional requirement, otherwise disabled. Secure alternatives that encrypt communications are available. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SNMP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. SNMPv3 is a secure protocol for management of networked systems, provided the cryptographic security mechanisms are used. SNMPv1 and SNMPv2 are unsecured protocols for Internet facing systems and should only be used on a trusted network segment. For all versions, the software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The TFTP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The TFTP Service is an unsecured protocol and it should used only on a limited basis on rare occasion to provide a specific functional requirement, otherwise disabled. Secure alternatives are available. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SMTP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The SMTP Service is an unsecured protocol for Internet facing systems (e.g., user authentication not required, communications not encrypted) and should only be used on a limited basis to provide a specific functional requirement, otherwise disabled. The software should be patched and configured properly. The rexec service is running. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The Telnet service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The Telnet Service is an unsecured and obsolete protocol and it should be disabled. Secure alternatives such as SSH are available. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to NIS is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. These protocols, such as RPC ypbind, yppasswd, ypserv, ypupdated, and ypxfrd, are unsecured protocols for Internet facing systems and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to NETBIOS is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. This component service should not be allowed to communicate over untrusted networks, such as the Internet, because it is an unsecured protocol (e.g., communications not encrypted). The software should be patched and configured properly. oval:org.mitre.oval:def:1024 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A component service related to DNS service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. DNS is a critical network service. It should be fully patched and properly configured for Internet facing servers to avoid common attacks such as DNS spoofing, poisoning, and unauthorized zone transfers. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The X Windows service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The XWindows service is an unsecured protocol for Internet facing system and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. The rstat/rstatd service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. These are unsecured and obsolete protocols and they should be disabled. The rpc.rquotad service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. rpc.rquotad is an unsecured and obsolete protocol and it should be disabled. A version of rusers is running that exposes valid user information to any entity on the network. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. rusers is an unsecured and obsolete protocol and it should be disabled. The rexd service is running, which uses weak authentication that can allow an attacker to execute commands. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The rexd service is an unsecured protocol for Internet facing systems and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. The rwho/rwhod service is running, which exposes machine status and user information. The ident/identd service is running. The NT Alerter and Messenger services are running. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The NFS service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. NFS Service is an unsecured protocol for Internet facing systems (e.g., user authentication not required, communications not encrypted) and should only be used on a trusted managed network, otherwise disabled. The software should be patched and configured properly. The RPC portmapper service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The RPC portmapper service is an unsecured protocol for Internet facing systems and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The HTTP/WWW service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The software should be patched and configured properly. SSL/TLS should be used to protect transmissions of sensitive data. The presence of HTTP may be an indication that an web application server is running on the system. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The SSH service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. SSH is a secure protocol, provided it is fully patched, properly configured, and uses FIPS approved algorithms. SSH version 2 is preferred over SSH version 1 because of known flaws in version 1. The echo service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The Echo Service is an unsecured and obsolete protocol and it should be disabled. Historically it has been used to perform denial of service attacks. 20060116 ACT P202S VoIP wireless phone multiple undocumented ports/services The discard service is running. The systat service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The systat service is an unsecured and obsolete protocol and it should be disabled because it can reveal information about a host's operations. The daytime service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The daytime service is an unsecured and obsolete protocol and it should be disabled. The chargen service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. chargen service is an unsecured and obsolete protocol and it should be disabled. Historically it has been used to perform denial of service attacks. Ping and traceroute can be used to provide the same functionality. The Gopher service is running. The UUCP service is running. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The UUCP Service is an unsecured and obsolete protocol and it should be disabled. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A POP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. POP3 is an unsecured protocol for Internet facing systems that does not encrypt its transmissions. POP3 should be tunneled over SSL/TLS or another encrypted tunnel. The software should be patched and configured properly. Earlier versions of POP, such as POP2, are unsecured and obsolete, and should be disabled. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The IMAP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. IMAP Service is an unsecured protocol for Internet facing systems that does not encrypt its transmissions. IMAP should be tunneled over SSL/TLS or another encrypted tunnel. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The NNTP news service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. NNTP news service is an unsecured protocol for Internet facing systems (e.g., user authentication not required, communications not encrypted). It could be tunneled over SSL/TLS. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The IRC service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. IRC Service is an unsecured protocol that typically does not authenticate the identity of users and does not encrypt its network communications. IRC is not commonly deployed on enterprise networks. If an organization decides to use it, it should be patched and configured properly, otherwise it should be disabled. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The LDAP service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The software should be patched and configured properly to prevent information disclosure. It can be tunneled over SSL/TLS. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The bootparam (bootparamd) service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The bootparam service is an unsecured protocol for Internet facing systems and should only be used on a trusted network segment, otherwise disabled. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The X25 service is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. X25 is an unsecured protocol for Internet facing systems and should only be used on a limited basis to provide a specific functional requirement, otherwise disabled. The software should be patched and configured properly. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "The FSP service is running." The netstat service is running, which provides sensitive information to remote attackers. netstat(72) The rsh/rlogin service is running. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A database service is running, e.g. a SQL server, Oracle, or mySQL." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The software should be patched and configured properly to prevent information leakage and unauthorized access. A component service related to NIS+ is running. The OS/2 or POSIX subsystem in NT is enabled. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. Notes: the former description is: "A service may include useful information in its banner or help function (such as the name and version), making it useful for information gathering activities." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. http://ca.com/au/securityadvisor/vulninfo/Vuln.aspx?ID=1638 linux-ugidd(348) WinGate is being used. This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "DCOM is running." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A Windows NT Primary Domain Controller (PDC) or Backup Domain Controller (BDC) is present." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. It might be more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: "A hacker utility, back door, or Trojan Horse is installed on a system, e.g. NetBus, Back Orifice, Rootkit, etc." This Common Vulnerabilities and Exposures (CVE) entry is a configuration issue and not a software flaw. As such, it doesn’t fit in the CVE software flaw list. The Common Vulnerability Scoring System (CVSS) base score for this CVE entry has been set to 0 because this CVE entry has no impact as a software flaw according to CVSS. This does not mean that the configuration issue is not important and there may be security implications relative to computers having this configuration. A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail 8.12.6. 20020801 trojan horse in recent openssh (version 3.4 portable 1) 20020801 OpenSSH Security Advisory: Trojaned Distribution Files 20021009 Re: CERT Advisory CA-2002-28 Trojan Horse Sendmail CA-1994-07 CA-1994-14 CA-1999-01 CA-1999-02 CA-2002-28 sendmail-backdoor(10313) 5921 A system-critical program or library does not have the appropriate patch, hotfix, or service pack installed, or is outdated or obsolete. A system-critical program, library, or file has a checksum or other integrity measurement that indicates that it has been modified. An application-critical Windows NT registry key has inappropriate permissions. An application-critical Windows NT registry key has an inappropriate value. The ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service. The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy. J-064 Q240308 598 MS99-032 The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy. J-064 Buffer overflow in the Eyedog ActiveX control allows a remote attacker to execute arbitrary commands. J-064 MS99-032 Buffer overflow in ToxSoft NextFTP client through CWD command. 572 Buffer overflow in Fujitsu Chocoa IRC client via IRC channel topics. 573 Buffer overflow in ALMail32 POP3 client via From: or To: headers. 574 The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve. J-067 570 Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host. 19990809 FW1 UDP Port 0 DoS 576 sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack. 575 19990808 sdtcm_convert The WebRamp web administration utility has a default password. 577 A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server. 318 Buffer overflow in hybrid-6 IRC server commonly used on EFnet allows remote attackers to execute commands via m_invite invite option. http://www.efnet.org/archive/servers/hybrid/ChangeLog 581 Windows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated, allowing for a denial of service. Q238600 J-057 571 MS99-028 Buffer overflow in Microsoft FrontPage Server Extensions (PWS) 3.0.2.926 on Windows 95, and possibly other versions, allows remote attackers to cause a denial of service via a long URL. 19990807 Crash FrontPage Remotely... 568 frontpage-pws-dos(3117) Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled. Q237927 J-056 567 MS99-027 Denial of service in Gauntlet Firewall via a malformed ICMP packet. 556 Denial of service in Sendmail 8.8.6 in HPUX. Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option. 618 Denial of service in Netscape Enterprise Server (NES) in HP Virtual Vault (VVOS) via a long URL. J-046 HPSBUX9906-098 The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands. 00192 K-001 637 HPSBUX9909-103 Buffer overflows in HP Software Distributor (SD) for HPUX 10.x and 11.x. 545 HPSBUX9907-101 The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack. 00192 636 HPSBUX9909-103 oval:org.mitre.oval:def:1880 HP CDE program includes the current directory in root's PATH variable. J-053 HPSBUX9907-100 Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name. 00192 635 HPSBUX9909-103 oval:org.mitre.oval:def:3078 The default configuration of the Array Services daemon (arrayd) disables authentication, allowing remote users to gain root privileges. 19990701-01-P J-052 Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges. 00192 641 HPSBUX9909-103 oval:org.mitre.oval:def:4374 Denial of service in AIX ptrace system call allows local users to crash the system. J-055 The Sybase PowerDynamo personal web server allows attackers to read arbitrary files through a .. (dot dot) attack. 620 Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd). 00188 J-051 HPSBUX9908-102 SCO Doctor allows local users to gain root privileges through a Tools option. 621 Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux. The Bluestone Sapphire web server allows session hijacking via easily guessable session IDs. 623 Buffer overflow in Microsoft Phone Dialer (dialer.exe), via a malformed dialer entry in the dialer.ini file. Q237185 MS99-026 After an unattended installation of Windows NT 4.0, an installation file could include sensitive information such as the local Administrator password. Q173039 626 MS99-036 Internet Explorer 5.0 and 5.01 allows remote attackers to modify or execute files via the Import/Export Favorites feature, aka the "ImportExportFavorites" vulnerability. Q241361 627 MS99-037 OpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices. J-066 Buffer overflow in Berkeley automounter daemon (amd) logging facility provided in the Linux am-utils package and others. 614 Buffer overflow in INN inews program. 616 Linux xmonisdn package allows local users to gain root privileges by modifying the IFS or PATH environmental variables. 583 The default FTP configuration in HP Visualize Conference allows conference users to send a file to other participants without authorization. J-050 493 HPSBUX9906-099 Buffer overflow in cfingerd allows local users to gain root privileges via a long GECOS field. 651 The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems. FLSA-2006:152809 DSA-576 FEDORA-2005-373 http://www.redhat.com/support/errata/archives/rh52-errata-general.html#squid RHSA-1999:025 RHSA-2005:489 2059 http-cgi-cachemgr(2385) The oratclsh interpreter in Oracle 8.x Intelligent Agent for Unix allows local users to execute Tcl commands as root. 19990506 Oracle Security Followup, patch and FAQ: setuid on oratclsh 19990430 *Huge* security hole in Oracle 8.0.5 with Intellegent agent installed A vulnerability in Caldera Open Administration System (COAS) allows the /etc/shadow password file to be made world-readable. The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges. J-044 Vulnerability in Compaq Tru64 UNIX edauth command. Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry. Q230677 MS99-016 Buffer overflow in Windows NT 4.0 help file utility via a malformed help file. Q231605 MS99-015 A remote attacker can disable the virus warning mechanism in Microsoft Excel 97. Q231304 MS99-014 IBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMapping registry key. 19990823 IBM Gina security warning 608 ibm-gina-group-add(3166) The Guile plugin for the Gnumeric spreadsheet package allows attackers to execute arbitrary code. 563 The pt_chown command in Linux allows local users to modify TTY terminal devices that belong to other users. 597 19990823 [Linux] glibc 2.1.x / wu-ftpd <=2.5 / BeroFTPD / lynx / vlock / mc / glibc 2.0.x Denial of service in Windows NT Local Security Authority (LSA) through a malformed LSA request. Q231457 J-049 MS99-020 The default configuration of Cobalt RaQ2 servers allows remote users to install arbitrary software packages. 558 The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input. Q233323 J-049 478 MS99-021 Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function. When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page". Q233335 477 MS99-022 iis-double-byte-code-page(2302) An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header. Q234557 499 MS99-023 A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted. A Windows NT user can disable the keyboard or mouse by directly calling the IOCTLs which control them. Q236359 MS99-024 Buffer overflow in Lotus Notes LDAP (NLDAP) allows an attacker to conduct a denial of service through the ldap_search request. J-061 601 19990823 Denial of Service Attack against Lotus Notes Domino Server 4.6 The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack. The KDE klock program allows local users to unlock a session using malformed input. 489 The logging facility of the Debian smtp-refuser package allows local users to delete arbitrary files using symbolic links. Buffer overflow in VMWare 1.0.1 for Linux via a long HOME environmental variable. 490 A default configuration of CiscoSecure Access Control Server (ACS) allows remote users to modify the server database without authentication. ciscosecure-read-write(3133) 19990819 CiscoSecure Access Control Server for UNIX Remote Administration Vulnerability KDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories. RHSA-1999:015-01 300 The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. MS99-013 oval:org.mitre.oval:def:932 The viewcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. MS99-013 The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. MS99-013 The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. MS99-013 Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed TERM environmental variable. 594 QMS CrownNet Unix Utilities for 2060 allows root to log on without a password. 593 The Debian mailman package uses weak authentication, which allows attackers to gain privileges. 480 Trn allows local users to overwrite other users' files via symlinks. trn-symlinks(3144) Buffer overflow in Netscape Enterprise Server and FastTrask Server allows remote attackers to gain privileges via a long HTTP GET request. 603 Buffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler. J-059 590 A default configuration of in.identd in SuSE Linux waits 120 seconds between requests, allowing a remote attacker to conduct a denial of service. 587 Denial of service in BSDi Symmetric Multiprocessing (SMP) when an fstat call is made when the system has a high CPU load. 589 19990816 Symmetric Multiprocessing (SMP) Vulnerbility in BSDi 4.0.1 Buffer overflows in Red Hat net-tools package. Buffer overflow in Microsoft Telnet client in Windows 95 and Windows 98 via a malformed Telnet argument. 586 MS99-033 Hotmail allows Javascript to be executed via the HTML STYLE tag, allowing remote attackers to execute commands on the user's Hotmail account. 630 Buffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch. 631 netscape-accept-bo(3256) Denial of service in Netscape Enterprise Server via a buffer overflow in the SSL handshake. The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories. 591 The INN inndstart program allows local users to gain privileges by specifying an alternate configuration file using the INNCONF environmental variable. CSSA-1999-011.0 http://www.redhat.com/corp/support/errata/inn99_05_22.html 255 Windows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option. Q230681 MS99-017 ColdFusion Administrator with Advanced Security enabled allows remote users to stop the ColdFusion server via the Start/Stop utility. ASB99-07 coldfusion-admin-dos(2207) The ColdFusion CFCRYPT program for encrypting CFML templates has weak encryption, allowing attackers to decrypt the templates. ASB99-08 coldfusion-encryption(2208) Netscape Enterprise 3.5.1 and FastTrack 3.01 servers allow a remote attacker to view source code to scripts by appending a %20 to the script's URL. Buffer overflow in FuseMAIL POP service via long USER and PASS commands. http://www.crosswinds.net/~fuseware/faq.html#8 634 Undocumented ColdFusion Markup Language (CFML) tags and functions in the ColdFusion Administrator allow users to gain additional privileges. ASB99-10 550 coldfusion-server-cfml-tags(3288) Buffer overflow in FreeBSD fts library routines allows local user to modify arbitrary files via the periodic program. 644 When Javascript is embedded within the TITLE tag, Netscape Communicator allows a remote attacker to use the "about" protocol to gain access to browser information. NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another connected network. NetBSD allows ARP packets to overwrite static ARP entries. SGI IRIX midikeys program allows local users to modify arbitrary files via a text editor. 19990501-01-A 262 The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment. Q240346 600 MS99-031 Buffer overflow in Solaris libc, ufsrestore, and rcp via LC_MESSAGES environmental variable. Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable. 602 Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable. 611 Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN, allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems. 549 The web components of Compaq Management Agents and the Compaq Survey Utility allow a remote attacker to read arbitrary files via a .. (dot dot) attack. Denial of service in Compaq Management Agents and the Compaq Survey Utility via a long string sent to port 2301. Buffer overflow in Solaris lpset program allows local users to gain root access. 19990511 Solaris2.6 and 2.7 lpset overflow Buffer overflows in Mars NetWare Emulation (NWE, mars_nwe) package via long directory names. 617 Cisco Gigabit Switch routers running IOS allow remote attackers to forward unauthorized packets due to improper handling of the "established" keyword in an access list. Alibaba HTTP server allows remote attackers to read files via a .. (dot dot) attack. 19990506 ".."-hole in Alibaba 2.0 IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions. Q241407 Q242559 658 MS99-039 Buffer overflow in Xi Graphics Accelerated-X server allows local users to gain root access via a long display or query parameter. 488 Denial of service in HP-UX SharedX recserv program. HPSBUX9810-086 KDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file. 19981118 Multiple KDE security vulnerabilities (root compromise) KDE allows local users to execute arbitrary commands by setting the KDEDIR environmental variable to modify the search path that KDE uses to locate its executables. 19981118 Multiple KDE security vulnerabilities (root compromise) KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable. 19981118 Multiple KDE security vulnerabilities (root compromise) FreeBSD allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system. I-057 Denial of service in Oracle TNSLSNR SQL*Net Listener via a malformed string to the listener port, aka NERP. 19981228 Oracle8 TNSLSNR DoS 19990104 Re: Fw:"NERP" DoS attack possible in Oracle 19980827 NERP DoS attack possible in Oracle The INN inndstart program allows local users to gain root privileges via the "pathrun" parameter in the inn.conf file. 254 The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack. 659 The SSH authentication agent follows symlinks via a UNIX domain socket. 19990917 A few bugs... 19990924 [Fwd: Truth about ssh 1.2.27 vulnerability] 660 Arkiea nlservd allows remote attackers to conduct a denial of service. 19990924 Multiple vendor Knox Arkiea local root/remote DoS 662 Buffer overflow in AIX ftpd in the libc library. J-072 679 A remote attacker can read information from a Netscape user's cache via JavaScript. http://home.netscape.com/security/notes/jscachebrowsing.html Hybrid Network cable modems do not include an authentication mechanism for administration, allowing remote attackers to compromise the system through the HSMP protocol. 695 ROUTERmate has a default SNMP community name which allows remote attackers to modify its configuration. http://www2.merton.ox.ac.uk/~security/rootshell/0022.html Internet Explorer allows remote attackers to read files by redirecting data to a Javascript applet. MS99-043 Microsoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file. Q241900 Q241901 Q241902 MS99-044 The NIS+ rpc.nisd server allows remote attackers to execute certain RPC calls without authentication to obtain system information, disable logging, or modify caches. FreeBSD T/TCP Extensions for Transactions can be subjected to spoofing attacks. NIS finger allows an attacker to conduct a denial of service via a large number of finger requests, resulting in a large number of NIS queries. I-070 Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type. 19981204 bootpd remote vulnerability Buffer overflow in bootpd 2.4.3 and earlier via a long boot file location. The GetFile.cfm file in Allaire Forums allows remote attackers to read files through a parameter to GetFile.cfm. 19990211 ACFUG List: Alert: Allaire Forums GetFile bug ASB99-05 allaire-forums-file-read(1748) BMC Patrol allows remote attackers to gain access to an agent by spoofing frames. bmc-patrol-frames(2075) 19990409 Patrol security bugs Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon. Q231450 MS99-018 The fwluser script in AIX eNetwork Firewall allows local users to write to arbitrary files via a symlink attack. 19990525 IBM eNetwork Firewall for AIX Denial of service in Linux 2.2.x kernels via malformed ICMP packets containing unusual types, codes, and IP header lengths. 302 Novell NetWare Transaction Tracking System (TTS) in Novell 4.11 and earlier allows remote attackers to cause a denial of service via a large number of requests. 19990512 DoS with Netware 4.x's TTS novell-tts-dos(2184) Buffer overflow in Solaris dtprintinfo program. The Netscape Directory Server installation procedure leaves sensitive information in a file that is accessible to local users. Multiple buffer overflows in ISC DHCP Distribution server (dhcpd) 1.0 and 2.0 allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary commands via long options. ftp://ftp.isc.org/isc/dhcp/dhcp-1.0-history/dhcp-1.0.0-1.0pl1.diff.gz I-053 19980518 DHCP 1.0 and 2.0 SECURITY ALERT! (fwd) Netscape Communicator 4.x with Javascript enabled does not warn a user of cookie settings, even if they have selected the option to "Only accept cookies originating from the same server as the page being viewed". Denial of service in Samba NETBIOS name service daemon (nmbd). Buffer overflow in Samba smbd program via a malformed message command. 536 Race condition in Samba smbmnt allows local users to mount file systems in arbitrary locations. Cfingerd with ALLOW_EXECUTION enabled does not properly drop privileges when it executes a program on behalf of the user, allowing local users to gain root privileges. Red Hat pump DHCP client allows remote attackers to gain root access in some configurations. RHSA-1999:027 Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries. Q196270 nt-snmpagent-leak(1974) oval:org.mitre.oval:def:952 The Motorola CableRouter allows any remote user to connect to and configure the router on port 1024. 19980510 Security Vulnerability in Motorola CableRouters Lynx WWW client allows a remote attacker to specify command-line parameters which Lynx uses when calling external programs to handle certain protocols, e.g. telnet. Buffer overflow in Solaris kcms_configure via a long NETPATH environmental variable. 831 19991130 another hole of Solaris7 kcms_configure NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it. 19991130 NTmail and VRFY FreeBSD seyon allows users to gain privileges via a modified PATH variable for finding the xterm and seyon-emu commands. 838 FreeBSD seyon allows local users to gain privileges by providing a malicious program in the -emulator argument. 838 Buffer overflow in Qpopper (qpop) 3.0 allows remote root access via AUTH command. 830 Buffer overflow in FreeBSD xmindpath allows local users to gain privileges via -f argument. 839 A Windows NT user can use SUBST to map a drive letter to a folder, which is not unmapped after the user logs off, potentially allowing that user to modify the location of folders accessed by later users. 833 The default permissions for UnixWare /var/mail allow local users to read and modify other users' mail. 849 Buffer overflow in FreeBSD angband allows local users to gain privileges. 840 By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing. UnixWare pkg commands such as pkginfo, pkgcat, and pkgparam allow local users to read arbitrary files via the dacread permission. 853 HP Secure Web Console uses weak encryption. Buffer overflow in SCO UnixWare Xsco command via a long argument. Denial of service in Linux syslogd via a large number of connections. CSSA-1999-035.0 809 Buffer overflow in NFS server on Linux allows attackers to execute commands via a long pathname. CSSA-1999-033.0 19991111 buffer overflow in nfs server 19991110 Security hole in nfs-server < 2.2beta47 within nkita RHSA-1999:053-01 782 19991109 undocumented bugs - nfsd Buffer overflow in BIND 8.2 via NXT records. CSSA-1999-034.1 788 Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library. 843 Denial of service in BIND named via malformed SIG records. CSSA-1999-034.1 788 UnixWare uidadmin allows local users to modify arbitrary files via a symlink attack. SB-99.22a 842 19991202 UnixWare 7 uidadmin exploit + discussion Denial of service in BIND by improperly closing TCP sessions via so_linger. CSSA-1999-034.1 00194 788 Buffer overflow in Serv-U FTP 2.5 allows remote users to conduct a denial of service via the SITE command. 859 Windows NT Task Scheduler installed with Internet Explorer 5 allows a user to gain privileges by modifying the job after it has been scheduled. Q246972 828 MS99-051 Buffer overflow in CDE dtmail and dtmailpr programs allows local users to gain privileges via a long -f option. http://www.securiteam.com/exploits/3J5QQPPQ0O.html 19991129 Solaris7 dtmail/dtmailpr/mailtool Buffer Overflow 832 solaris-dtmail-overflow(3579) solaris-dtmailpr-overflow(3580) Buffer overflow in CDE mailtool allows local users to gain root privileges via a long MIME Content-Type. http://www.securiteam.com/exploits/3J5QQPPQ0O.html 19991129 Solaris7 dtmail/dtmailpr/mailtool Buffer Overflow 832 cde-mailtool-bo(3732) Symantec Mail-Gear 1.0 web interface server allows remote users to read arbitrary files via a .. (dot dot) attack. 827 19991129 Symantec Mail-Gear 1.0 Web interface Server Directory Traversal Vulnerability Denial of service in Cisco routers running NAT via a PORT command from an FTP client to a Telnet port. Denial of service in MDaemon WorldClient and WebConfig services via a long URL. 820 823 Buffer overflow in SCO su program allows local users to gain root access via a long username. Denial of service in MDaemon 2.7 via a large number of connection attempts. Buffer overflow in free internet chess server (FICS) program, xboard. Denial of service in BIND named via consuming more than "fdmax" file descriptors. CSSA-1999-034.1 00194 788 Denial of service in BIND named via maxdname. CSSA-1999-034.1 00194 788 The default permissions for Endymion MailMan allow local users to read email or modify files. 845 Denial of service in BIND named via naptr. CSSA-1999-034.1 00194 788 IBM WebSphere sets permissions that allow a local user to modify a deinstallation script or its data files stored in /usr/bin. 844 Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication procedure. 847 Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file. 20000225 FW: Important UBB News For Licensed Users http://www.ultimatebb.com/home/versions.shtml Buffer overflow in FreeBSD gdc program. 834 login in Slackware 7.0 allows remote attackers to identify valid users on the system by reporting an encryption error when an account is locked or does not exist. FreeBSD gdc program allows local users to modify files via a symlink attack. 835 Internet Explorer 5 allows a remote attacker to modify the IE client's proxy configuration via a malicious Web Proxy Auto-Discovery (WPAD) server. Q247333 846 MS99-054 Solaris arp allows local users to read files via the -f parameter, which lists lines in the file that do not parse properly. 837 Solaris chkperm allows local users to read files owned by bin via the VMSYS environmental variable and a symlink attack. 837 Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext. Q244613 MS99-053 Insecure directory permissions in RPM distribution for PostgreSQL allows local users to gain privileges by reading a plaintext password file. Buffer overflow in FreeBSD seyon via HOME environmental variable, -emulator argument, -modems argument, or the GUI. UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file. 19991215 Recent postings about SCO UnixWare 7 19991220 SCO OpenServer Security Status 19991223 FYI, SCO Security patches available. 851 19991202 UnixWare coredumps follow symlinks Buffer overflow in CommuniGatePro via a long string to the HTTP configuration port. 19991203 CommuniGatePro 3.1 for NT DoS 19991203 CommuniGatePro 3.1 for NT Buffer Overflow 860 Buffer overflow in UnixWare xauto program allows local users to gain root privilege. SB-99.24a 19991215 Recent postings about SCO UnixWare 7 19991220 SCO OpenServer Security Status 19991223 FYI, SCO Security patches available. 848 Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers. Q238349 J-058 579 MS99-029 ucbmail allows remote attackers to execute commands via shell metacharacters that are passed to it from INN. Internet Explorer 3.x to 4.01 allows a remote attacker to insert malicious content into a frame of another web site, aka frame spoofing. MS98-020 Internet Explorer 4.01 allows remote attackers to read arbitrary files by pasting a file name into the file upload control, aka untrusted scripted paste. MS98-015 Internet Explorer 4.0 and 4.01 allow a remote attacker to read files via IE's cross frame security, aka the "Cross Frame Navigate" vulnerability. MS98-013 ie-crossframe-file-read(3668) Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file. 611 759 Buffer overflow in Skyfull mail server via MAIL FROM command. 759 Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. Q234905 J-048 AD06081999 MS99-019 oval:org.mitre.oval:def:915 DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes. Q216141 578 Buffer overflow in Internet Explorer 4.0 via EMBED tag. Q185959 Q176697 Internet Explorer 5 allows remote attackers to read files via an ExecCommand method called on an IFRAME. Q243638 MS99-042 Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via MAPPING_CHDIR. 599 Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via macro variables in a message file. Denial of service in WU-FTPD via the SITE NEWER command, which does not free memory properly. Falcon web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 743 Falcon web server allows remote attackers to determine the absolute path of the web root via long file names. Zeus web server allows remote attackers to read arbitrary files by specifying the file name in an option to the search engine. 742 zeus-remote-root(3380) The Zeus web server administrative interface uses weak encryption for its passwords. 742 zeus-weak-password(3833) Alibaba web server allows remote attackers to execute commands via a pipe character in a malformed URL. 770 19991103 More Alibaba Web Server problems... The security descriptor for RASMAN allows users to point to an alternate location via the Windows NT Service Control Manager. Q242294 645 MS99-041 FTGate web interface server allows remote attackers to read files via a .. (dot dot) attack. AD05261999 dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find the nmiconf.tcl script. 585 Cisco 675 routers running CBOS allow remote attackers to establish telnet sessions if an exec or superuser password has not been set. iHTML Merchant allows remote attackers to obtain sensitive information or execute commands via a code parsing error. http://www.ihtmlmerchant.com/support_patches_feedback.htm 694 The "download behavior" in Internet Explorer 5 allows remote attackers to read arbitrary files via a server-side redirect. Q242542 K-002 VU#37828 674 MS99-040 Buffer overflow in Netscape Communicator before 4.7 via a dynamic font whose length field is less than the size of the font. userOsa in SCO OpenServer allows local users to corrupt files via a symlink attack. Red Hat Linux screen program does not use Unix98 ptys, allowing local users to write to other terminals. Firewall-1 does not properly restrict access to LDAP attributes. 725 19991020 Checkpoint FireWall-1 V4.0: possible bug in LDAP authentication Buffer overflow in RealNetworks RealServer administration utility allows remote attackers to execute arbitrary commands via a long username and password. http://service.real.com/help/faq/servg260.html 767 iChat ROOMS Webserver allows remote attackers to read arbitrary files via a .. (dot dot) attack. 19980908 bug in iChat 3.0 (maybe others) Buffer overflows in Windows NT 4.0 print spooler allow remote attackers to gain privileges or cause a denial of service via a malformed spooler request. Q243649 768 MS99-047 The Windows NT 4.0 print spooler allows a local user to execute arbitrary commands due to inappropriate permissions that allow the user to specify an alternate print provider. Q243649 769 MS99-047 Buffer overflow in rpc.yppasswdd allows a local user to gain privileges via MD5 hash generation. ypserv allows a local user to modify the GECOS and login shells of other users. ypserv allows local administrators to modify password tables. genfilt in the AIX Packet Filtering Module does not properly filter traffic to destination ports greater than 32767. Buffer overflow in BFTelnet allows remote attackers to cause a denial of service via a long username. 771 Denial of service in Axent Raptor firewall via malformed zero-length IP options. 736 Buffer overflow in sccw allows local users to gain root access via the HOME environmental variable. 656 sccw allows local users to read arbitrary files. Denial of service in Solaris TCP streams driver via a malicious connection that causes the server to panic as a result of recursive calls to mutex_enter. 655 Multihomed Windows systems allow a remote attacker to bypass IP source routing restrictions via a malformed packet with IP options, aka the "Spoofed Route Pointer" vulnerability. Q238453 646 MS99-038 Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user. 625 MS99-035 Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories. 19990210 612 FreeBSD VFS cache (vfs_cache) allows local users to cause a denial of service by opening a large number of files. 653 dfire.cgi script in Dragon-Fire IDS allows remote users to execute commands via shell metacharacters. 19990804 NSW Dragon Fire gets drowned 564 Buffer overflow in the FTP client in the Debian GNU/Linux netstd package. 324 URL Live! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 746 WebTrends software stores account names and passwords in a file which does not have restricted access permissions. The Preloader ActiveX control used by Internet Explorer allows remote attackers to read arbitrary files. Q231452 MS99-018 Denial of service in various Windows systems via malformed, fragmented IGMP packets. Q238329 514 MS99-034 A memory leak in a Motorola CableRouter allows remote attackers to conduct a denial of service via a large number of telnet connections. 19980510 Security Vulnerability in Motorola CableRouters motorola-cable-crash(2004) Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command. 283 BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service. bmc-patrol-udp-dos(4291) 19990409 Patrol security bugs 1879 An example application in ColdFusion Server 4.0 allows remote attackers to view source code via the sourcewindow.cfm file. ASB99-02 Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files, conduct a denial of service, or use the server as a proxy for other HTTP calls. ASB99-02 The Syntax Checker in ColdFusion Server 4.0 allows remote attackers to conduct a denial of service. ASB99-02 coldfusion-syntax-checker(1742) UnityMail allows remote attackers to conduct a denial of service via a large number of MIME headers. 19980903 Web servers / possible DOS Attack / mime header flooding Apache allows remote attackers to conduct a denial of service via a large number of MIME headers. 19990903 Web servers / possible DOS Attack / mime header flooding NTMail allows remote attackers to read arbitrary files via a .. (dot dot) attack. AD05261999 279 Buffer overflow in SmartDesk WebSuite allows remote attackers to cause a denial of service via a long URL. 278 Novell NetWare with Novell-HTTP-Server or YAWN web servers allows remote attackers to conduct a denial of service via a large number of HTTP GET requests. wwwboard allows a remote attacker to delete message board articles via a malformed argument. 1795 http://www.worldwidemart.com/scripts/faq/wwwboard/q5.shtml http-cgi-wwwboard(2344) Buffer overflow in Mediahouse Statistics Server allows remote attackers to execute commands. 734 Mediahouse Statistics Server allows remote attackers to read the administrator password, which is stored in cleartext in the ss.cfg file. 735 TeamTrack web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 689 classifieds.cgi allows remote attackers to read arbitrary files via shell metacharacters. 2020 http-cgi-classifieds-read(3102) classifieds.cgi allows remote attackers to execute arbitrary commands by specifying them in a hidden variable in a CGI form. BNBSurvey survey.cgi program allows remote attackers to execute commands via shell metacharacters. BNBForm allows remote attackers to read arbitrary files via the automessage hidden form variable. MBone SDR Package allows remote attackers to execute commands via shell metacharacters in Session Initiation Protocol (SIP) messages. Denial of service in Debian IRC Epic/epic4 client via a long string. 605 Buffer overflow in mutt mail client allows remote attackers to execute commands via malformed MIME messages. Mutt mail client allows a remote attacker to execute commands via shell metacharacters. 19980728 mutt x.x UnixWare dos7utils allows a local user to gain root privileges by using the STATICMERGE environmental variable to find a script which it executes. Buffer overflow in OpenLink 3.2 allows remote attackers to gain privileges via a long GET request to the web configurator. 720 IBM WebSphere ikeyman tool uses weak encryption to store a password for a key database that is used for SSL connections. Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote attackers to conduct a denial of service via AUTH or AUTHINFO commands. Q169174 I-080 19980724 Denial of Service attacks against Microsoft Exchange 5.0 to 5.5 exchange-dos(1223) Buffer overflow in Yamaha MidiPlug via a Text variable in an EMBED tag. 19991102 Some holes for Win/UNIX softwares 760 AN-HTTPd provides example CGI scripts test.bat, input.bat, input2.bat, and envout.bat, which allow remote attackers to execute commands via shell metacharacters. 19991102 Some holes for Win/UNIX softwares 762 Buffer overflow in uum program for Canna input system allows local users to gain root privileges. 757 Buffer overflow in canuum program for Canna input system allows local users to gain root privileges. 757 Buffer overflow in WFTPD FTP server allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories. 747 Buffer overflow in OmniHTTPd CGI program imagemap.exe allows remote attackers to execute commands. 739 Buffer overflow in Solaris lpstat via class argument allows local users to gain root access. 19990126 Buffer overflow in Solaris 2.6/2.7 /usr/bin/lpstat WWWBoard stores encrypted passwords in a password file that is under the web root and thus accessible by remote attackers. WWWBoard has a default username and default password. 649 Race condition in wu-ftpd and BSDI ftpd allows remote attackers to gain root access via the SITE EXEC command. The NeXT NetInfo _writers property allows local users to gain root privileges or conduct a denial of service. MajorCool mj_key_cache program allows local users to modify files via a symlink attack. sudo 1.5.x allows local users to execute arbitrary commands via a .. (dot dot) attack. 19980112 Re: hole in sudo for MP-RAS. IRIX startmidi program allows local users to modify arbitrary files via a symlink attack. 19980301-01-PX 469 irix-startmidi-file-creation(1634) IRIX cdplayer allows local users to create directories in arbitrary locations via a command line option. 19980301-01-PX HPUX sysdiag allows local users to gain root privileges via a symlink attack during log file creation. 19960921 Vunerability in HP sysdiag ? Buffer overflow in HPUX passwd command allows local users to gain root privileges via a command line option. HPSBUX9701-045 FreeBSD mount_union command allows local users to gain root privileges via a symlink attack. Buffer overflow in FreeBSD setlocale in the libc module allows attackers to execute arbitrary code via a long PATH_LOCALE environment variable. Race condition in xterm allows local users to modify arbitrary files via the logging option. Buffer overflow in Solaris getopt in libc allows local users to gain root privileges via a long argv[0]. Buffer overflow in the HTML library used by Internet Explorer, Outlook Express, and Windows Explorer via the res: local resource protocol. Buffer overflow in BNC IRC proxy allows remote attackers to gain privileges. 19981226 bnc exploit 1927 bnc-proxy-bo(1546) The Windows NT RPC service allows remote attackers to conduct a denial of service using spoofed malformed RPC packets which generate an error message that is sent to the spoofed host, potentially setting up a loop, aka Snork. Q193233 MS98-014 The OmniHTTPD visadmin.exe program allows a remote attacker to conduct a denial of service via a malformed URL which causes a large number of temporary files to be created. 19990605 Remote Exploit (Bug) in OmniHTTPd Web Server 1808 omnihttpd-dos(2271) Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file. 19970722 Security hole in exim 1.62: local root exploit Buffer overflow in Xshipwars xsw program. 863 Buffer overflow in Solaris snoop program allows remote attackers to gain root privileges via a long domain name when snoop is running in verbose mode. 858 Buffer overflow in Solaris snoop allows remote attackers to gain root privileges via GETQUOTA requests to the rpc.rquotad service. 00190 864 The Windows help system can allow a local user to execute commands as another user by editing a table of contents metafile with a .CNT extension and modifying the topic action to include the commands to be executed when the .hlp file is accessed. 868 Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail. 857 Buffer overflow in Solaris sadmind allows remote attackers to gain root privileges using a NETMGT_PROC_SERVICE request. 00191 2354 866 htdig allows remote attackers to execute commands via filenames with shell metacharacters. 867 The SCO UnixWare privileged process system allows local users to gain root privileges by using a debugger such as gdb to insert traps into _init before the privileged process is executed. 19991215 Recent postings about SCO UnixWare 7 869 Windows NT Service Control Manager (SCM) allows remote attackers to cause a denial of service via a malformed argument in a resource enumeration request. Q246045 MS99-055 Internet Explorer 5.01 and earlier allows a remote attacker to create a reference to a client window and use a server-side redirect to access local files via that window, aka "Server-side Page Reference Redirect." Q246094 MS99-050 The Sun Web-Based Enterprise Management (WBEM) installation script stores a password in plaintext in a world readable file. Whois Internic Lookup program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry. Matt's Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry. CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry. The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large packets with the -R (record route) option. 870 Windows NT does not properly download a system policy if the domain user logs into the domain with a space at the end of the domain name. Q237923 UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack. Buffer overflow in Internet Explorer 5 directshow filter (MSDXM.OCX) allows remote attackers to execute commands via the vnd.ms.radio protocol. 861 Error messages generated by gdm with the VerboseAuth setting allows an attacker to identify valid users on a system. Buffer overflow in GoodTech Telnet Server NT allows remote users to cause a denial of service via a long login name. 862 HP VirtualVault with the PHSS_17692 patch allows unprivileged processes to bypass access restrictions via the Trusted Gateway Proxy (TGP). HPSBUX9912-107 Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed. Windows NT with SYSKEY reuses the keystream that is used for encrypting SAM password hashes, allowing an attacker to crack passwords. Q248183 873 MS99-056 Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID, aka "Malformed Security Identifier Request." Q248185 875 MS99-057 Buffer overflow in Infoseek Ultraseek search engine allows remote attackers to execute commands via a long GET request. AD19991215 wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress. DSA-377 Cisco Cache Engine allows an attacker to replace content in the cache. Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet. Q248749 817 MS99-059 The web administration interface for Cisco Cache Engine allows remote attackers to view performance statistics. Cisco Cache Engine allows a remote attacker to gain access via a null username and password. Netscape Navigator uses weak encryption for storing a user's Netscape mail password. 19991216 Reinventing the wheel (aka "Decoding Netscape Mail passwords") 19991220 Netscape password scrambling http://www.rstcorp.com/news/bad-crypto.html War FTP Daemon 1.70 allows remote attackers to cause a denial of service by flooding it with connections. Buffer overflow in the POP server POProxy for the Norton Anti-Virus protection NAV2000 program via a large USER command. http://service1.symantec.com/SUPPORT/nav.nsf/df0a595864594c86852567ac0063608c/6206f660a1f2516a882568660082c930?OpenDocument&Highlight=0,poproxy 19991217 NAV2000 Email Protection DoS 19991220 Norton Email Protection Remote Overflow (Addendum) Groupwise web server GWWEB.EXE allows remote attackers to read arbitrary files with .htm extensions via a .. (dot dot) attack using the HELP parameter. 19991219 Groupewise Web Interface 879 Groupwise web server GWWEB.EXE allows remote attackers to determine the real path of the web server via the HELP parameter. 19991219 Groupewise Web Interface Buffer overflow in VDO Live Player allows remote attackers to execute commands on the VDO client via a malformed .vdo file. 19991213 VDO Live Player 3.02 Buffer Overflow 872 xsoldier program allows local users to gain root access via a long argument. http://marc.info/?l=freebsd-security&m=94531826621620&w=2 871 The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system. An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy. 19991214 sshd1 allows unencrypted sessions regardless of server policy The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands. J-054 MS98-004 MS99-025 529 SMTP component of Lotus Domino 4.6.1 on AS/400, and possibly other operating systems, allows a remote attacker to crash the mail server via a long string. 19990504 AS/400 173 named-xfer in AIX 4.1.5 and 4.2.1 allows members of the system group to overwrite system files to gain root access via the -f parameter and a malformed zone file. 19990923 named-xfer hole on AIX (fwd) 673 Buffer overflow in mail command in Solaris 2.7 and 2.7 allows local users to gain privileges via a long -m argument. 19990913 Solaris 2.7 /usr/bin/mail 19990927 Working Solaris x86 /usr/bin/mail exploit 672 sun-usrbinmail-local-bo(3297) Buffer overflow in Apple AppleShare Mail Server 5.0.3 on MacOS 8.1 and earlier allows a remote attacker to cause a denial of service (crash) via a long HELO command. 19980408 AppleShare IP Mail Server 61 Microsoft HTML control as used in (1) Internet Explorer 5.0, (2) FrontPage Express, (3) Outlook Express 5, and (4) Eudora, and possibly others, allows remote malicious web site or HTML emails to cause a denial of service (100% CPU consumption) via large HTML form fields such as text inputs in a table cell. 19990827 HTML code to crash IE5 and Outlook Express 5 606 Seattle Labs Emurl 2.0, and possibly earlier versions, stores e-mail attachments in a specific directory with scripting enabled, which allows a malicious ASP file attachment to execute when the recipient opens the message. 19990728 Seattle Labs EMURL Vulnerability 544 IPChains in Linux kernels 2.2.10 and earlier does not reassemble IP fragments before checking the header information, which allows a remote attacker to bypass the filtering rules using several fragments with 0 offsets. 19990727 Linux 2.2.10 ipchains Advisory 543 SpectroSERVER in Cabletron Spectrum Enterprise Manager 5.0 installs a directory tree with insecure permissions, which allows local users to replace a privileged executable (processd) with a Trojan horse, facilitating a root or Administrator compromise. 19990624 Re: Cabletron Spectrum security vulnerability 19990623 Cabletron Spectrum security vulnerability 495 The installation of Novell Netware NDS 5.99 provides an unauthenticated client with Read access for the tree, which allows remote attackers to access sensitive information such as users, groups, and readable objects via CX.EXE and NLIST.EXE. 19980918 NMRC Advisory - Default NDS Rights 484 novell-nds(1364) NFS on SunOS 4.1 through 4.1.2 ignores the high order 16 bits in a 32 bit UID, which allows a local user to gain root access if the lower 16 bits are set to 0, as fixed by the NFS jumbo patch upgrade. 00117 CA-1992-15 47 nfs-uid(82) serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, which allows local users to gain root privileges via a Trojan horse ls program. 19941002 464 sgi-serialports(2111) useradd in Solaris 7.0 does not properly interpret certain date formats as specified in the "-e" (expiration date) argument, which could allow users to login after their accounts have expired. 19990610 Sun Useradd program expiration date bug 426 ip_print procedure in Tcpdump 3.4a allows remote attackers to cause a denial of service via a packet with a zero length header, which causes an infinite loop and core dump when tcpdump prints the packet. 19990616 tcpdump 3.4 bug? 19990617 Re: tcpdump 3.4 bug? 19990620 Re: tcpdump 3.4 bug? (final) 313 CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user's console session when the host is an NIS+ client, which allows others with physical access to login with any string. 19981012 Annoying Solaris/CDE/NIS+ bug 4115685 294 aspppd on Solaris 2.5 x86 allows local users to modify arbitrary files and gain root privileges via a symlink attack on the /tmp/.asppp.fifo file. 19961220 Solaris 2.5 x86 aspppd (semi-exploitable-hole) 292 Solaris 2.6 HW3/98 installs admintool with world-writable permissions, which allows local users to gain privileges by replacing it with a Trojan horse program. 19980507 admintool mode 0777 in Solaris 2.6 HW3/98 290 solaris-admintool-world-writable(7296) Symantec pcAnywhere 8.0 allows remote attackers to cause a denial of service (CPU utilization) via a large amount of data to port 5631. 19990528 DoS against PC Anywhere pcanywhere-dos(2256) 288 SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs. 19990513 - J.J.F. / Hackers Team warns for SSHD 2.x brute force password hacking 277 ssh2-bruteforce(2193) counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via an HTTP request that ends in %0A (newline), which causes a malformed entry in the counter log that produces an access violation. 19990519 Denial of Service in Counter.exe version 2.70 19990519 Denial of Service in Counter.exe version 2.70 267 counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via a long argument. 19990519 Denial of Service in Counter.exe version 2.70 19990519 Denial of Service in Counter.exe version 2.70 267 Vulnerability in LAT/Telnet Gateway (lattelnet) on Ultrix 4.1 and 4.2 allows attackers to gain root privileges. B-36 CA-1991-11 26 ultrix-telnet(584) Microsoft Outlook Express before 4.72.3612.1700 allows a malicious user to send a message that contains a .., which can inadvertently cause Outlook to re-enter POP3 command mode and cause the POP3 session to hang. 19990511 Outlook Express Win98 bug 19990512 Outlook Express Win98 bug, addition. 252 Vulnerability in login in AT&T System V Release 4 allows local users to gain privileges. CA-1991-08 B-28 23 sysv-login(583) IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, aka the IIS "GET" vulnerability. Q192296 MS98-019 iis-get-dos(1823) COPS 1.04 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files in (1) res_diff, (2) ca.src, and (3) mail.chk. 19980626 vulnerability in satan, cops & tiger rex.satan in SATAN 1.1.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rex.$$ file. 19980626 vulnerability in satan, cops & tiger 19980627 Re: vulnerability in satan, cops & tiger satan-rexsatan-symlink(7167) Tiger 2.2.3 allows local users to overwrite arbitrary files via a symlink attack on various temporary files in Tiger's default working directory, as defined by the WORKDIR variable. 19980626 vulnerability in satan, cops & tiger Vulnerability in (1) diskalign and (2) diskperf in IRIX 6.4 patches 2291 and 2848 allow a local user to create root-owned files leading to a root compromise. 19980502-01-P3030 Vulnerabilities in (1) ipxchk and (2) ipxlink in NetWare Client 1.0 on IRIX 6.3 and 6.4 allows local users to gain root access via a modified IFS environmental variable. 19980501-01-P I-055 19980408 SGI O2 ipx security issue Buffer overflow in mscreen on SCO OpenServer 5.0 and SCO UNIX 3.2v4 allows a local user to gain root access via (1) a long TERM environmental variable and (2) a long entry in the .mscreenrc file. SB-98.05a 19980926 Root exploit for SCO OpenServer. VB-98.10 19980827 SCO mscreen vul. Cisco Resource Manager (CRM) 1.0 and 1.1 creates world-readable log files and temporary files, which may expose sensitive information, to local users such as user IDs, passwords and SNMP community strings. 19980813 CRM Temporary File Vulnerability Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error). MS98-007 Vulnerability in Advanced File System Utility (advfs) in Digital UNIX 4.0 through 4.0d allows local users to gain privileges. I-050 dgux-advfs-softlinks(7431) pnserver in RealServer 5.0 and earlier allows remote attackers to cause a denial of service by sending a short, malformed request. 19980115 [rootshell] Security Bulletin #7 19980115 pnserver exploit.. 19980817 Re: Real Audio Server Version 5 bug? http://service.real.com/help/faq/serv501.html realserver-pnserver-remote-dos(7297) Buffer overflow in IMonitor in IMail 5.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to port 8181. 19990302 Multiple IMail Vulnerabilites 504 imail-imonitor-overflow(1897) When BSDI patches for Gauntlet 5.0 BSDI are installed in a particular order, Gauntlet allows remote attackers to bypass firewall access restrictions, and does not log the activities. 19991018 Gauntlet 5.0 BSDI warning 19991019 Re: Gauntlet 5.0 BSDI warning gauntlet-bsdi-bypass(3397) Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory. 19970821 Buffer overflow in /bin/bash 19980909 problem with very long pathnames 19980905 BASH buffer overflow, LiNUX x86 exploit linux-bash-bo(3414) ARCserve NT agents use weak encryption (XOR) for passwords, which allows remote attackers to sniff the authentication request to port 6050 and decrypt the password. 19990222 Severe Security Hole in ARCserve NT agents (fwd) Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template. 19991112 FormHandler.cgi 19991116 Re: FormHandler.cgi 798 799 formhandler-cgi-absolute-path(3550) Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the reply_message_attach attachment parameter. 19991116 Re: FormHandler.cgi Microsoft FrontPage stores form results in a default location in /_private/form_results.txt, which is world-readable and accessible in the document root, which allows remote attackers to read possibly sensitive information submitted by other users. 19990824 Front Page form_results guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->". 19991105 Guestbook.pl, sloppy SSI handling in Apache? (VD#2) 19990913 Guestbook perl script (long) 19990916 Re: Guestbook perl script (error fix) 776 The default configuration of FLEXlm license manager 6.0d, and possibly other versions, allows remote attackers to shut down the server via the lmdown command. 19980925 Globetrotter FlexLM 'lmdown' bogosity Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability." 179 MS98-018 excel-call(1737) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-1395. Reason: This candidate is a duplicate of CVE-1999-1395. Notes: All CVE users should reference CVE-1999-1395 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. VMS 4.0 through 5.3 allows local users to gain privileges via the ANALYZE/PROCESS_DUMP dcl command. B-04 CA-1990-07 vms-analyze-processdump-privileges(7137) 12 Buffer overflow in Vermillion FTP Daemon VFTPD 1.23 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via several long CWD commands. 19991122 Remote DoS Attack in Vermillion FTP Daemon (VFTPD) v1.23 Vulnerability 19991122 Remote DoS Attack in Vermillion FTP Daemon (VFTPD) v1.23 Vulnerability 818 vermillion-ftp-cwd-overflow(3543) Vulnerability in rexec daemon (rexecd) in AT&T TCP/IP 4.0 for various SVR4 systems allows remote attackers to execute arbitrary commands. CA-1992-04 att-rexecd(3159) 36 Buffer overflow in Tetrix TetriNet daemon 1.13.16 allows remote attackers to cause a denial of service and possibly execute arbitrary commands by connecting to port 31457 from a host with a long DNS hostname. 19990217 Tetrix 1.13.16 is Vulnerable 340 HP Laserjet printers with JetDirect cards, when configured with TCP/IP, can be configured without a password, which allows remote attackers to connect to the printer and change its IP address or disable logging. 19971004 HP Laserjet 4M Plus DirectJet Problem laserjet-unpassworded(1876) HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100. 19971004 HP Laserjet 4M Plus DirectJet Problem laserjet-unpassworded(1876) CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter. 19990601 whois_raw.cgi problem 304 http-cgi-cdomain(2251) Multiple buffer overflows in WindowMaker 0.52 through 0.60.0 allow attackers to cause a denial of service and possibly execute arbitrary commands by executing WindowMaker with a long program name (argv[0]). 19990822 19990824 Re: WindowMaker bugs (was sub:none ) 596 Palm Pilot HotSync Manager 3.0.4 in Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to port 14238 while the manager is in network mode. 19991104 Palm Hotsync vulnerable to DoS attack Quake 1 server responds to an initial UDP game connection request with a large amount of traffic, which allows remote attackers to use the server as an amplifier in a "Smurf" style attack on another host, by spoofing the connection request. 19991222 Quake "smurf" - Quake War Utils SGI MachineInfo CGI program, installed by default on some web servers, prints potentially sensitive system status information, which could be used by remote attackers for information gathering activities. 19970507 Re: SGI Security Advisory 19970501-01-A - Vulnerability in webdist.cgi Oracle Webserver 2.1, when serving PL/SQL stored procedures, allows remote attackers to cause a denial of service via a long HTTP GET request. 19970723 DoS against Oracle Webserver 2.1 with PL/SQL stored procedures Directory traversal vulnerability in carbo.dll in iCat Carbo Server 3.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the icatcommand parameter. 19971108 Security bug in iCat Suite version 3.0 2126 icat-carbo-server-vuln(1620) Buffer overflow in ping CGI program in Xylogics Annex terminal service allows remote attackers to cause a denial of service via a long query parameter. 19980725 Annex DoS Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, which allows local users to gain access to Excite accounts by modifying the file. 19981130 Security bugs in Excite for Web Servers 1.1 excite-world-write(1417) Excite for Web Servers (EWS) 1.1 allows local users to gain privileges by obtaining the encrypted password from the world-readable Architext.conf authentication file and replaying the encrypted password in an HTTP request to AT-generated.cgi or AT-admin.cgi. 19981130 Security bugs in Excite for Web Servers 1.1 Excite for Web Servers (EWS) 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack. 19981130 Security bugs in Excite for Web Servers 1.1 Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking. 19980501 Warning! Webmin Security Advisory 98 http://www.webmin.com/webmin/changes.html inetd in AIX 4.1.5 dynamically assigns a port N when starting ttdbserver (ToolTalk server), but also inadvertently listens on port N-1 without passing control to ttdbserver, which allows remote attackers to cause a denial of service via a large number of connections to port N-1, which are not properly closed by inetd. 19980318 AIX 4.1.5 DoS attack (aka "Port 1025 problem") Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the user wants to log out, which returns the attacker into the locked session. 19991026 Mac OS 9 Idle Lock Bug 745 Idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock. 19991101 Re: Mac OS 9 Idle Lock Bug 756 WS_FTP Pro 6.0 uses weak encryption for passwords in its initialization files, which allows remote attackers to easily decrypt the passwords and gain privileges. 19990729 WS_FTP Pro 6.0 Weak Password Encryption Vulnerability 547 Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program. 19990506 AIX Security Fixes Update 19990825 AIX security summary 439 IX80470 rmmount in SunOS 5.7 may mount file systems without the nosuid flag set, contrary to the documentation and its use in previous versions of SunOS, which could allow local users with physical access to gain root privileges by mounting a floppy or CD-ROM that contains a setuid program and running volcheck, when the file systems do not have the nosuid option specified in rmmount.conf. 19990510 SunOS 5.7 rmmount, no nosuid. 19991011 250 solaris-rmmount-gain-root(8350) Vulnerability in files.pl script in Novell WebServer Examples Toolkit 2 allows remote attackers to read arbitrary files. http://www.roxanne.org/faqs/www-secure/wwwsf4.html#Q35 http://www.w3.org/Security/Faq/wwwsf8.html#Q87 http-nov-files(2054) Directory traversal vulnerability in Jana proxy web server 1.40 allows remote attackers to ready arbitrary files via a "......" (modified dot dot) attack. 19991008 Jana webserver exploit 699 Directory traversal vulnerability in Jana proxy web server 1.45 allows remote attackers to ready arbitrary files via a .. (dot dot) attack. 20000502 Security Bug in Jana HTTP Server 699 The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash. 19980622 Yet another "get yourself admin rights exploit": Q103861 K-029 1044 MS00-008 SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack." 19980612 CORE-SDI-04: SSH insertion attack 19980703 UPDATE: SSH insertion attack ssh-insert(1126) VU#13877 Novell 5 and earlier, when running over IPX with a packet signature level less than 3, allows remote attackers to gain administrator privileges by spoofing the MAC address in IPC fragmented packets that make NetWare Core Protocol (NCP) calls. 19990715 NMRC Advisory: Netware 5 Client Hijacking 528 Internet Explorer 4 treats a 32-bit number ("dotless IP address") in the a URL as the hostname instead of an IP address, which causes IE to apply Local Intranet Zone settings to the resulting web page, allowing remote malicious web servers to conduct unauthorized activities by using URLs that contain the dotless IP address for their server. Q168617 http://www.microsoft.com/Windows/Ie/security/dotless.asp MS98-016 ie-dotless(2209) Vulnerability in chsh command in HP-UX 9.X through 10.20 allows local users to gain privileges. H-21 hp-chsh(2012) Buffer overflow in chfn command in HP-UX 9.X through 10.20 allows local users to gain privileges via a long command line argument. H-16 H-21 19961209 the HP Bug of the Week! hp-chfn(2008) The default configuration of NCSA Telnet package for Macintosh and PC enables FTP, even though it does not include an "ftp=yes" line, which allows remote attackers to read and modify arbitrary files. CA-1991-15 ftp-ncsa(1844) UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack. 19960903 [BUG] Vulnerability in TIN 19960903 Re: BoS: [BUG] Vulnerability in TIN 19970329 symlink bug in tin/rtin tin-tmpfile(431) tin 1.40 creates the .tin directory with insecure permissions, which allows local users to read passwords from the .inputhistory file. 19991117 default permissions for tin Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote attackers to execute arbitrary commands via a malicious web page. Q191200 java-script-patch(1276) MS98-011 Buffer overflow in Internet Explorer 4.01 and earlier allows remote attackers to execute arbitrary commands via a long URL with the "mk:" protocol, aka the "MK Overrun security issue." 19980114 L0pht Advisory MSIE4.0(1) Q176697 iemk-bug(917) sort creates temporary files and follows symbolic links, which allows local users to modify arbitrary files that are writable by the user running sort, as observed in updatedb and other programs that use sort. 19971006 KSR[T] Advisory #3: updatedb / crontabs 19980302 overwrite any file with updatedb 19980303 updatedb stuff Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental variable. 19980516 kde exploit 19980517 simple kde exploit fix kde-klock-home-bo(1644) Microsoft NetMeeting 2.1 allows one client to read the contents of another client's clipboard via a CTRL-C in the chat box when the box is empty. 19990504 Microsoft Netmeeting Hole netmeeting-clipboard(2187) Vulnerability in BSD Telnet client with encryption and Kerberos 4 authentication allows remote attackers to decrypt the session via sniffing. CA-1995-03 F-12 bsd-telnet(516) Kerberos 4 allows remote attackers to obtain sensitive information via a malformed UDP packet that generates an error string that inadvertently includes the realm name and the last user. 19961122 L0pht Kerberos Advisory kerberos-user-grab(65) Cisco PIX Private Link 4.1.6 and earlier does not properly process certain commands in the configuration file, which reduces the effective key length of the DES key to 48 bits instead of 56 bits, which makes it easier for an attacker to find the proper key via a brute force attack. I-056 19980616 PIX Private Link Key Processing and Cryptography Issues cisco-pix-parse-error(1579) Kabsoftware Lydia utility uses weak encryption to store user passwords in the lydia.ini file, which allows local users to easily decrypt the passwords and gain privileges. 19990219 Yet Another password storing problem (was: Re: Possible Netscape Crypto Security Flaw) lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times. E-25a 19940307 8lgm Advisory Releases http://www.phreak.org/archives/security/8lgm/8lgm.lpr dxconsole in DEC OSF/1 3.2C and earlier allows local users to read arbitrary files by specifying the file with the -file parameter. G-18 VB-96.05 osf-dxconsole-gain-privileges(7138) http://www.tao.ca/fire/bos/0209.html Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, which allows local users to gain privileges by decrypting the passwords. 19951205 Cracked: WINDOWS.PWL 19980120 How to recover private keys for various Microsoft products 19980121 How to recover private keys for various Microsoft products Q140557 win95-nbsmbpwl(71) Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary files by mapping the network drive. win95-netware-hidden-share(7231) http://www.net-security.sk/bugs/NT/netware1.html http://www.zdnet.com/eweek/reviews/1016/tr42bug.html Buffer overflow in kppp in KDE allows local users to gain root access via a long -c (account_name) command line argument. 19980429 Security hole in kppp 92 kde-kppp-account-bo(1643) Buffer overflow in kppp in KDE allows local users to gain root access via a long PATH environmental variable. 19981118 Multiple KDE security vulnerabilities (root compromise) kde-kppp-path-bo(1650) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-1107. Reason: This candidate is a duplicate of CVE-1999-1107. Notes: All CVE users should reference CVE-1999-1107 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server, while Sendmail continues to process the commands after the connection has been terminated. 19991222 Re: procmail / Sendmail - five bugs 20000113 Re: procmail / Sendmail - five bugs sendmail-etrn-dos(7760) 904 Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote malicious web sites to determine the existence of files on the client. 19991114 IE 5.0 and Windows Media Player ActiveX object allow checking the existence of local files and directories 793 Vulnerability in StackGuard before 1.21 allows remote attackers to bypass the Random and Terminator Canary security mechanisms by using a non-linear attack which directly modifies a pointer to a return address instead of using a buffer overflow to reach the return address entry itself. 19911109 ImmuniX OS Security Alert: StackGuard 1.21 Released 786 immunix-stackguard-bo(3524) Buffer overflow in IrfanView32 3.07 and earlier allows attackers to execute arbitrary commands via a long string after the "8BPS" image type in a Photo Shop image header. http://stud4.tuwien.ac.at/~e9227474/main2.html 19991109 Irfan view 3.07 buffer overflow 781 irfan-view32-bo(3549) Buffer overflow in Eudora Internet Mail Server (EIMS) 2.01 and earlier on MacOS systems allows remote attackers to cause a denial of service via a long USER command to port 106. 19980414 MacOS based buffer overflows... 75 Buffer overflow in Korn Shell (ksh) suid_exec program on IRIX 6.x and earlier, and possibly other operating systems, allows local users to gain root privileges. AA-96.17 19980405-01-I H-15A 467 ksh-suid_exec(2100) Vulnerability in the /etc/suid_exec program in HP Apollo Domain/OS sr10.2 and sr10.3 beta, related to the Korn Shell (ksh). CA-1990-04 A-30 apollo-suidexec-unauthorized-access(6721) 7 Vulnerability in runpriv in Indigo Magic System Administration subsystem of SGI IRIX 6.3 and 6.4 allows local users to gain root privileges. 19970503-01-PX 462 sgi-runpriv(2108) lquerypv in AIX 4.1 and 4.2 allows local users to read arbitrary files by specifying the file in the -h command line parameter. H-13 19961125 lquerypv fix 19961125 AIX lquerypv 19961124 455 ibm-lquerypv(1752) ndd in Solaris 2.6 allows local users to cause a denial of service by modifying certain TCP/IP parameters. 00165 433 sun-ndd(817) FTP installation script anon.ftp in AIX insecurely configures anonymous FTP, which allows remote attackers to execute arbitrary commands. CA-1992-09 41 aix-anon-ftp(3154) netprint in SGI IRIX 6.4 and earlier trusts the PATH environmental variable for finding and executing the disable program, which allows local users to gain privileges. 19961203-01-PX 19961203-02-PX 19970104 Irix: netprint story 395 sgi-netprint(2107) The default configuration for UUCP in AIX before 3.2 allows local users to gain root privileges. CA-1992-06 38 ibm-uucp(554) Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges. CA-1989-02 CIAC-08 3 sun-restore-gain-privileges(6695) The installation of Sun Source (sunsrc) tapes allows local users to gain root privileges via setuid root programs (1) makeinstall or (2) winstall. 00107 CA-1991-07 21 22 sun-sourcetapes(582) HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the target page to the mainframeset.cfm application, which requests the page from the server, making it look like the request is coming from the local host. http://packetstorm.securify.com/mag/phrack/phrack54/P54-08 Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file. 19970919 Instresting practises of Oracle [Oracle Webserver] Cisco Resource Manager (CRM) 1.1 and earlier creates certain files with insecure permissions that allow local users to obtain sensitive configuration information including usernames, passwords, and SNMP community strings, from (1) swim_swd.log, (2) swim_debug.log, (3) dbi_debug.log, and (4) temporary files whose names begin with "DPR_". I-086 19980813 CRM Temporary File Vulnerability cisco-crm-file-vuln(1575) Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability. Q195733 nt-spoolss(523) MS98-017 Internet Explorer 3.01 on Windows 95 allows remote malicious web sites to execute arbitrary commands via a .isp file, which is automatically downloaded and executed without prompting the user. http://members.tripod.com/~unibyte/iebug3.htm http://oliver.efri.hr/~crv/security/bugs/NT/ie3.html Cisco Catalyst 2900 Virtual LAN (VLAN) switches allow remote attackers to inject 802.1q frames into another VLAN by forging the VLAN identifier in the trunking tag. http://www.cisco.com/univercd/cc/td/doc/product/lan/28201900/1928v8x/eescg8x/aleakyv.htm 19990901 VLAN Security 615 cisco-catalyst-vlan-frames(3294) Default configuration of the search engine in Netscape Enterprise Server 3.5.1, and possibly other versions, allows remote attackers to read the source of JHTML files by specifying a search command using the HTML-tocrec-demo1.pat pattern file. 19990730 Netscape Enterprise Server yeilds source of JHTML 19990730 Netscape Enterprise Server yeilds source of JHTML 559 Buffer overflow in OSF Distributed Computing Environment (DCE) security demon (secd) in IRIX 6.4 and earlier allows attackers to cause a denial of service via a long principal, group, or organization. 19980601-01-PX I-060 VB-97.12 sgi-osf-dce-dos(1123) Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information Field (RIF) field with a hop count greater than 7, or (2) a list containing duplicate Token Ring IDs. 19981005 NMRC Advisory - Lame NT Token Ring DoS 19981002 NMRC Advisory - Lame NT Token Ring DoS Q179157 token-ring-dos(1399) HP-UX 9.x and 10.x running X windows may allow local attackers to gain privileges via (1) vuefile, (2) vuepad, (3) dtfile, or (4) dtpad, which do not authenticate users. HPSBUX9709-069 hp-vue-dt(499) Vulnerability in Vue 3.0 in HP 9.x allows local users to gain root privileges, as fixed by PHSS_4038, PHSS_4055, and PHSS_4066. E-23 HPSBUX9404-008 hp-vue(2284) Vulnerability in VUE 3.0 in HP 9.x allows local users to gain root privileges, as fixed by PHSS_4994 and PHSS_5438. HPSBUX9504-027 hp-vue(2284) Vulnerability in Predictive on HP-UX 11.0 and earlier, and MPE/iX 5.5 and earlier, allows attackers to compromise data transfer for Predictive messages (using e-mail or modem) between customer and Response Center Predictive systems. HPSBMP9807-005 19980729 HP-UX Predictive & Netscape SSL Vulnerabilities I-081 HPSBUX9807-081 mpeix-predictive(1413) The permissions for the /dev/audio device on Solaris 2.2 and earlier, and SunOS 4.1.x, allow any local user to read from the device, which could be used by an attacker to monitor conversations happening near a machine that has a microphone. 00122 E-01 sun-audio(549) SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable. CA-1993-13 sco-homedir(546) Character-Terminal User Environment (CUE) in HP-UX 11.0 and earlier allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the IOERROR.mytty file. 19970901 HP UX Bug :) 19980121 HP-UX CUE, CUD and LAND vulnerabilities I-027B HPSBUX9801-074 hp-cue(2007) Buffer overflow in CrackLib 2.5 may allow local users to gain root privileges via a long GECOS field. 19971214 buffer overflows in cracklib?! VB-97.16 cracklib-bo(1539) Ascom Timeplex router allows remote attackers to obtain sensitive information or conduct unauthorized activities by entering debug mode through a sequence of CTRL-D characters. 19970515 MicroSolved finds hole in Ascom Timeplex Router Security ascom-timeplex-debug(1824) SunOS 4.1.2 and earlier allows local users to gain privileges via "LD_*" environmental variables to certain dynamically linked setuid or setgid programs such as (1) login, (2) su, or (3) sendmail, that change the real and effective user ids to the same user. 00116 CA-1992-11 sun-env(3152) Vulnerability in runtime linker program rld in SGI IRIX 6.x and earlier allows local users to gain privileges via setuid and setgid programs. 19970504-01-PX H-065 sgi-rld(2109) Certain files in MPower in HP-UX 10.x are installed with insecure permissions, which allows local users to gain privileges. HPSBUX9701-051 hp-mpower(2056) Vulnerability in Glance programs in GlancePlus for HP-UX 10.20 and earlier allows local users to access arbitrary files and gain privileges. H-21 HPSBUX9701-044 hp-glanceplus(2059) Vulnerability in Glance and gpm programs in GlancePlus for HP-UX 9.x and earlier allows local users to access arbitrary files and gain privileges. HPSBUX9405-011 hp-glanceplus-gpm(2060) Buffer overflow in Platinum Policy Compliance Manager (PCM) 7.0 allows remote attackers to execute arbitrary commands via a long string to the Agent port (1827), which is handled by smaxagent.exe. 19981204 [SAFER-981204.DOS.1.3] Buffer Overflow in Platinum PCM 7.0 pcm-dos-execute(1430) FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time. Q189262 MS98-006 iis-passive-ftp(1215) Buffer overflow in CSM Proxy 4.1 allows remote attackers to cause a denial of service (crash) via a long string to the FTP port. 19980716 S.A.F.E.R. Security Bulletin 980708.DOS.1.1 csm-proxy-dos(1422) Livingston Portmaster routers running ComOS use the same initial sequence number (ISN) for TCP connections, which allows remote attackers to conduct spoofing and hijack TCP sessions. 19980630 Livingston Portmaster - ISN generation is loosy! portmaster-fixed-isn(1882) Compaq/Microcom 6000 Access Integrator does not cause a session timeout after prompting for a username or password, which allows remote attackers to cause a denial of service by connecting to the integrator without providing a username or password. 19980603 Compaq/Microcom 6000 DoS + more microcom-dos(2089) Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, which allows remote attackers to guess usernames or passwords via a brute force attack. 19980603 Compaq/Microcom 6000 DoS + more HAMcards Postcard CGI script 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address. cgi-perl-mail-programs(1400) LakeWeb Filemail CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address. http://lakeweb.com/scripts/ 19981109 Several new CGI vulnerabilities cgi-perl-mail-programs(1400) LakeWeb Mail List CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient email address. http://lakeweb.com/scripts/ 19981109 Several new CGI vulnerabilities cgi-perl-mail-programs(1400) BisonWare FTP Server 4.1 and earlier allows remote attackers to cause a denial of service via a malformed PORT command that contains a non-numeric character and a large number of carriage returns. bisonware-port-crash(2254) Tcpip.sys in Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service via an ICMP Subnet Mask Address Request packet, when certain multiple IP addresses are bound to the same network interface. Q192774 tcpipsys-icmp-dos(3894) Buffer overflow in (1) pluggable authentication module (PAM) on Solaris 2.5.1 and 2.5 and (2) unix_scheme in Solaris 2.4 and 2.3 allows local users to gain root privileges via programs that use these modules such as passwd, yppasswd, and nispasswd. AA-97.09 00139 SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root. 19981229 ssh2 security problem (and patch) (fwd) ssh-privileged-port-forward(1471) Vulnerability in ftpd/kftpd in HP-UX 10.x and 9.x allows local and possibly remote users to gain root privileges. H-33 HPSBUX9702-055 hp-ftpd-kftpd(7437) Vulnerability in ppl in HP-UX 10.x and earlier allows local users to gain root privileges by forcing ppl to core dump. H-32 19961103 Re: Untitled 19961104 ppl bugs HPSBUX9704-057 hp-ppl(7438) Vulnerability in passwd in SCO UNIX 4.0 and earlier allows attackers to cause a denial of service by preventing users from being able to log into the system. CA-1993-08 sco-passwd-deny(542) Vulnerability in HP Series 800 S/X/V Class servers allows remote attackers to gain access to the S/X/V Class console via the Service Support Processor (SSP) Teststation. HPSBUX9911-105 hp-ssp(7439) Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang. 19990625 Outlook denial of service GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2) read arbitrary files via symbolic links from .plan, .forward, or .project files. 19990721 old gnu finger bugs 19950317 GNU finger 1.37 executes ~/.fingerrc with gid root 535 Linux 2.0.37 does not properly encode the Custom segment limit, which allows local users to gain root privileges by accessing and modifying kernel memory. 19990711 Linux 2.0.37 segment limit bug 523 Cross-site scripting vulnerability in Third Voice Web annotation utility allows remote users to read sensitive data and generate fake web pages for other Third Voice users by injecting malicious Javascript into an annotation. thirdvoice-cross-site-scripting(7252) http://www.wired.com/news/technology/0,1282,20636,00.html http://www.wired.com/news/technology/0,1282,20677,00.html install.iss installation script for Internet Security Scanner (ISS) for Linux, version 5.3, allows local users to change the permissions of arbitrary files via a symlink attack on a temporary file. 19990220 ISS install.iss security hole nobo 1.2 allows remote attackers to cause a denial of service (crash) via a series of large UDP packets. 19990204 NOBO denial of service IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920. 19990204 WS FTP Server Remote DoS Attack 218 IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920. 19990204 WS FTP Server Remote DoS Attack 218 By design, Maximizer Enterprise 4 calendar and address book program allows arbitrary users to modify the calendar of other users when the calendar is being shared. 19990114 security hole in Maximizer Corel Word Perfect 8 for Linux creates a temporary working directory with world-writable permissions, which allows local users to (1) modify Word Perfect behavior by modifying files in the working directory, or (2) modify files of other users via a symlink attack. 19981218 wordperfect 8 for linux security ZIP drive for Iomega ZIP-100 disks allows attackers with physical access to the drive to bypass password protection by inserting a known disk with a known password, waiting for the ZIP drive to power down, manually replacing the known disk with the target disk, and using the known password to access the target disk. http://www.counterpane.com/crypto-gram-9812.html#doghouse Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, which allows remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets to UDP port 2048. I-054 19980513 Cisco Web Cache Control Protocol Router Vulnerability cisco-wccp-vuln(1577) Buffer overflow in cidentd ident daemon allows local users to gain root privileges via a long line in the .authlie script. 19980110 Cidentd 19980911 Re: security problems with jidentd Directory traversal vulnerability in nph-publish before 1.2 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the pathname for an upload operation. http://www.w3.org/Security/Faq/wwwsf4.html http://www-genome.wi.mit.edu/WWW/tools/CGI_scripts/server_publish/nph-publish http-cgi-nphpublish(2055) Sambar Server 4.1 beta allows remote attackers to obtain sensitive information about the server via an HTTP request for the dumpenv.pl script. 19980610 Sambar Server Beta BUG.. sambar-dump-env(3223) Vulnerability in man.sh CGI script, included in May 1998 issue of SysAdmin Magazine, allows remote attackers to execute arbitrary commands. 19980515 May SysAdmin man.sh security hole O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat. O'Reilly has corrected this issue in WebSite Professional 2.5, which is now available from: http://website.oreilly.com Vulnerability in On-Line Customer Registration software for IRIX 6.2 through 6.4 allows local users to gain root privileges. 19980901-01-PX J-003 irix-register(7441) Buffer overflow in run-time linkers (1) ld.so or (2) ld-linux.so for Linux systems allows local users to gain privileges by calling a setuid program with a long program name (argv[0]) and forcing ld.so/ld-linux.so to report an error. 19970717 KSR[T] Advisory #2: ld.so 19970722 ld.so vulnerability 19980204 An old ld-linux.so hole System Manager sysmgr GUI in SGI IRIX 6.4 and 6.3 allows remote attackers to execute commands by providing a trojan horse (1) runtask or (2) runexec descriptor file, which is used to execute a System Manager Task when the user's Mailcap entry supports the x-sgi-task or x-sgi-exec type. 19980403-01-PX 19980403-02-PX sgi-mailcap(809) Buffer overflow in Elm 2.4 and earlier allows local users to gain privileges via a long TERM environmental variable. 19970513 19970514 Re: ELM overflow Buffer overflow in SCO mscreen allows local users to gain root privileges via a long terminal entry (TERM) in the .mscreenrc file. 19980926 Root exploit for SCO OpenServer. sco-openserver-mscreen-bo(1379) rxvt, when compiled with the PRINT_PIPE option in various Linux operating systems including Linux Slackware 3.0 and RedHat 2.1, allows local users to gain root privileges by specifying a malicious program using the -print-pipe command line parameter. 19960102 rxvt security hole Pine before version 3.94 allows local users to gain privileges via a symlink attack on a lockfile that is created when a user receives new mail. 19960826 [BUG] Vulnerability in PINE pine-tmpfile(416) mysqld in MySQL 3.21 creates log files with world-readable permissions, which allows local users to obtain passwords for users who are added to the user database. 19981227 mysql: mysqld creates world readable logs.. mysql-readable-log-files(1568) Buffer overflow in Netscape Navigator/Communicator 4.7 for Windows 95 and Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long argument after the ? character in a URL that references an .asp, .cgi, .html, or .pl file. 19991124 Netscape Communicator 4.7 - Navigator Overflows 19991127 Netscape Communicator 4.7 - Navigator Overflows 822 netscape-long-argument-bo(7884) Buffer overflow in POP3 server of Admiral Systems EmailClub 1.05 allows remote attackers to execute arbitrary commands via a long "From" header in an e-mail message. http://www.securiteam.com/exploits/E-MailClub__FROM__remote_buffer_overflow.html 801 Buffer overflow in chkey in Solaris 2.5.1 and earlier allows local users to gain root privileges via a long command line argument. AA-97.18 19970519 Re: Finally, most of an exploit for Solaris 2.5.1's ps. 00144 solaris-chkey-bo(7442) 207 Buffer overflow in eeprom in Solaris 2.5.1 and earlier allows local users to gain root privileges via a long command line argument. 00143 solaris-eeprom-bo(7444) 206 The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become root. CA-1991-06 20 next-me(581) chroot in Digital Ultrix 4.1 and 4.0 is insecurely installed, which allows local users to gain privileges. CA-1991-05 17 dec-chroot(577) NAI VirusScan NT 4.0.2 does not properly modify the scan.dat virus definition file during an update via FTP, but it reports that the update was successful, which could cause a system administrator to believe that the definitions have been updated correctly. 19990505 NAI AntiVirus Update Problem 19990505 NAI AntiVirus Update Problem 169 Hummingbird Exceed X version 5 allows remote attackers to cause a denial of service via malformed data to port 6000. Upgrade to a non-vulnerable version of Exceed (Hummingbird Exceed 6.0.1 Hummingbird Exceed 6.0.2 Hummingbird Exceed 6.1) 19990427 NT/Exceed D.O.S. 158 TIOCCONS in SunOS 4.1.1 does not properly check the permissions of a user who tries to redirect console output and input, which could allow a local user to gain privileges. CA-1990-12 sunos-tioccons-console-redirection(7140) 14 BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to gain root privileges. B-01 CA-1990-06 nextstep-builddisk-root-access(7141) 11 Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability. 19980807 YA Apache DoS attack 19980808 Debian Apache Security Update 19980811 Apache 'sioux' DOS fix for TurboLinux 19980810 Apache DoS Attack http://www.redhat.com/support/errata/rh51-errata-general.html#apache Vintra SMTP MailServer allows remote attackers to cause a denial of service via a malformed "EXPN *@" command. 19980720 DOS in Vintra systems Mailserver software. vintra-mail-dos(1617) Windows 95 and Windows 98 systems, when configured with multiple TCP/IP stacks bound to the same MAC address, allow remote attackers to cause a denial of service (traffic amplification) via a certain ICMP echo (ping) packet, which causes all stacks to send a ping response, aka TCP Chorusing. 19990206 New Windows 9x Bug: TCP Chorusing 225 win-multiple-ip-dos(7542) StarTech (1) POP3 proxy server and (2) telnet server allows remote attackers to cause a denial of service via a long USER command. 19980703 Windows95 Proxy DoS Vulnerabilites startech-pop3-overflow(2088) Multilink PPP for ISDN dialup users in Ascend before 4.6 allows remote attackers to cause a denial of service via a spoofed endpoint identifier. 19990210 Security problems in ISDN equipment authentication 19990212 PPP/ISDN multilink security issue - summary ascend-ppp-isdn-dos(7498) Check Point Firewall-1 does not properly handle certain restricted keywords (e.g., Mail, auth, time) in user-defined objects, which could produce a rule with a default "ANY" address and result in access to more systems than intended by the administrator. 19980511 Firewall-1 Reserved Keywords Vulnerability http://www.checkpoint.com/techsupport/config/keywords.html fw1-user-defined-keywords-access(7293) nettune in HP-UX 10.01 and 10.00 is installed setuid root, which allows local users to cause a denial of service by modifying critical networking configuration information. 19960607 HP-UX B.10.01 vulnerability HPSBUX9607-035 hp-nettune(414) SystemSoft SystemWizard package in HP Pavilion PC with Windows 98, and possibly other platforms and operating systems, installs two ActiveX controls that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via a malicious web page that references (1) the Launch control, or (2) the RegObj control. 19990729 New ActiveX security problems in Windows 98 PCs 555 http://www.systemsoft.com/l-2/l-3/support-systemwizard.htm Buffer overflow in web-admin tool in NetXRay 2.6 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request. http://www.efri.hr/~crv/security/bugs/NT/netxtray.html netxray-bo(907) Buffer overflow in ping in AIX 4.2 and earlier allows local users to gain root privileges via a long command line argument. 19970721 AIX ping (Exploit) 19970721 AIX ping, lchangelv, xlock fixes ping-bo(803) Vulnerability in scoterm in SCO OpenServer 5.0 and SCO Open Desktop/Open Server 3.0 allows local users to gain root privileges. 19971204 scoterm exploit VB-97.14 sco-scoterm(690) xterm in Digital UNIX 4.0B *with* patch kit 5 allows local users to overwrite arbitrary files via a symlink attack on a core dump file, which is created when xterm is called with a DISPLAY environmental variable set to a display that xterm cannot access. 19971112 Digital Unix Security Problem dec-xterm(613) Vulnerability in in.telnetd in SunOS 4.1.1 and earlier allows local users to gain root privileges. CA-1991-02 sun-intelnetd(574) Vulnerability in in.rlogind in SunOS 4.0.3 and 4.0.3c allows local users to gain root privileges. CA-1991-02 sun-intelnetd(574) Vulnerability in telnet service in HP-UX 10.30 allows attackers to cause a denial of service. HPSBUX9710-070 hp-telnetdos(571) The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID. http://www.openbsd.com/advisories/signals.txt openbsd-iosig(556) LOGIN.EXE program in Novell Netware 4.0 and 4.01 temporarily writes user name and password information to disk, which could allow local users to gain privileges. D-21 CA-1993-12 novell-login(545) Cisco routers 9.17 and earlier allow remote attackers to bypass security restrictions via certain IP source routed packets that should normally be denied using the "no ip source-route" command. D-15 CA-1993-07 cisco-sourceroute(541) The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories. 19970723 NT security - why bother? 19970725 Re: NT security - why bother? nt-path(526) Vulnerability in finger in Commodore Amiga UNIX 2.1p2a and earlier allows local users to read arbitrary files. CA-1993-04 amiga-finger(522) Vulnerability in sgihelp in the SGI help system and print manager in IRIX 5.2 and earlier allows local users to gain root privileges, possibly through the clogin command. E-33 CA-1994-13 468 sgi-prn-mgr(511) Majordomo 1.94.3 and earlier allows remote attackers to execute arbitrary commands when the advertise or noadvertise directive is used in a configuration file, via shell metacharacters in the Reply-To header. 19970824 Vulnerability in Majordomo majordomo-advertise(502) dxchpwd in Digital Unix (OSF/1) 3.x allows local users to modify arbitrary files via a symlink attack on the dxchpwd.log file. 19961117 Digital Unix v3.x (v4.x?) security vulnerability dgux-chpwd(399) Netbt.sys in Windows NT 4.0 allows remote malicious DNS servers to cause a denial of service (crash) by returning 0.0.0.0 as the IP address for a DNS host name lookup. Q188571 dns-netbtsys-dos(3893) IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters. Q187503 url-asp-av(3892) IMAP 4.1 BETA, and possibly other versions, does not properly handle the SIGABRT (abort) signal, which allows local users to crash the server (imapd) via certain sequences of commands, which causes a core dump that may contain sensitive password information. 19971008 L0pht Advisory: IMAP4rev1 imapd server imapd-core(349) rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not. 19970824 Serious security flaw in rpc.mountd on several operating systems. mountd-file-exists(347) Netscape Communicator 4.7 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long certificate key. netscape-huge-key-dos(3436) Ethereal allows local users to overwrite arbitrary files via a symlink attack on the packet capture file. http://www.ethereal.com/lists/ethereal-dev/199907/msg00126.html http://www.ethereal.com/lists/ethereal-dev/199907/msg00130.html ethereal-dev-capturec-root(3334) Various modems that do not implement a guard time, or are configured with a guard time of 0, can allow remote attackers to execute arbitrary modem commands such as ATH, ATH0, etc., via a "+++" sequence that appears in ICMP packets, the subject of an e-mail message, IRC commands, and others. 19980927 1+2=3, +++ATH0=Old school DoS http://www.macintouch.com/modemsecurity.html global-village-modem-dos(3320) Quake 2 server 3.13 on Linux does not properly check file permissions for the config.cfg configuration file, which allows local users to read arbitrary files via a symlink from config.cfg to the target file. 19980225 Quake 2 Linux 3.13 (and lower) allow users to read arbitrary files linux-quake2(733) Quake 2 server allows remote attackers to cause a denial of service via a spoofed UDP packet with a source address of 127.0.0.1, which causes the server to attempt to connect to itself. 19971224 Quake II Remote Denial of Service quake2-dos(698) ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server. 19990609 ssh advirsory ssh-leak(2276) Untrusted search path vulnerability in day5datacopier in SGI IRIX 6.2 allows local users to execute arbitrary commands via a modified PATH environment variable that points to a malicious cp program. 19970516 Irix and WWW sgi-day5datacopier(3316) IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain, aka the "Domain Resolution" vulnerability. 241562 657 MS99-039 iis-unresolved-domain-access(3306) LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in a call to (1) SamrOpenDomain, (2) SamrEnumDomainUsers, and (3) SamrQueryDomainInfo. 19991026 Re: LSA vulnerability on NT40 SP5 msrpc-samr-open-dos(3293) Internet Explorer 5.0 records the username and password for FTP servers in the URL history, which could allow (1) local users to read the information from another user's index.dat, or (2) people who are physically observing ("shoulder surfing") another user to read the information from the status bar when the user moves the mouse over a link. nt-ie5-user-ftp-password(3289) Internet Anywhere Mail Server 2.3.1 stores passwords in plaintext in the msgboxes.dbf file, which could allow local users to gain privileges by extracting the passwords from msgboxes.dbf. 19991001 Vulnerabilities in the Internet Anywhere Mail Server 731 iams-passwords-plaintext(3285) Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods. 19990606 Buffer overflows in smbval library smbvalid-bo(2272) Vulnerability in CORE-DIAG fileset in HP message catalog in HP-UX 9.05 and earlier allows local users to gain privileges. HPSBUX9409-017 hp-core-diag-fileset(2262) HP-UX 9.x does not properly enable the Xauthority mechanism in certain conditions, which could allow local users to access the X display even when they have not explicitly been authorized to do so. HPSBUX9407-015 hp-xauthority(2261) Buffer overflow in cddbd CD database server allows remote attackers to execute arbitrary commands via a long log message. cddbd-bo(2203) Internet Explorer, with a security setting below Medium, allows remote attackers to execute arbitrary commands via a malicious web page that uses the FileSystemObject ActiveX object. http://oliver.efri.hr/~crv/security/bugs/NT/activex4.html ie-filesystemobject(2173) Vulnerability in subnetconfig in HP-UX 9.01 and 9.0 allows local users to gain privileges. HPSBUX9402-003 hp-subnet-config(2162) SGI Desktop Permissions Tool in IRIX 6.0.1 and earlier allows local users to modify permissions for arbitrary files and gain privileges. 19950301-01-P373 F-16 sgi-permissions(2113) IPFilter 3.2.3 through 3.2.10 allows local users to modify arbitrary files via a symlink attack on the saved output file. 19990415 FSA-99.04-IPFILTER-v3.2.10 ipfilter-temp-file(2087) vacm ucd-snmp SNMP server, version 3.52, does not properly disable access to the public community string, which could allow remote attackers to obtain sensitive information. This vulnerability was fixed in version 3.6 of ucd-snmpd. ucd-snmpd-community(2086) Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which has insecure default permissions, allowing remote attackers to read the passwords and gain privileges. Q229972 siteserver-directmail-passwords(2068) Vulnerability in HP Camera component of HP DCE/9000 in HP-UX 9.x allows attackers to gain root privileges. HPSBUX9402-006 hp-dce9000(2061) Vulnerability in Support Watch (aka SupportWatch) in HP-UX 8.0 through 9.0 allows local users to gain privileges. HPSBUX9411-019 hp-supportwatch(2058) movemail in HP-UX 10.20 has insecure permissions, which allows local users to gain privileges. HPSBUX9701-047 hp-movemail(2057) Vulnerability in CGI program in the Lasso application by Blue World, as used on WebSTAR and other servers, allows remote attackers to read arbitrary files. 19970819 Lasso CGI security hole (fwd) http-cgi-lasso(2044) Vulnerability in direct audio user space code on HP-UX 10.20 and 10.10 allows local users to cause a denial of service. HPSBUX9612-043 hp-audio-panic(2010) Vulnerability in a certain system call in SCO UnixWare 2.0.x and 2.1.0 allows local users to access arbitrary files and gain root privileges. 96:002 VB-96.15 sco-system-call(1966) Vulnerability in a kernel error handling routine in SCO OpenServer 5.0.2 and earlier, and SCO Internet FastStart 1.0, allows local users to gain root privileges. 96:001 VB-96.10 sco-kernel(1965) Windows 95, 98, and NT 4.0 allow remote attackers to cause a denial of service by spoofing ICMP redirect messages from a router, which causes Windows to change its routing tables. 19990308 Winfreeze EXPLOIT Win9x/NT win-redirects-freeze(1947) Hyperseek allows remote attackers to modify the hyperseek configuration by directly calling the admin.cgi program with an edit_file action parameter. hyperseek-modify(1914) Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition stores the database master password in plaintext in the spoolmain.log file when a new database is created, which allows local users to obtain the password from that file. 19990304 Oracle Plaintext Password 19990304 Oracle Plaintext Password oracle-passwords(1902) Xyplex terminal server 6.0.1S1, and possibly other versions, allows remote attackers to bypass the password prompt by entering (1) a CTRL-Z character, or (2) a ? (question mark). 19971126 Xyplex terminal server bug xyplex-controlz-login(1825) xyplex-question-login(1826) rpc.pwdauthd in SunOS 4.1.1 and earlier does not properly prevent remote access to the daemon, which allows remote attackers to obtain sensitive system information. 00102 sun-pwdauthd(1782) Microsoft Office 98, Macintosh Edition, does not properly initialize the disk space used by Office 98 files and effectively inserts data from previously deleted files into the Office file, which could allow attackers to obtain sensitive information. Q189529 office-extraneous-data(1780) mSQL (Mini SQL) 2.0.6 allows remote attackers to obtain sensitive server information such as logged users, database names, and server version via the ServerStats query. 19990215 KSR[T] Advisory #10: mSQL ServerStats msql-serverstats(1777) Buffer overflow in Rainbow Six Multiplayer allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long nickname (nick) command. 19990211 Rainbow Six Buffer Overflow..... rainbowsix-nick-bo(1772) Java in Netscape 4.5 does not properly restrict applets from connecting to other hosts besides the one from which the applet was loaded, which violates the Java security model and could allow remote attackers to conduct unauthorized activities. 19990202 Unsecured server in applets under Netscape java-socket-open(1727) Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an e-mail message containing a uuencoded attachment that specifies the full pathname for the file to be modified, which is processed by uuencode in Metamail scripts such as sun-audio-file. 19971024 Vulnerability in metamail metamail-file-creation(1677) WebRamp M3 router does not disable remote telnet or HTTP access to itself, even when access has been explicitly disabled. 19990203 WebRamp M3 Perceived Bug 19990121 WebRamp M3 remote network access bug webramp-remote-access(1670) SMTP server in SLmail 3.1 and earlier allows remote attackers to cause a denial of service via malformed commands whose arguments begin with a "(" (parenthesis) character, such as (1) SEND, (2) VRFY, (3) EXPN, (4) MAIL FROM, (5) RCPT TO. 19980922 WARNING! SMTP Denial of Service in SLmail ver 3.1 19980922 WARNING! SMTP Denial of Service in SLmail ver 3.1 slmail-parens-overload(1664) rsh daemon (rshd) generates different error messages when a valid username is provided versus an invalid name, which allows remote attackers to determine valid users on the system. 19970613 rshd gives away usernames rsh-username-leaks(1660) KDE file manager (kfm) uses a TCP server for certain file operations, which allows remote attackers to modify arbitrary files by sending a copy command to the server. 19970505 Hole in the KDE desktop kde-flawed-ipc(1646) Vulnerability in KDE konsole allows local users to hijack or observe sessions of other users by accessing certain devices. http://lists.kde.org/?l=kde-devel&m=91560433413263&w=2 kde-konsole-hijack(1645) Screen savers in KDE beta 3 allows local users to overwrite arbitrary files via a symlink attack on the .kss.pid file. 19980206 serious security hole in KDE Beta 3 kde-kss-file-clobber(1641) KMail in KDE 1.0 provides a PGP passphrase as a command line argument to other programs, which could allow local users to obtain the passphrase and compromise the PGP keys of other users by viewing the arguments via programs that list process information, such as ps. http://lists.kde.org/?l=kde-devel&m=90221974029738&w=2 kde-kmail-passphrase-leak(1639) Macromedia Dreamweaver uses weak encryption to store FTP passwords, which could allow local users to easily decrypt the passwords of other users. 19980611 Unsecure passwords in Macromedia Dreamweaver dreamweaver-weak-passwords(1636) Buffer overflows in CDROM Confidence Test program (cdrom) allow local users to gain root privileges. 19980301-01-PX irix-cdrom-confidence(1635) Squid Internet Object Cache 1.1.20 allows users to bypass access control lists (ACLs) by encoding the URL with hexadecimal escape sequences. 19980220 Simple way to bypass squid ACLs squid-regexp-acl(1627) iPass RoamServer 3.1 creates temporary files with world-writable permissions. 19971229 iPass RoamServer 3.1 ipass-temporary-files(1625) Lotus cc:Mail release 8 stores the postoffice password in plaintext in a hidden file which has insecure permissions, which allows local users to gain privileges. 19970908 Password unsecurity in cc:Mail release 8 lotus-ccmail-passwords(1619) fte-console in the fte package before 0.46b-4.1 does not drop root privileges, which allows local users to gain root access via the virtual console device. 19981207 fte-console: does not drop its root priviliges fte-console-privileges(1609) BackWeb client stores the username and password in cleartext for proxy authentication in the Communication registry key, which could allow other local users to gain privileges by reading the password. 19981224 BackWeb - Password issue (used by NAI for Corporate customer notification). backweb-cleartext-passwords(1565) nlog CGI scripts do not properly filter shell metacharacters from the IP address argument, which could allow remote attackers to execute certain commands via (1) nlog-smb.pl or (2) rpc-nlog.pl. 19981225 Re: Nlog v1.0 Released - Nmap 2.x log management / analyzing tool 19981226 Nlog 1.1b released - security holes fixed http-cgi-nlog-metachars(1549) http-cgi-nlog-netbios(1550) An interaction between the AS/400 shared folders feature and Microsoft SNA Server 3.0 and earlier allows users to view each other's folders when the users share the same Local APPC LU. Q138001 snaserver-shared-folders(1548) Hummingbird Exceed 6.0.1.0 inadvertently includes a DLL that was meant for development and testing, which logs user names and passwords in cleartext in the test.log file. 19981203 Remote Tools w/Exceed v.6.0.1.0 fer 95 exceed-cleartext-passwords(1547) Development version of Breeze Network Server allows remote attackers to cause the system to reboot by accessing the configbreeze CGI program. 19981226 Breeze Network Server remote reboot and other bogosity. breeze-remote-reboot(1544) RealSystem G2 server stores the administrator password in cleartext in a world-readable configuration file, which allows local users to gain privileges. 19981210 RealSystem passwords realsystem-readable-conf-file(1542) Opera 3.2.1 allows remote attackers to cause a denial of service (application crash) via a URL that contains an extra / in the http:// tag. 19980814 URL exploit to crash Opera Browser opera-slash-crash(1541) NukeNabber allows remote attackers to cause a denial of service by connecting to the NukeNabber port (1080) without sending any data, which causes the CPU usage to rise to 100% from the report.exe program that is executed upon the connection. 19981107 Re: various *lame* DoS attacks http://www.dynamsol.com/puppet/text/new.txt 19981105 various *lame* DoS attacks nukenabber-timeout-dos(1540) Linux 2.1.132 and earlier allows local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed. 19981227 [patch] fix for urandom read(2) not interruptible linux-random-read-dos(1472) addnetpr in SGI IRIX 6.2 and earlier allows local users to modify arbitrary files and possibly gain root access via a symlink attack on a temporary file. ftp://patches.sgi.com/support/free/security/advisories/19961203-02-PX 19970509 Re: Irix: misc 330 irix-addnetpr(1433) Vulnerability in Analog 3.0 and earlier allows remote attackers to read arbitrary files via the forms interface. http://www.statslab.cam.ac.uk/~sret1/analog/security.html analog-remote-file(1410) Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions including the setgid bit, which allows local users to read and write files and possibly gain privileges via bugs in the program. SA-1998.35 19981119 Vulnerability in Samba on RedHat, Caldera and PHT TurboLinux samba-wsmbconf(1406) ICQ 98 beta on Windows NT leaks the internal IP address of a client in the TCP data segment of an ICQ packet instead of the public address (e.g. through NAT), which provides remote attackers with potentially sensitive information about the client or the internal network configuration. 19981111 WARNING: Another ICQ IP address vulnerability icq-ip-info(1398) Buffer overflow in nftp FTP client version 1.40 allows remote malicious FTP servers to cause a denial of service, and possibly execute arbitrary commands, via a long response string. 19981117 nftp vulnerability (fwd) http://www.ayukov.com/nftp/history.html nftp-bo(1397) TCP/IP implementation in Microsoft Windows 95, Windows NT 4.0, and possibly others, allows remote attackers to reset connections by forcing a reset (RST) via a PSH ACK or other means, obtaining the target's last sequence number from the resulting packet, then spoofing a reset to the target. 19981005 New Windows Vulnerability nt-brkill(1383) Buffer overflow in web administration feature of Kolban Webcam32 4.8.3 and earlier allows remote attackers to execute arbitrary commands via a long URL. 19980901 Remote Buffer Overflow in the Kolban Webcam32 Program webcam32-buffer-overflow(1366) mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core. 19980106 Apache security advisory http://www.apache.org/info/security_bulletin_1.2.5.html Office Shortcut Bar (OSB) in Windows 3.51 enables backup and restore permissions, which are inherited by programs such as File Manager that are started from the Shortcut Bar, which could allow local users to read folders for which they do not have permission. Q146604 nt-filemgr(562) Transarc DCE Distributed File System (DFS) 1.1 for Solaris 2.4 and 2.5 does not properly initialize the grouplist for users who belong to a large number of groups, which could allow those users to gain access to resources that are protected by DFS. VB-96.16 dfs-login-groups(7154) Buffer overflow in Kerberos IV compatibility libraries as used in Kerberos V allows local users to gain root privileges via a long line in a kerberos configuration file, which can be specified via the KRB_CONF environmental variable. 19970429 vulnerabilities in kerberos cmdtool in OpenWindows 3.0 and XView 3.0 in SunOS 4.1.4 and earlier allows attackers with physical access to the system to display unechoed characters (such as those from password prompts) via the L2/AGAIN key. 1077164 sun-cmdtool-echo(7482) Sysinstall in FreeBSD 2.2.1 and earlier, when configuring anonymous FTP, creates the ftp user without a password and with /bin/date as the shell, which could allow attackers to gain access to certain system resources. FreeBSD-SA-97:03 freebsd-sysinstall-ftp-password(7537) rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file. 19970203 Linux rcp bug Vulnerability in accton in Cray UNICOS 6.1 and 6.0 allows local users to read arbitrary files and modify system accounting configuration. B-31 A design flaw in the Z-Modem protocol allows the remote sender of a file to execute arbitrary programs on the client, as implemented in rz in the rzsz module of FreeBSD before 2.1.5, and possibly other programs. FreeBSD-SA-96:17 G-31 rzsz-command-execution(7540) Unspecified vulnerability in pt_chmod in SCO UNIX 4.2 and earlier allows local users to gain root access. 94:001 VB-94:01 sco-pt_chmod(7586) Vulnerability in prwarn in SCO UNIX 4.2 and earlier allows local users to gain root access. 94:001 Vulnerability in login in SCO UNIX 4.2 and earlier allows local users to gain root access. 94:001 Vulnerability in "at" program in SCO UNIX 4.2 and earlier allows local users to gain root access. 94:001 Cisco IOS 9.1 and earlier does not properly handle extended IP access lists when the IP route cache is enabled and the "established" keyword is set, which could allow attackers to bypass filters. CA-1992-20 Vulnerability in urestore in Novell UnixWare 1.1 allows local users to gain root privileges. F-06 19941209 Novell security advisory on sadc, urestore and the suid_exec feature Certain programs in HP-UX 10.20 do not properly handle large user IDs (UID) or group IDs (GID) over 60000, which could allow local users to gain privileges. H-09 H-91 hp-large-uid-gid(7594) Sendmail before 8.6.7 allows local users to gain root access via a large value in the debug (-d) command line option. CA-1994-12 19940314 sendmail -d problem (OLD yet still here) 19940315 anyone know details? 19940315 so... 19940315 Security problem in sendmail versions 8.x.x 19940327 sendmail exploit script - resend sendmail-debug-gain-root(7155) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-1022. Reason: This candidate is a duplicate of CVE-1999-1022. Notes: All CVE users should reference CVE-1999-1022 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Vulnerability in dtlogin and dtsession in HP-UX 10.20 and 10.10 allows local users to bypass authentication and gain privileges. H-21 Vulnerability in DEC OpenVMS VAX 5.5-2 through 5.0, and OpenVMS AXP 1.0, allows local users to gain system privileges. CA-1993-05 openvms-local-privilege-elevation(7142) Manual page reader (man) in FreeBSD 2.2 and earlier allows local users to gain privileges via a sequence of commands. FreeBSD-SA-96:11 G-24 bsd-man-command-sequence(7348) Vulnerability in union file system in FreeBSD 2.2 and earlier, and possibly other operating systems, allows local users to cause a denial of service (system reload) via a series of certain mount_union commands. FreeBSD-SA-96:10 G-24 unionfs-mount-ordering(7429) Vulnerabilities in DECnet/OSI for OpenVMS before 5.8 on DEC Alpha AXP and VAX/VMS systems allow local users to gain privileges or cause a denial of service. F-04 Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess. Q247975 passfilt-fullname(7391) Windows NT 4.0 SP4 and earlier allows local users to gain privileges by modifying the symbolic link table in the \?? object folder using a different case letter (upper or lower) to point to a different device. 19990312 [ ALERT ] Case Sensitivity and Symbolic Links 19990314 AW: [ ALERT ] Case Sensitivity and Symbolic Links Q222159 nt-symlink-case(7398) /usr/5bin/su in SunOS 4.1.3 and earlier uses a search path that includes the current working directory (.), which allows local users to gain privileges via Trojan horse programs. 1121935 sun-su-path(7480) Vulnerability in object server program in SGI IRIX 5.2 through 6.1 allows remote attackers to gain root privileges in certain configurations. 19960101-01-PX irix-object-server(7430) Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spoofing. D-01 netware-packet-spoofing-privileges(7213) Buffer overflow in ssh 1.2.26 client with Kerberos V enabled could allow remote attackers to cause a denial of service or execute arbitrary commands via a long DNS hostname that is not properly handled during TGT ticket passing. 19981105 security patch for ssh-1.2.26 kerberos code The installation of 1ArcServe Backup and Inoculan AV client modules for Exchange create a log file, exchverify.log, which contains usernames and passwords in plaintext. 19981112 exchverify.log 19981117 Re: exchverify.log - update #1 Norton AntiVirus for Internet Email Gateways (NAVIEG) 1.0.1.7 and earlier, and Norton AntiVirus for MS Exchange (NAVMSE) 1.5 and earlier, store the administrator password in cleartext in (1) the navieg.ini file for NAVIEG, and (2) the ModifyPassword registry key in NAVMSE. 19990409 NAV for MS Exchange & Internet Email Gateways VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing. D-06 openvms-sysgen-enabled(7225) SAS System 5.18 on VAX/VMS is installed with insecure permissions for its directories and startup file, which allows local users to gain privileges. C-19 vaxvms-sas-gain-privileges(7261) wu-ftpd 2.4 FTP server does not properly drop privileges when an ABOR (abort file transfer) command is executed during a file transfer, which causes a signal to be handled incorrectly and allows local and possibly remote attackers to read arbitrary files. 19970104 serious security bug in wu-ftpd v2.4 19970105 BoS: serious security bug in wu-ftpd v2.4 -- PATCH wuftpd-abor-gain-privileges(7169) Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable. 19980601 Re: SECURITY: Red Hat Linux 5.1 linuxconf bug (fwd) linuxconf-lang-bo(7239) http://www.redhat.com/support/errata/rh51-errata-general.html#linuxconf linuxconf before 1.11.r11-rh3 on Red Hat Linux 5.1 allows local users to overwrite arbitrary files and gain root access via a symlink attack. 19980823 Security concerns in linuxconf shipped w/RedHat 5.1 linuxconf-symlink-gain-privileges(7232) http://www.redhat.com/support/errata/rh51-errata-general.html#linuxconf Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges. sysvinit-root-bo(7250) http://www.redhat.com/support/errata/rh50-errata-general.html#SysVinit The snprintf function in the db library 1.85.4 ignores the size parameter, which could allow attackers to exploit buffer overflows that would be prevented by a properly implemented snprintf. http://lists.openresources.com/Debian/debian-bugs-closed/msg00581.html 19970709 [linux-security] so-called snprintf() in db-1.85.4 (fwd) linux-libdb-snprintf-bo(7244) http://www.redhat.com/support/errata/rh42-errata-general.html#db netcfg 2.16-1 in Red Hat Linux 4.2 allows the Ethernet interface to be controlled by users on reboot when an option is set, which allows local users to cause a denial of service by shutting down the interface. netcfg-ethernet-dos(7245) http://www.redhat.com/support/errata/rh42-errata-general.html#netcfg gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file. 19980128 GZEXE - the big problem DSA-308 gzip-gzexe-tmp-symlink(7241) http://www.redhat.com/support/errata/rh50-errata-general.html#gzip 7845 automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded. 19980319 ncftp 2.4.2 MkDirs bug ncftp-autodownload-command-execution(7240) http://www.redhat.com/support/errata/rh50-errata-general.html#ncftp Multiple buffer overflows in filter command in Elm 2.4 allows attackers to execute arbitrary commands via (1) long From: headers, (2) long Reply-To: headers, or (3) via a long -f (filterfile) command line argument. 19980129 KSR[T] Advisory #7: filter http://www.redhat.com/support/errata/rh50-errata-general.html#elm snmpd server in cmu-snmp SNMP package before 3.3-1 in Red Hat Linux 4.0 is configured to allow remote attackers to read and write sensitive information. http://www.redhat.com/support/errata/rh40-errata-general.html#cmu-snmp cmusnmp-read-write(7251) 3Com HiPer Access Router Card (HiperARC) 4.0 through 4.2.29 allows remote attackers to cause a denial of service (reboot) via a flood of IAC packets to the telnet port. 19990812 3com hiperarch flaw [hiperbomb.c] 19990816 Re: 3com hiperarch flaw [hiperbomb.c] FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges. 19990801 midnight commander vulnerability(?) (fwd) midnight-commander-data-disclosure(9873) Delegate proxy 5.9.3 and earlier creates files and directories in the DGROOT with world-writable permissions. 19990721 Delegate creates directories writable for anyone Vulnerability when Network Address Translation (NAT) is enabled in Linux 2.2.10 and earlier with ipchains, or FreeBSD 3.2 with ipfw, allows remote attackers to cause a denial of service (kernel panic) via a ping -R (record route) command. 19990722 Linux +ipchains+ ping -R 19990722 Re: ping -R causes kernel panic on a forwarding machine ( 2.2.5 a nd 2 .2.10) ipchains-ping-route-dos(7257) http://www.kernel.org/pub/linux/kernel/v2.2/patch-2.2.11.gz Buffer overflow in faxalter in hylafax 4.0.2 allows local users to gain privileges via a long -m command line argument. 19991104 hylafax-4.0.2 local exploit 765 Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices. 19991022 Local user can send forged packets linux-tiocsetd-forge-packets(7858) ICQ ActiveList Server allows remote attackers to cause a denial of service (crash) via malformed packets to the server's UDP port. 19991017 ICQ ActiveList Server Exploit... HTTP server for Xerox DocuColor 4 LP allows remote attackers to cause a denial of service (hang) via a long URL that contains a large number of . characters. 19991013 Xerox DocuColor 4 LP D.O.S Auto_FTP.pl script in Auto_FTP 0.2 stores usernames and passwords in plaintext in the auto_ftp.conf configuration file. 19991005 Auto_FTP v0.02 Advisory Auto_FTP.pl script in Auto_FTP 0.2 uses the /tmp/ftp_tmp as a shared directory with insecure permissions, which allows local users to (1) send arbitrary files to the remote server by placing them in the directory, and (2) view files that are being transferred. 19991005 Auto_FTP v0.02 Advisory PAM configuration file for rlogin in Red Hat Linux 6.1 and earlier includes a less restrictive rule before a more restrictive one, which allows users to access the host via rlogin even if rlogin has been explicitly disabled using the /etc/nologin file. 19991007 Problems with redhat 6 Xsession and pam.d/rlogin. Xsession in Red Hat Linux 6.1 and earlier can allow local users with restricted accounts to bypass execution of the .xsession file by starting kde, gnome or anotherlevel from kdm. 19991007 Problems with redhat 6 Xsession and pam.d/rlogin. Linuxconf on Red Hat Linux 6.0 and earlier does not properly disable PAM-based access to the shutdown command, which could allow local users to cause a denial of service. 19990630 linuxconf doesn't seem to deal correctly with /etc/pam.d/reboot NFS daemon (nfsd.exe) for Omni-NFS/X 6.1 allows remote attackers to cause a denial of service (resource exhaustion) via certain packets, possibly with the Urgent (URG) flag set, to port 111. 19991006 Omni-NFS/X Enterprise (nfsd.exe) DOS ARCAD Systemhaus 0.078-5 installs critical programs and files with world-writeable permissions, which could allow local users to gain privileges by replacing a program with a Trojan horse. 19990929 Multiple Vendor ARCAD permission problems Directory traversal vulnerability in KVIrc IRC client 0.9.0 with the "Listen to !nick <soundname> requests" option enabled allows remote attackers to read arbitrary files via a .. (dot dot) in a DCC GET request. 19990924 Kvirc bug kvirc-dot-directory-traversal(7761) mknod in Linux 2.2 follows symbolic links, which could allow local users to overwrite files or gain privileges. 19990928 Re: [Fwd: Truth about ssh 1.2.27 vulnerabiltiy] Nosque MsgCore 2.14 stores passwords in cleartext: (1) the administrator password in the AdmPasswd registry key, and (2) user passwords in the Userbase.dbf data file, which could allow local users to gain privileges. 19990907 MsgCore mailserver stores passwords in clear text E-mail client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files (1) home.fc for version 5.506, (2) network.fc for version 3.5, or (3) FCCLIENT.LOG when logging is enabled. 19990830 SoftArc's FirstClass E-mail Client 19990909 SoftArc's FirstClass E-mail Client BMC Patrol component, when installed with Compaq Insight Management Agent 4.23 and earlier, or Management Agents for Servers 4.40 and earlier, creates a PFCUser account with a default password and potentially dangerous privileges. 19990817 Compaq PFCUser account 19990905 Case ID SSRT0620 - PFCUser account communication 19990915 (I) UPDATE - PFCUser Account, 19991105 UPDATE: SSRT0620 Compaq Foundation Agents v4.40B PFCUser issues http://www.compaq.com/products/servers/management/advisory.html management-pfcuser(3231) Compaq Integration Maintenance Utility as used in Compaq Insight Manager agent before SmartStart 4.50 modifies the legal notice caption (LegalNoticeCaption) and text (LegalNoticeText) in Windows NT, which could produce a legal notice that is in violation of the security policy. 19990902 Compaq CIM UG Overwrites Legal Notice 19990902 Compaq CIM UG Overwrites Legal Notice 19990917 Re: Compaq CIM UG Overwrites Legal Notice compaq-smartstart-legal-notice(7763) Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a "<" sign, and the 0x9b character to a ">" sign, which could allow remote attackers to attack other clients via cross-site scripting (CSS) in CGI programs that do not filter these characters. 19991005 Time to update those CGIs again When an administrator in Windows NT or Windows 2000 changes a user policy, the policy is not properly updated if the local ntconfig.pol is not writable by the user, which could allow local users to bypass restrictions that would otherwise be enforced by the policy, possibly by changing the policy file to be read-only. Q157673 nt-user-policy-update(7400) When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies. Q163875 nt-group-policy-longname(7401) Windows NT 4.0 allows local users to cause a denial of service via a user mode application that closes a handle that was opened in kernel mode, which causes a crash when the kernel attempts to close the handle. Q160650 nt-kernel-handle-dos(7402) Windows NT 3.51 and 4.0 running WINS (Windows Internet Name Service) allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed packets, which causes the server to slow down and fill the event logs with error messages. 19980509 coke.c Win32k.sys in Windows NT 4.0 before SP2 allows local users to cause a denial of service (crash) by calling certain WIN32K functions with incorrect parameters. Q160601 nt-win32k-dos(7403) Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on a file, which exhausts the NonPagedPool. Q163143 nt-nonpagedpool-dos(7405) Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions (1) GetThreadContext or (2) SetThreadContext. Q142653 nt-threadcontext-dos(7421) Windows NT searches a user's home directory (%systemroot% by default) before other directories to find critical programs such as NDDEAGNT.EXE, EXPLORER.EXE, USERINIT.EXE or TASKMGR.EXE, which could allow local users to bypass access restrictions or gain privileges by placing a Trojan horse program into the root directory, which is writable by default. 19990628 NT runs Explorer.exe, Taskmgr.exe etc. from wrong location 19990630 Update: NT runs explorer.exe, etc... 515 nt-login-default-folder(2336) Pegasus e-mail client 3.0 and earlier uses weak encryption to store POP3 passwords in the pmail.ini file, which allows local users to easily decrypt the passwords and read e-mail. 19990515 Pegasus Mail weak encryption Internet Explorer 5.0 does not properly reset the username/password cache for Web sites that do not use standard cache controls, which could allow users on the same system to access restricted web sites that were visited by other users. http://www.pcworld.com/news/article/0,aid,10842,00.asp AV Option for MS Exchange Server option for InoculateIT 4.53, and possibly other versions, only scans the Inbox folder tree of a Microsoft Exchange server, which could allow viruses to escape detection if a user's rules cause the message to be moved to a different mailbox. 19990512 InoculateIT 4.53 Real-Time Exchange Scanner Flawed 20001116 InoculateIT AV Option for MS Exchange Server Real Media RealServer (rmserver) 6.0.3.353 stores a password in plaintext in the world-readable rmserver.cfg file, which allows local users to gain privileges. 19990414 Real Media Server stores passwords in plain text The setup wizard (ie5setup.exe) for Internet Explorer 5.0 disables (1) the screen saver, which could leave the system open to users with physical access if a failure occurs during an unattended installation, and (2) the Task Scheduler Service, which might prevent the scheduled execution of security-critical programs. 19990323 MSIE 5 installer disables screen saver Buffer overflow in /usr/bin/write in Solaris 2.6 and 7 allows local users to gain privileges via a long string in the terminal name argument. 19990308 Solaris "/usr/bin/write" bug http://www.securiteam.com/exploits/5ZP0O1P35O.html solaris-write-bo(7546) Triactive Remote Manager with Basic authentication enabled stores the username and password in cleartext in registry keys, which could allow local users to gain privileges. 19990219 Plaintext Password in Tractive's Remote Manager Software FORE PowerHub before 5.0.1 allows remote attackers to cause a denial of service (hang) via a TCP SYN scan with TCP/IP OS fingerprinting, e.g. via nmap. 19990105 Re: Network Scan Vulnerability [SUMMARY] perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that information via an HTTP request. 19990427 Re: Shopping Carts exposing CC data FileSystemObject (FSO) in the showfile.asp Active Server Page (ASP) allows remote attackers to read arbitrary files by specifying the name in the file parameter. 19990211 Using FSO in ASP to view just about anything 230 Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands. 19990114 MS IIS 4.0 Security Advisory 19990114 MS IIS 4.0 Security Advisory Matt Wright's download.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter. http://pulhas.org/phrack/55/P55-07.html dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files. 19990917 improper chroot in dbmlparser.exe DNS allows remote attackers to use DNS name servers as traffic amplifiers via a UDP DNS query with a spoofed source address, which produces more traffic to the victim than was sent by the attacker. AL-1999.004 J-063 19990730 Possible Denial Of Service using DNS 19990810 Possible Denial Of Service using DNS dns-udp-query-dos(7238) Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as safe for scripting, which allows remote attackers to execute arbitrary commands via the run option through malicious web pages that are accessed by browsers such as Internet Explorer 3.0. http://mlarchive.ima.com/win95/1997/May/0342.html http://news.zdnet.co.uk/story/0,,s2065518,00.html nu-tuneocx-activex-control(7188) http://www.net-security.sk/bugs/NT/nu20.html Buffer overflow in dbadmin CGI program 1.0.1 on Linux allows remote attackers to execute arbitrary commands. 19981008 buffer overflow in dbadmin NetWare NFS mode 1 and 2 implements the "Read Only" flag in Unix by changing the ownership of a file to root, which allows local users to gain root privileges by creating a setuid program and setting it to "Read Only," which NetWare-NFS changes to a setuid root program. 19980108 NetWare NFS 19980812 Re: Netware NFS (fwd) http://support.novell.com/cgi-bin/search/tidfinder.cgi?2940551 netware-nfs-file-ownership(7246) (1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters (` back-tick), which can cause the commands enclosed in the directory name to be executed when the shell expands filenames using the \w option in the PS1 variable. 19960913 tee see shell problems 19960919 Vulnerability in expansion of PS1 in bash & tcsh Indigo Magic System Tour in the SGI system tour package (systour) for IRIX 5.x through 6.3 allows local users to gain root privileges via a Trojan horse .exitops program, which is called by the inst command that is executed by the RemoveSystemTour program. AA-96.08 19961101-01-I 19961030 (Another) vulnerability in new SGIs irix-systour(7456) 470 Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable. FreeBSD-SA-96:20 19961219 Exploit for ppp bug (FreeBSD 2.1.0). ppp-bo(7465) Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file. 19980308 another /tmp race: `perl -e' opens temp file not safely perl-e-tmp-symlink(7243) http://www.redhat.com/support/errata/rh50-errata-general.html#perl Windows NT 4.0 SP2 allows remote attackers to cause a denial of service (crash), possibly via malformed inputs or packets, such as those generated by a Linux smbmount command that was compiled on the Linux 2.0.29 kernel but executed on Linux 2.0.25. 19970402 Fatal bug in NT 4.0 server 19970403 Fatal bug in NT 4.0 server (more comments) 19970407 DUMP of NT system crash passwd in SunOS 4.1.x allows local users to overwrite arbitrary files via a symlink attack and the -F command line argument. 19941218 Sun Patch Id #102060-01 19940513 [8lgm]-Advisory-7.UNIX.passwd.11-May-1994 19940514 [8lgm]-Advisory-7.UNIX.passwd.11-May-1994.NEWFIX US Robotics/3Com Total Control Chassis with Frame Relay between 3.6.22 and 3.7.24 does not properly enforce access filters when the "set host prompt" setting is made for a port, which allows attackers to bypass restrictions by providing the hostname twice at the "host: " prompt. 19980511 3Com/USR Total Control Chassis dialup port access filters 99 suidexec in suidmanager 0.18 on Debian 2.0 allows local users to gain root privileges by specifying a malicious program on the command line. 19980428 [Debian 2.0] /usr/bin/suidexec gives root access 94 Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions. B-01 CA-1990-06 nextstep-npd-root-access(7143) 10 Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges. B-01 CA-1990-06 nextstep-restore09-root-access(7144) 9 Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an emergency startup disk and using a disk editor to modify the on/off toggle or password in the aaaaaaaAPWD file, which is normally inaccessible. http://freaky.staticusers.net/macsec/data/powerbooksecurity-data.html 532 BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for files by unmounting the file system and using a file system editor such as fsdb to directly modify the file through a device. 19990702 BSD-fileflags 510 Vulnerability in Monitor utility (SYS$SHARE:SPISHR.EXE) in VMS 5.0 through 5.4-2 allows local users to gain privileges. CA-1992-18 CA-92.16 vms-monitor-gain-privileges(7136) 51 Vulnerability in integer multiplication emulation code on SPARC architectures for SunOS 4.1 through 4.1.2 allows local users to gain root access or cause a denial of service (crash). CA-1992-15 sun-integer-multiplication-access(7150) 49 Index Server 2.0 on IIS 4.0 stores physical path information in the ContentIndex\Catalogs subkey of the AllowedPaths registry key, whose permissions allows local and remote users to obtain the physical paths of directories that are being indexed. 19990323 Index Server 2.0 and the Registry 19990323 Index Server 2.0 and the Registry iis-indexserver-reveal-path(7559) 476 Vulnerability in xfsdump in SGI IRIX may allow local users to obtain root privileges via the bck.log log file, possibly via a symlink attack. 19970507 Irix: misc http://www.insecure.org/sploits/irix.xfsdump.html 472 spaceball program in SpaceWare 7.3 v1.0 in IRIX 6.2 allows local users to gain root privileges by setting the HOSTNAME environmental variable to contain the commands to be executed. 19970820 SpaceWare 7.3 v1.0 471 The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and read files by running Internet Explorer while the screen is still locked. 19990603 Huge Exploit in NT 4.0 SP5 Screensaver with Password Protection Enabled 19990603 Re: Huge Exploit in NT 4.0 SP5 Screensaver with Password Protecti on Enabled. 19990604 Official response from The Economist re: 1999 Screen Saver 466 Vulnerability in Desktop searchbook program in IRIX 5.0.x through 6.2 sets insecure permissions for certain user files (iconbook and searchbook). 19961201-01-PX irix-searchbook-permissions(7575) 463 The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket. 19970517 UNIX domain socket (Solarisx86 2.5) 19971003 Solaris 2.6 and sockets sun-domain-socket-permissions(7172) 456 IBM/Tivoli OPC Tracker Agent version 2 release 1 creates files, directories, and IPC message queues with insecure permissions (world-readable and world-writable), which could allow local users to disrupt operations and possibly gain privileges by modifying or deleting files. 19981002 Several potential security problems in IBM/Tivoli OPC Tracker Age nt 382 IBM/Tivoli OPC Tracker Agent version 2 release 1 allows remote attackers to cause a denial of service (resource exhaustion) via malformed data to the localtracker client port (5011), which prevents the connection from being closed properly. 19981002 Several potential security problems in IBM/Tivoli OPC Tracker Age nt 382 snap command in AIX before 4.3.2 creates the /tmp/ibmsupt directory with world-readable permissions and does not remove or clear the directory when snap -a is executed, which could allow local users to access the shadowed password file by creating /tmp/ibmsupt/general/passwd before root runs snap -a. Fixed in AIX 4.3 and 4.3.2 AIX 4.3.x APAR: IX88263 AIX 4.2.x APAR: IX88261 19990217 snap utility for AIX. 19990220 Re: snap utility for AIX. 375 dumpreg in Red Hat Linux 5.1 opens /dev/mem with O_RDWR access, which allows local users to cause a denial of service (crash) by redirecting fd 1 (stdout) to the kernel. 19980729 Crash a redhat 5.1 linux box 19980730 FD's 0..2 and suid/sgid procs (Was: Crash a redhat 5.1 linux box) 372 ifdhcpc-done script for configuring DHCP on Red Hat Linux 5 allows local users to append text to arbitrary files via a symlink attack on the dhcplog file. 19980309 *sigh* another RH5 /tmp problem initscripts-ifdhcpdone-dhcplog-symlink(7294) http://www.redhat.com/support/errata/rh50-errata-general.html#initscripts 368 Vulnerability in AIX 4.1.4 and HP-UX 10.01 and 9.05 allows local users to cause a denial of service (crash) by using a socket to connect to a port on the localhost, calling shutdown to clear the socket, then using the same socket to connect to a different port on localhost. 19970305 Bug in connect() for aix 4.1.4 ? 352 The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail. NetBSD-SA1998-004 19980805 irix-6.2 "at -f" vulnerability at-f-read-files(7577) 331 19980703 more about 'at' addnetpr in IRIX 5.3 and 6.2 allows local users to overwrite arbitrary files and possibly gain root privileges via a symlink attack on the printers temporary file. ftp://patches.sgi.com/support/free/security/advisories/19961203-02-PX 19970509 Re: Irix: misc 330 The installation of the fsp package 2.71-10 in Debian GNU/Linux 2.0 adds the anonymous FTP user without notifying the administrator, which could automatically enable anonymous FTP on some servers such as wu-ftp. 19981126 new version of fsp fixes security flaw 19981128 Debian: Security flaw in FSP 19981130 Debian: Security flaw in FSP 19990217 Debian GNU/Linux 2.0r5 released (fwd) fsp-anon-ftp-access(7574) 316 A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes. 19990603 MacOS X system panic with CGI 306 Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg. 19960803 Exploiting Zolaris 2.4 ?? :) 296 IBM Netfinity Remote Control allows local users to gain administrator privileges by starting programs from the process manager, which runs with system level privileges. 19990525 Security Leak with IBM Netfinity Remote Control Software 19990609 IBM's response to "Security Leak with IBM Netfinity Remote Control Software 284 Vulnerability in /usr/bin/mail in DEC ULTRIX before 4.2 allows local users to gain privileges. CA-91.13 27 AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large content-length. 19980823 Solaris ab2 web server is junk 253 Format string vulnerability in AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via encoded % characters in an HTTP request, which is improperly logged. 19980823 Solaris ab2 web server is junk 253 ICQ99 ICQ web server build 1701 with "Active Homepage" enabled generates allows remote attackers to determine the existence of files on the server by comparing server responses when a file exists ("404 Forbidden") versus when a file does not exist ("404 not found"). 19990501 Update: security hole in the ICQ-Webserver 246 Buffer overflow in nss_nisplus.so.1 library in NIS+ in Solaris 2.3 and 2.4 allows local users to gain root privileges. 00148 sun-nisplus-bo(7535) 219 NBase switches NH2012, NH2012R, NH2015, and NH2048 have a back door password that cannot be disabled, which allows remote attackers to modify the switch's configuration. 19980720 N-Base Vulnerability Advisory 19980722 N-Base Vulnerability Advisory Followup 212 NBase switches NH208 and NH215 run a TFTP server which allows remote attackers to send software updates to modify the switch or cause a denial of service (crash) by guessing the target filenames, which have default names. 19980720 N-Base Vulnerability Advisory 19980722 N-Base Vulnerability Advisory Followup 212 The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users. 19990102 PATH variable in zip-slackware 2.0.35 ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface, e.g. via ping -i. 19970626 Solaris Ping bug (DoS) 19970627 SUMMARY: Solaris Ping bug (DoS) 19971005 Solaris Ping Bug and other [bc] oddities 19970627 Solaris Ping bug(inetsvc) 00146 ping-multicast-loopback-dos(7492) 209 Solaris Solstice AdminSuite (AdminSuite) 2.1 uses unsafe permissions when adding new users to the NIS+ password table, which allows local users to gain root access by modifying their password table entries. 00145 208 Solaris Solstice AdminSuite (AdminSuite) 2.1 incorrectly sets write permissions on source files for NIS maps, which could allow local users to gain privileges by modifying /etc/passwd. 00145 208 Solaris Solstice AdminSuite (AdminSuite) 2.1 follows symbolic links when updating an NIS database, which allows local users to overwrite arbitrary files. 00145 208 Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 create lock files insecurely, which allows local users to gain root privileges. 00145 208 Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges. 00145 208 DIT TransferPro installs devices with world-readable and world-writable permissions, which could allow local users to damage disks through the ff device driver. 19980105 Security flaw in either DIT TransferPro or Solaris 204 PIM software for Royal daVinci does not properly password-protext access to data stored in the .mdb (Microsoft Access) file, which allows local users to read the data without a password by directly accessing the files with a different application, such as Access. 19990102 security problem with Royal daVinci 185 ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe. 19990107 WinNT, ZAK and Office 97 19990109 WinNT, ZAK and Office 97 181 Power management (Powermanagement) on Solaris 2.4 through 2.6 does not start the xlock process until after the sys-suspend has completed, which allows an attacker with physical access to input characters to the last active application from the keyboard for a short period after the system is restoring, which could lead to increased privileges. 19980716 Security risk with powermanagemnet on Solaris 2.6 160 HP JetAdmin D.01.09 on Solaris allows local users to change the permissions of arbitrary files via a symlink attack on the /tmp/jetadmin.log file. 19980715 JetAdmin software 19980722 Re: JetAdmin software 157 login in Slackware Linux 3.2 through 3.5 does not properly check for an error when the /etc/group file is missing, which prevents it from dropping privileges, causing it to assign root privileges to any local user who logs on to the server. 19980713 Slackware Shadow Insecurity 155 Buffer overflow in libsocks5 library of Socks 5 (socks5) 1.0r5 allows local users to gain privileges via long environmental variables. 19980710 socks5 1.0r5 buffer overflow.. 154 Ray Chan WWW Authorization Gateway 0.1 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "user" parameter. 19980708 WWW Authorization Gateway 152 ePerl 2.2.12 allows remote attackers to read arbitrary files and possibly execute certain commands by specifying a full pathname of the target file as an argument to bar.phtml. 19980707 ePerl: bad handling of ISINDEX queries 19980710 ePerl Security Update Available 151 Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command line arguments. 00105 CA-1991-01 15 gcc 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary .i, .s, or .o files. 19980102 Symlink bug with GCC 2.7.2 19980115 GCC 2.7.? /tmp files 19980108 GCC Exploit 146 Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is safe to open from the client. 19990101 Win32 ICQ 98a flaw 132 Linux 2.0.34 does not properly prevent users from sending SIGIO signals to arbitrary processes, which allows local users to cause a denial of service by sending SIGIO to processes that do not catch it. 19980630 Serious Linux 2.0.34 security problem 111 Bug in AMD K6 processor on Linux 2.0.x and 2.1.x kernels allows local users to cause a denial of service (crash) via a particular sequence of instructions, possibly related to accessing addresses outside of segments. http://uwsg.iu.edu/hypermail/linux/kernel/9805.3/0855.html http://www.cs.helsinki.fi/linux/linux-kernel/Year-1998/1998-25/0816.html 105 Micah Software Full Armor Network Configurator and Zero Administration allow local users with physical access to bypass the desktop protection by (1) using <CTRL><ALT><DEL> and kill the process using the task manager, (2) booting the system from a separate disk, or (3) interrupting certain processes that execute while the system is booting. 19980609 Full Armor 19980602 Full Armor.... Fool Proof etc... bugs 103 genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext. http://catless.ncl.ac.uk/Risks/20.41.html#subj4 Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords. 19980202 imapd/ipop3d coredump in slackware 3.4 Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and History folders, which are not cleared when the user selects the "Clear History" option, and are not visible when the user browses the folders because of tailored displays. 19970805 Re: Strange behavior regarding directory 19970806 Re: Strange behavior regarding directory Internet Explorer 4.0 allows remote attackers to cause a denial of service (crash) via HTML code that contains a long CLASSID parameter in an OBJECT tag. 19980728 Object tag crashes Internet Explorer 4.0 19980730 Re: Object tag crashes Internet Explorer 4.0 Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as (1) dates before 1970, which cause a Divide By Zero error, or (2) dates that are 100 years after the current date, which causes a segmentation fault. 19980729 Eudora exploit (was Microsoft Security Bulletin (MS98-008)) SunOS 4.1.4 on a Sparc 20 machine allows local users to cause a denial of service (kernel panic) by reading from the /dev/tcx0 TCX device. 19970519 /dev/tcx0 crashes SunOS 4.1.4 on Sparc 20's http://www.insecure.org/sploits/sunos.dev.tcx0.write.wierd.shit.to.device.bug.html Vulnerability in (1) rlogin daemon rshd and (2) scheme on SCO UNIX OpenServer 5.0.5 and earlier, and SCO UnixWare 7.0.1 and earlier, allows remote attackers to gain privileges. SB-99.03b SB-99.06b SSE020 The Winmsdp.exe sample file in IIS 4.0 and Site Server 3.0 allows remote attackers to read arbitrary files. Q231368 MS99-013 iis-samples-winmsdp(3271) GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting (CTRL-V) the contents into the username prompt. 19990129 ole objects in a "secured" environment? 19990129 ole objects in a "secured" environment? 19990205 Alert: MS releases GINA-fix for SP3, SP4, and TS Q214802 198 nt-gina-clipboard(1975) Internet Explorer 4 allows remote attackers (malicious web site operators) to read the contents of the clipboard via the Internet WebBrowser ActiveX object. 19990222 New IE4 vulnerability : the clipboard again. 215 Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to the machine to bypass the password prompt by pressing the ESC (Escape) key. 19991004 Weakness In "The Matrix" Screensaver For Windows RSH service utility RSHSVC in Windows NT 3.5 through 4.0 does not properly restrict access as specified in the .Rhosts file when a user comes from an authorized host, which could allow unauthorized users to access the service by logging in from an authorized host. Q158320 nt-rshsvc-ale-bypass(7422) thttpd HTTP server 2.03 and earlier allows remote attackers to read arbitrary files via a GET request with more than one leading / (slash) character in the filename. http://www.acme.com/software/thttpd/thttpd.html#releasenotes 19980819 thttpd 2.04 released (fwd) thttpd-file-read(1809) Buffer overflow in thttpd HTTP server before 2.04-31 allows remote attackers to execute arbitrary commands via a long date string, which is not properly handled by the tdate_parse function. 19991116 thttpd Buffer overflow in at program in Digital UNIX 4.0 allows local users to gain root privileges via a long command line argument. SSRT0583U 19990125 Digital Unix 4.0 exploitable buffer overflows du-at(3138) BMC PATROL Agent before 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file. 534 19981102 BMC PATROL File Creation Vulnerability bmc-patrol-file-create(1388) BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program. 19990713 Root Perms Gained with Patrol SNMP Agent 3.2 (all others?) 19990801 Re: Root Perms Gained with Patrol SNMP Agent 3.2 (all others?) 525 inpview in InPerson on IRIX 5.3 through IRIX 6.5.10 trusts the PATH environmental variable to find and execute the ttsession program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse ttsession program. 20001101-01-I 19970507 Irix: misc 381 Vulnerability in bb-hist.sh CGI History module in Big Brother 1.09b and 1.09c allows remote attackers to read portions of arbitrary files. 19990426 FW: Security Notice: Big Brother 1.09b/c 142 http-cgi-bigbrother-bbhist(3755) Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment, which the TCP/IP stack incorrectly reassembles into a valid session. 19970710 A New Fragmentation Attack nt-frag(528) Vulnerability in Cisco IOS 11.1CC and 11.1CT with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled interface to an interface that does not have DFS enabled, as described by Cisco bug CSCdk35564. J-016 19981105 Cisco IOS DFS Access List Leakage cisco-acl-leakage(1401) Vulnerability in Cisco IOS 11.1 through 11.3 with distributed fast switching (DFS) enabled allows remote attackers to bypass certain access control lists when the router switches traffic from a DFS-enabled input interface to an output interface with a logical subinterface, as described by Cisco bug CSCdk43862. J-016 19981105 Cisco IOS DFS Access List Leakage cisco-acl-leakage(1401) Vulnerability in Cisco routers versions 8.2 through 9.1 allows remote attackers to bypass access control lists when extended IP access lists are used on certain interfaces, the IP route cache is enabled, and the access list uses the "established" keyword. CA-1992-20 53 Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user. CA-1989-07 5 sun-rcp(3165) rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable. http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-01.html CA-91.20 rdist-popen-gain-privileges(7160) 31 Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) a long User-Agent MIME header. 19990930 mini-sql Buffer Overflow Eastman Work Management 3.21 stores passwords in cleartext in the COMMON and LOCATOR registry keys, which could allow local users to gain privileges. 19990624 Eastman Software Work Management 3.21 485 eastman-cleartext-passwords(2303) Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field. CA-1989-01 bsd-passwd-bo(7152) 4 Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker, aka the Freiburg text-viewing issue. 19971017 Security Hole in Explorer 4.0 Q176697 Q176794 http://www.insecure.org/sploits/Internet_explorer_4.0.hack.html http://www.microsoft.com/Windows/ie/security/freiburg.asp http-ie-spy(587) When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka the "Page Redirect Issue." Q176697 ie-page-redirect(7426) PowerPoint 95 and 97 allows remote attackers to cause an application to be run automatically without prompting the user, possibly through the slide show, when the document is opened in browsers such as Internet Explorer. http://www.microsoft.com/windows/ie/security/powerpoint.asp nt-ppt-patch(179) ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command. 19991119 ProFTPd - mod_sqlpw.c 812 A bug in Intel Pentium processor (MMX and Overdrive) allows local users to cause a denial of service (hang) in Intel-based operating systems such as Windows NT and Windows 95, via an invalid instruction, aka the "Invalid Operand with Locked CMPXCHG8B Instruction" problem. Q163852 pentium-crash(704) Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in programs such as nethack. 19990923 Linux GNOME exploit 663 gnome-espeaker-local-bo(3349) The Sun HotSpot Performance Engine VM allows a remote attacker to cause a denial of service on any server running HotSpot via a URL that includes the [ character. 19990706 Bug in SUN's Hotspot VM 19990716 FW: (Review ID: 85125) Hotspot crashes bringing down webserver 522 sun-hotspot-vm(2348) The textcounter.pl by Matt Wright allows remote attackers to execute arbitrary commands via shell metacharacters. 19980624 textcounter.pl SECURITY HOLE 2265 http-cgi-textcounter(2052) (1) acledit and (2) aclput in AIX 4.3 allow local users to create or modify files via a symlink attack. 429 Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls via a newline in the user/password pair. 19991103 [squid]exploit for external authentication problem 741 http://www.squid-cache.org/Versions/v2/2.2/bugs/ squid-proxy-auth-access(3433) SVGAlib zgv 3.0-7 and earlier allows local users to gain root access via a privilege leak of the iopl(3) privileges to child processes. 19990219 Security hole: "zgv" Buffer overflow in zgv in svgalib 1.2.10 and earlier allows local users to execute arbitrary code via a long HOME environment variable. 19970619 svgalib/zgv Buffer overflow in MSN Setup BBS 4.71.0.10 ActiveX control (setupbbs.ocx) allows a remote attacker to execute arbitrary commands via the methods (1) vAddNewsServer or (2) bIsNewsServerConfigured. 19990924 Several ActiveX Buffer Overruns 668 msn-setup-bbs-activex-bo(3310) nsd in IRIX 6.5 through 6.5.2 exports a virtual filesystem on a UDP port, which allows remote attackers to view files and cause a possible denial of service by mounting the nsd virtual file system. 19990531 IRIX 6.5 nsd virtual filesystem vulnerability 412 sgi-nsd-view(2246) sgi-nsd-create(2247) sadc in IBM AIX 4.1 through 4.3, when called from programs such as timex that are setgid adm, allows local users to overwrite arbitrary files via a symlink attack. http://techsupport.services.ibm.com/aix/fixes/v4/os/bos.acct.4.3.1.0.info 408 IX75554 IX76330 IX76853 aix-sadc-timex(7675) Vulnerability in digest in AIX 4.3 allows printq users to gain root privileges by creating and/or modifing any file on the system. aix-digest(7477) 405 IX74599 sdrd daemon in IBM SP2 System Data Repository (SDR) allows remote attackers to read files without authentication. I-079A ibm-sdr-read-files(7217) 371 Buffer overflow in TestChip function in XFree86 SuperProbe in Slackware Linux 3.1 allows local users to gain root privileges via a long -nopr argument. 19970304 Linux SuperProbe exploit 364 xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable. 19980528 ALERT: Tiresome security hole in "xosview", RedHat5.1? 19980529 Re: Tiresome security hole in "xosview" (xosexp.c) linux-xosview-bo(8787) 362 abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via a path that points to a Trojan horse program. 19960202 abuse Red Hat 2.1 security hole 354 Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned files, leading to root privileges. 19980502-01-P3030 348 sgi-diskperf(2103) sgi-diskalign(2104) Vulnerability in crp in Hewlett Packard Apollo Domain OS SR10 through SR10.3 allows remote attackers to gain root privileges via insecure system calls, (1) pad_$dm_cmd and (2) pad_$def_pfk(). CA-1991-23 34 apollo-crp-root-access(7158) colorview in Silicon Graphics IRIX 5.1, 5.2, and 6.0 allows local attackers to read arbitrary files via the -text argument. 19950209-00-P 19940809 Re: IRIX 5.2 Security Advisory 336 19950307 sigh. another Irix 5.2 hole. sgi-colorview(2112) xtvscreen in SuSE Linux 6.0 allows local users to overwrite arbitrary files via a symlink attack on the pic000.pnm file. 19990218 xtvscreen and suse 6 325 xtvscreen-overwrite(1792) Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates a different error message when the file does not exist. 19990608 unneeded information in sudo 321 sudo-file-exists(2277) Ipswitch IMail 5.0 and 6.0 uses weak encryption to store passwords in registry keys, which allows local attackers to read passwords for e-mail accounts. 19991221 [w00giving '99 #11] IMail's password encryption scheme 880 Slackware Linux 3.4 pkgtool allows local attacker to read and write to arbitrary files via a symlink attack on the reply file. 82 named in ISC BIND 4.9 and 8.1 allows local users to destroy files via a symlink attack on (1) named_dump.db when root kills the process with a SIGINT, or (2) named.stats when SIGIOT is used. 19980410 BIND 4.9.7 named follows symlinks, clobbers anything 80 Internet Anywhere POP3 Mail Server 2.3.1 allows remote attackers to cause a denial of service (crash) via (1) LIST, (2) TOP, or (3) UIDL commands using letters as arguments. 19991001 Vulnerabilities in the Internet Anywhere Mail Server 733 (1) ipxchk and (2) ipxlink in SGI OS2 IRIX 6.3 does not properly clear the IFS environmental variable before executing system calls, which allows local users to execute arbitrary commands. 19980408 SGI O2 ipx security issue 70 71 Buffer overflows in Quake 1.9 client allows remote malicious servers to execute arbitrary commands via long (1) precache paths, (2) server name, (3) server address, or (4) argument to the map console command. 19980408 QuakeI client: serious holes. 68 69 Network Flight Recorder (NFR) 1.5 and 1.6 allows remote attackers to cause a denial of service in nfrd (crash) via a TCP packet with a null header and data field. 63 Stalker Internet Mail Server 1.6 allows a remote attacker to cause a denial of service (crash) via a long HELO command. 19980408 Re: AppleShare IP Mail Server 62 Buffer overflow in QuakeWorld 2.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary commands via a long initial connect packet. 19980407 QW vulnerability 60 Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin. CA-1990-01 6 Sun SunOS 4.1 through 4.1.3 allows local attackers to gain root access via insecure permissions on files and directories such as crash. CA-1993-03 59 sun-dir(521) Web server in Tektronix PhaserLink Printer 840.0 and earlier allows a remote attacker to gain administrator access by directly calling undocumented URLs such as ncl_items.html and ncl_subjects.html. 19991116 [Fwd: Printer Vulnerability: Tektronix PhaserLink Webserver gives Administrator Password] 806 Directory traversal vulnerability in Etype Eserv 2.50 web server allows a remote attacker to read any file in the file system via a .. (dot dot) in a URL. 19991104 Eserv 2.50 Web interface Server Directory Traversal Vulnerability 19991104 Eserv 2.50 Web interface Server Directory Traversal Vulnerability 773 Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands. 19990517 Vulnerabilities in BisonWare FTP Server 3.5 bisonware-command-bo(3234) Buffer overflows in Xtramail 1.11 allow attackers to cause a denial of service (crash) and possibly execute arbitrary commands via (1) a long PASS command in the POP3 service, (2) a long HELO command in the SMTP service, or (3) a long user name in the Control Service. 19991110 Multiples Remotes DoS Attacks in Artisoft XtraMail v1.11 Vulnerability 791 xtramail-pass-dos(3488) The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field. 19990716 AMaViS virus scanner for Linux - root exploit http://www.amavis.org/ChangeLog.txt 527 amavis-command-execute(2349) Management information base (MIB) for a 3Com SuperStack II hub running software version 2.10 contains an object identifier (.1.3.6.1.4.1.43.10.4.2) that is accessible by a read-only community string, but lists the entire table of community strings, which could allow attackers to conduct unauthorized activities. 19990830 One more 3Com SNMP vulnerability Buffer overflow in Celtech ExpressFS FTP server 2.x allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long USER command. 19990729 ExpressFS 2.x FTPServer remotely exploitable buffer overflow vulnerability 19990729 ExpressFS 2.x FTPServer remotely exploitable buffer overflow vulnerability 749 expressfs-command-bo(3401) A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses, which causes the gateway to continuously try to return the message every 10 seconds. 613 tfs-gateway-dos(3290) A buffer overflow in TenFour TFS Gateway SMTP mail server 3.2 allows an attacker to crash the mail server and possibly execute arbitrary code by offering more than 128 bytes in a MAIL FROM string. 19990902 [SECURITY] TenFour TFS SMTP 3.2 Buffer Overflow runtar in the Amanda backup system used in various UNIX operating systems executes tar with root privileges, which allows a user to overwrite or read arbitrary files by providing the target files to runtar. 19991101 Amanda multiple vendor local root compromises 750 Operating systems with shared memory implementations based on BSD 4.4 code allow a user to conduct a denial of service and bypass memory limits (e.g., as specified with rlimits) using mmap or shmget to allocate memory and cause page faults. 19990715 Shared memory DoS's 526 bsd-shared-memory-dos(2351) Gene6 G6 FTP Server 2.0 allows a remote attacker to cause a denial of service (resource exhaustion) via a long (1) user name or (2) password. 19991117 Remote D.o.S Attack in G6 FTP Server v2.0 (beta 4/5) Vulnerability 805 g6ftp-username-dos(3513) A configuration problem in the Ad Server Sample directory (AdSamples) in Microsoft Site Server 3.0 allows an attacker to obtain the SITE.CSC file, which exposes sensitive SQL database information. 19990511 [ALERT] Site Server 3.0 May Expose SQL IDs and PSWs 256 siteserver-site-csc(2270) Computalynx CMail 2.4 and CMail 2.3 SP2 SMTP servers are vulnerable to a buffer overflow attack in the MAIL FROM command that may allow a remote attacker to execute arbitrary code on the server. 19990912 Many kind of POP3/SMTP server softwares for Windows have buffer overflow bug 19990729 Vulnerability in CMail SMTP Server Version 2.4: Remotely exploitable buffer 633 cmail-command-bo(2240) Vulnerability in htmlparse.pike in Roxen Web Server 1.3.11 and earlier, possibly related to recursive parsing and referer tags in RXML. 19991007 Roxen security alert Buffer overflow in Sambar Web Server 4.2.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP GET request. 19991004 19991006 Re: Sample DOS against the Sambar HTTP-Server sambar-logging-bo(1672) FlowPoint DSL router firmware versions prior to 3.0.8 allows a remote attacker to exploit a password recovery feature from the network and conduct brute force password guessing, instead of limiting the feature to the serial console port. 19990807 Re: FlowPoint DSL router vulnerability Macromedia Shockwave before 6.0 allows a malicious webmaster to read a user's mail box and possibly access internal web servers via the GetNextText command on a Shockwave movie. 19970314 Shockwave Security Alert shockwave-internal-access(1585) shockwave-file-read-vuln(1586) http-ns-shockwave(460) Auto-update feature of Macromedia Shockwave 7 transmits a user's password and hard disk information back to Macromedia. 19990311 [Fwd: Shockwave 7 Security Hole] shockwave-updater(1931) Internal HTTP server in Sun Netbeans Java IDE in Netbeans Developer 3.0 Beta and Forte Community Edition 1.0 Beta does not properly restrict access to IP addresses as specified in its configuration, which allows arbitrary remote attackers to access the server. 19991123 NetBeans/ Forte' Java IDE HTTP vulnerability 816 ProSoft Netware Client 5.12 on Macintosh MacOS 9 does not automatically log a user out of the NDS tree when the user logs off the system, which allows other users of the same system access to the unprotected NDS session. 19991114 MacOS 9 and the MacOS Netware Client 794 A buffer overflow exists in the HELO command in Trend Micro Interscan VirusWall SMTP gateway 3.23/3.3 for NT, which may allow an attacker to execute arbitrary code. 19991107 Interscan VirusWall NT 3.23/3.3 buffer overflow 19991108 Patch for VirusWall 3.23. 19991108 Re: Interscan VirusWall NT 3.23/3.3 buffer overflow. 19991107 Interscan VirusWall NT 3.23/3.3 buffer overflow. 19991108 Patch for VirusWall 3.23. 20000417 New DOS on Interscan NT/3.32 787 viruswall-helo-bo(3465) cgiwrap as used on Cobalt RaQ 2.0 and RaQ 3i does not properly identify the user for running certain scripts, which allows a malicious site administrator to view or modify data located at another virtual site on the same system. 19991108 Security flaw in Cobalt RaQ2 cgiwrap 19991109 [Cobalt] Security Advisory - cgiwrap cobalt-cgiwrap-incorrect-permissions(7764) 777 Buffer overflow in IBM HomePagePrint 1.0.7 for Windows98J allows a malicious Web site to execute arbitrary code on a viewer's system via a long IMG_SRC HTML tag. 19991102 Some holes for Win/UNIX softwares ibm-homepageprint-bo(7767) 763 Netscape Messaging Server 3.54, 3.55, and 3.6 allows a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands. 19991029 message:Netscape Messaging Server RCPT TO vul. 748 Eicon Technology Diva LAN ISDN modem allows a remote attacker to cause a denial of service (hang) via a long password argument to the login.htm file in its HTTP service. 19990926 DoS Exploit in Eicon Diehl LAN ISDN Modem 665 diva-lan-isdn-dos(3317) Buffer overflow in (1) nlservd and (2) rnavc in Knox Software Arkeia backup product allows local users to obtain root access via a long HOME environmental variable. 19990923 Multiple vendor Knox Arkiea local root/remote DoS 661 Buffer overflow in AspUpload.dll in Persits Software AspUpload before 1.4.0.2 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long argument in the HTTP request. 19990720 Buffer overflow in AspUpload 1.4 19990818 AspUpload Buffer Overflow Fixed 592 http-aspupload-bo(3291) .sbstart startup script in AcuShop Salesbuilder is world writable, which allows local users to gain privileges by appending commands to the file. 19990730 World writable root owned script in SalesBuilder (RedHat 6.0) 560 IIS 3.x and 4.x does not distinguish between pages requiring encryption and those that do not, which allows remote attackers to cause a denial of service (resource exhaustion) via SSL requests to the HTTPS port for normally unencrypted files, which will cause IIS to perform extra work to send the files over SSL. 19990707 SSL and IIS. 521 ssl-iis-dos(2352) When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password. 19990114 MS IIS 4.0 Security Advisory 19990114 MS IIS 4.0 Security Advisory 189 Buffer overflow in FTP server in QPC Software's QVT/Term Plus versions 4.2d and 4.3 and QVT/Net 4.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long (1) user name or (2) password. 19991110 Remote DoS Attack in QVT/Term 'Plus' 4.2d FTP Server Vulnerability 19991110 Remote DoS Attack in QVT/Term 'Plus' 4.2d FTP Server Vulnerability 796 qvtterm-login-dos(3491) shell-lock in Cactus Software Shell Lock uses weak encryption (trivial encoding) which allows attackers to easily decrypt and obtain the source code. 19991005 Cactus Software's shell-lock 19991004 cactus-shell-lock-retrieve-shell-code(3356) shell-lock in Cactus Software Shell Lock allows local users to read or modify decoded shell files before they are executed, via a symlink attack on a temporary file. 19991005 Cactus Software's shell-lock 19991004 cactus-shell-lock-root-privs(3358) RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command. 19991004 RH6.0 local/remote command execution 19991006 Fwd: [Re: RH6.0 local/remote command execution] linux-rh-rpmmail(3353) MacOS uses weak encryption for passwords that are stored in the Users & Groups Data File. 19990710 MacOS system encryption algorithm 19990914 MacOS system encryption algorithm 3 519 Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a long NLST (ls) command. 19990124 Advisory: IIS FTP Exploit/DoS Attack Joe's Own Editor (joe) 2.8 sets the world-readable permission on its crash-save file, DEADJOE, which could allow local users to read files that were being edited by other users. 19990714 19990717 joe 2.8 makes world-readable DEADJOE netstation.navio-com.rte 1.1.0.1 configuration script for Navio NC on IBM AIX exports /tmp over NFS as world-readable and world-writable. 19990129 TROJAN: netstation.navio-comm.rte 1.1.0.1 navionc-config-script(1724) Oracle Web Listener 2.1 allows remote attackers to bypass access restrictions by replacing a character in the URL with its HTTP-encoded (hex) equivalent. 19991125 Oracle Web Listener 19991125 Oracle Web Listener 841 Cabletron SmartSwitch Router (SSR) 8000 firmware 2.x can only handle 200 ARP requests per second allowing a denial of service attack to succeed with a flood of ARP requests exceeding that limit. 19991124 Cabletron SmartSwitch Router 8000 Firmware v2.x 821 Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a "secure" hidden form value from a temporary file and craft a LYNXOPTIONS: URL that causes Lynx to modify the user's configuration file and execute commands. 19991116 lynx 2.8.x - 'special URLs' anti-spoofing protection is weak 804 bigconf.conf in F5 BIG/ip 2.1.2 and earlier allows remote attackers to read arbitrary files by specifying the target file in the "file" parameter. 19991108 BigIP - bigconf.cgi holes 19991109 Re: BigIP - bigconf.cgi holes 19991109 bigip-bigconf-view-files(7771) 778 Buffer overflow in Ipswitch IMail Service 5.0 allows an attacker to cause a denial of service (crash) and possibly execute arbitrary commands via a long URL. 19990302 Multiple IMail Vulnerabilites 505 imail-websvc-overflow(1898) dpsexec (DPS Server) when running under XDM in IBM AIX 3.2.5 and earlier does not properly check privileges, which allows local users to overwrite arbitrary files and gain privileges. 19940720 xnews and XDM 358 Buffer overflow in XCmail 0.99.6 with autoquote enabled allows remote attackers to execute arbitrary commands via a long subject line. The authors were notified of this problem and it was fixed in devel-release 0.99.7. 19990301 [0z0n3] XCmail remotely exploitable vulnerability 311 xcmail-reply-overflow(1859) /usr/sbin/Mail on SGI IRIX 3.3 and 3.3.1 does not properly set the group ID to the group ID of the user who started Mail, which allows local users to read the mail of other users. CA-1990-08 sgi-irix-reset(3164) 13 Cheyenne InocuLAN Anti-Virus Server in Inoculan 4.0 before Service Pack 2 creates an update directory with "EVERYONE FULL CONTROL" permissions, which allows local users to cause Inoculan's antivirus update feature to install a Trojan horse dll. 19980611 Cheyenne Inoculan vulnerability on NT 106 inoculan-bad-permissions(1536) Microsoft SQL Server 6.5 uses weak encryption for the password for the SQLExecutiveCmdExec account and stores it in an accessible portion of the registry, which could allow local users to gain privileges by reading and decrypting the CmdExecAccount value. 19980629 MS SQL Server 6.5 stores password in unprotected registry keys 109 mssql-sqlexecutivecmdexec-password(7354) Buffer overflow in the login functions in IMAP server (imapd) in Ipswitch IMail 5.0 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long user name or (2) a long password. 19990301 Multiple IMail Vulnerabilites imail-imap-overflow(1895) Vulnerability in loginout in Digital OpenVMS 7.1 and earlier allows unauthorized access when external authentication is enabled. I-071A openvms-loginout-unauth-access(7151) 161 Xylan OmniSwitch before 3.2.6 allows remote attackers to bypass the login prompt via a CTRL-D (control d) character, which locks other users out of the switch because it only supports one session at a time. 19990331 Xylan OmniSwitch "features" xylan-omniswitch-login(2064) Vulnerability in a script in Texas A&M University (TAMU) Tiger allows local users to execute arbitrary commands as the Tiger user, usually root. 19990720 tiger vulnerability tiger-script-execute(2369) Nullsoft SHOUTcast server stores the administrative password in plaintext in a configuration file (sc_serv.conf), which could allow a local user to gain administrative privileges on the server. 19990820 Winamp SHOUTcast server: Gain Administrator Password gFTP FTP client 1.13, and other versions before 2.0.0, records a password in plaintext in (1) the log window, or (2) in a log file. DSA-084 19990905 gftp 3446 Nachuatec D435 and D445 printer allows remote attackers to cause a denial of service via ICMP redirect storm. 19991014 NEUROCOM: Nashuatec printer, 3 vulnerabilities found 19991116 NEUROCOM: Nashuatec D445/435 vulnerabilities updated FreeBSD 3.2 and possibly other versions allows a local user to cause a denial of service (panic) with a large number accesses of an NFS v3 mounted directory from a large number of processes. 19990902 [ Kernel panic with FreeBSD-3.2-19990830-STABLE ] Man2html 2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file. 19990820 [SECURITY] New versions of man2html fixes postinst glitch Buffer overflow in iParty server 1.2 and earlier allows remote attackers to cause a denial of service (crash) by connecting to default port 6004 and sending repeated extended characters. 19990508 iParty Daemon Vulnerability w/ Exploit Code (worse than thought?) Seapine Software TestTrack server allows a remote attacker to cause a denial of service (high CPU) via (1) TestTrackWeb.exe and (2) ttcgi.exe by connecting to port 99 and disconnecting without sending any data. testtrack-dos(1948) Off-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command. 19990223 NcFTPd remote buffer overflow 19990223 Comments on NcFTPd "theoretical root compromise" ncftpd-port-bo(1833) Quake 1 and NetQuake servers allow remote attackers to cause a denial of service (resource exhaustion or forced disconnection) via a flood of spoofed UDP connection packets, which exceeds the server's player limit. 19980502 NetQuake Protocol problem resulting in smurf like effect. 19981101 Quake problem? 20010716 Quake client and server denial-of-service 3051 quake-spoofed-client-dos(6871) Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter. CSSA-2002-SCO.17 20020509 Sar -o exploitation process info. 19990909 19 SCO 5.0.5+Skunware98 buffer overflows openserver-sar-bo(8989) 4089 Buffer overflow in sar for SCO OpenServer 5.0.0 through 5.0.5 may allow local users to gain root privileges via a long -f parameter, a different vulnerability than CVE-1999-1570. SB-99.17c ftp://stage.caldera.com/pub/security/sse/sse037c/sse037c.ltr 19990917 Re: recent SCO 5.0.x vulnerabilities 19991020 Re: recent SCO 5.0.x vulnerabilities 19991105 SCO Security Bulletin 99.17 20020509 Sar -o exploitation process info. http://online.securityfocus.com/advisories/1843 19990909 19 SCO 5.0.5+Skunware98 buffer overflows openserver-sar-bo(8989) 643 cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files. Fixed in rev 1.3 of cpio/main.c. 20050204 [USN-75-1] cpio vulnerability http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf DSA-664 http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391 MDKSA-2005:032 RHSA-2005:073 RHSA-2005:080 RHSA-2005:806 2005-0003 cpio-o-archive-insecure-permissions(19167) oval:org.mitre.oval:def:10888 Multiple unknown vulnerabilities in the "r-cmnds" (1) remshd, (2) rexecd, (3) rlogind, (4) rlogin, (5) remsh, (6) rcp, (7) rexec, and (8) rdist for HP-UX 10.00 through 11.00 allow attackers to gain privileges or access files. ESB-98.186 J-022 VU#13217 HPSBUX9812-090 hp-rcmnds-gain-privileges(7860) oval:org.mitre.oval:def:5550 Buffer overflow in the lex routines of nslookup for AIX 4.3 may allow attackers to cause a core dump and possibly execute arbitrary code via "long input strings." VU#182777 IX79909 aix-nslookup-lex-bo(7867) The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5) Image Admin (imgadmin.ocx), (6) HHOpen (hhopen.ocx), (7) Registration Wizard (regwizc.dll), and (8) IE Active Setup (setupctl.dll) ActiveX controls for Internet Explorer (IE) 4.01 and 5.0 are marked as "Safe for Scripting," which allows remote attackers to create and modify files and execute arbitrary commands. VU#23412 VU#24839 VU#26924 VU#41408 VU#9162 19990924 Several ActiveX Buffer Overruns MS99-037 wang-kodak-activex-control(7097) Buffer overflow in Adobe Acrobat ActiveX control (pdf.ocx, PDF.PdfCtrl.1) 1.3.188 for Acrobat Reader 4.0 allows remote attackers to execute arbitrary code via the pdf.setview method. VU#25919 19990924 Several ActiveX Buffer Overruns 666 adobe-acrobat-pdf-bo(3318) Buffer overflow in HHOpen ActiveX control (hhopen.ocx) 1.0.0.1 for Internet Explorer 4.01 and 5 allows remote attackers to execute arbitrary commands via long arguments to the OpenHelp method. VU#29795 19990924 Several ActiveX Buffer Overruns 669 ie-hhopen-bo(3314) Buffer overflow in Registration Wizard ActiveX control (regwizc.dll, InvokeRegWizard) 3.0.0.0 for Internet Explorer 4.01 and 5 allows remote attackers to execute arbitrary commands. VU#37556 19990924 Several ActiveX Buffer Overruns 671 ie-registration-wiz-bo(3311) The Cenroll ActiveX control (xenroll.dll) for Terminal Server Editions of Windows NT 4.0 and Windows NT Server 4.0 before SP6 allows remote attackers to cause a denial of service (resource consumption) by creating a large number of arbitrary files on the target machine. Q242366 VU#3062 6827 winnt-xenroll-dos(7107) SunOS sendmail 5.59 through 5.65 uses popen to process a forwarding host argument, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable and passing crafted values to the -oR option. http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-21.html AA-95.09 CA-1995-11 VU#3278 7829 Memory leak in Simple Network Management Protocol (SNMP) agent (snmp.exe) for Windows NT 4.0 before Service Pack 4 allows remote attackers to cause a denial of service (memory consumption) via a large number of SNMP packets with Object Identifiers (OIDs) that cannot be decoded. Q178381 VU#4923 winnt-snmp-oid-memory-leak(8231) By design, the "established" command on the Cisco PIX firewall allows connections from one host to arbitrary ports of a target host if an alternative conduit has already been allowed, which can cause administrators to configure less restrictive access controls than intended if they do not understand this functionality. 19980715 PIX Firewall "established" Command VU#6733 cisco-pix-established-bypass(8052) Buffer overflow in nslookup for AIX 4.3 allows local users to execute arbitrary code via a long hostname command line argument. VU#872443 IY02120 aix-nslookup-hostname-bo(8031) Unknown vulnerability in (1) loadmodule, and (2) modload if modload is installed with setuid/setgid privileges, in SunOS 4.1.1 through 4.1.3c, and Open Windows 3.0, allows local users to gain root privileges via environment variables, a different vulnerability than CVE-1999-1586. 00124 CA-93.18 The (1) rcS and (2) mountall programs in Sun Solaris 2.x, possibly before 2.4, start a privileged shell on the system console if fsck fails while the system is booting, which allows attackers with physical access to gain root privileges. 00124 loadmodule in SunOS 4.1.x, as used by xnews, does not properly sanitize its environment, which allows local users to gain privileges, a different vulnerability than CVE-1999-1584. CA-95.12 G-02 sun-loadmodule(498) /usr/ucb/ps in Sun Microsystems Solaris 8 and 9, and certain earlier releases, allows local users to view the environment variables and values of arbitrary processes via the -e option. 1015833 102215 19662 http://www.sunmanagers.org/archives/1996/1383.html ADV-2006-1123 solaris-ps-information-disclosure(25460) oval:org.mitre.oval:def:1470 Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766. http://lsd-pl.net/files/get?SOLARIS/solx86_nlps_server http://security-protocols.com/sploits/unsorted_exploits/nlps_server.c 2319 http://www.securityfocus.com/data/vulnerabilities/exploits/nlps_server.c Unspecified vulnerability in crontab in IBM AIX 3.2 allows local users to gain root privileges via unknown attack vectors. CA-1992-10 357 Directory traversal vulnerability in Muhammad A. Muquit wwwcount (Count.cgi) 2.3 allows remote attackers to read arbitrary GIF files via ".." sequences in the image parameter, a different vulnerability than CVE-1999-0021. 19971010 Security flaw in Count.cgi (wwwcount) Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as demonstrated by connecting via Microsoft Visual InterDev 6.0. 19990118 IIS4.0 and Visual Interdev 19990119 Re: IIS4.0 and Visual Interdev 190 Multiple unspecified vulnerabilities in sendmail 5, as installed on Sun SunOS 4.1.3_U1 and 4.1.4, have unspecified attack vectors and impact. NOTE: this might overlap CVE-1999-0129. 00159 243 Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may be limited when Windows 95/98 clients are used, or if the primary domain controller becomes unavailable. 19990302 NT Domain DoS and Security Exploit with SAMBA Server 20010117 Invalid WINS entries 20010117 Re: Invalid WINS entries 20010118 Re: Invalid WINS entries 20010117 Re: Invalid WINS entries 20010117 Re: Invalid WINS entries 20010118 Re: Invalid WINS entries 20010119 Re: Invalid WINS entries 2221 https://www2.sans.org/reading_room/whitepapers/win2k/185.php RealMedia server allows remote attackers to cause a denial of service via a long ramgen request. 888 Buffer overflow in ZBServer Pro 1.50 allows remote attackers to execute commands via a long GET request. 19991223 Local / Remote GET Buffer Overflow Vulnerability in ZBServer 1.5 Pro Edition for Win98/NT 19991223 Local / Remote GET Buffer Overflow Vulnerability in ZBServer 1.5 Pro Edition for Win98/NT 889 20000128 ZBServer 1.50-r1x exploit (WinNT) Buffer overflow in UnixWare rtpm program allows local users to gain privileges via a long environmental variable. 20000127 New SCO patches... ZBServer Pro allows remote attackers to read source code for executable files by inserting a . (dot) into the URL. 19991223 Re: Local / Remote GET Buffer Overflow Vulnerability in ZBServer 1.5 Pro Edition for Win98/NT 19991223 Local / Remote GET Buffer Overflow Vulnerability in ZBServer 1.5 Pro Edition for Win98/NT HP-UX aserver program allows local users to gain privileges via a symlink attack. oval:org.mitre.oval:def:5635 strace allows local users to read arbitrary files via memory mapped file names. 19991225 strace can lie linux-strace(4554) Trend Micro PC-Cillin does not restrict access to its internal proxy port, allowing remote attackers to conduct a denial of service. 1740 pccillin-proxy-remote-dos(4491) FTPPro allows local users to read sensitive information, which is stored in plain text. The bna_pass program in Optivity NETarchitect uses the PATH environmental variable for finding the "rm" program, which allows local users to execute arbitrary commands. 907 WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter. Buffer overflow in AnalogX SimpleServer:WWW HTTP server allows remote attackers to execute commands via a long GET request. http://www.analogx.com/contents/download/network/sswww.htm 906 Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands. 898 IRIX soundplayer program allows local users to gain privileges by including shell metacharacters in a .wav file, which is executed via the midikeys program. 909 Denial of service in Savant web server via a null character in the requested URL. 897 CascadeView TFTP server allows local users to gain privileges via a symlink attack. 910 Buffer overflow in Internet Anywhere POP3 Mail Server allows remote attackers to cause a denial of service or execute commands via a long username. 730 Buffer overflow in Linux linuxconf package allows remote attackers to gain root privileges via a long parameter. wmmon in FreeBSD allows local users to gain privileges via the .wmmonrc configuration file. 885 IMail POP3 daemon uses weak encryption, which allows local users to read files. DNS PRO allows remote attackers to conduct a denial of service via a large number of connections. Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin. 881 Lotus Domino HTTP server does not properly disable anonymous access for the cgi-bin directory. 881 Buffer overflow in Lotus Domino HTTP server allows remote attackers to cause a denial of service via a long URL. 881 IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Character Parsing" vulnerability. Q246401 http://www.acrossecurity.com/aspr/ASPR-1999-11-10-1-PUB.txt MS99-061 IIS 4.0 and Site Server 3.0 allow remote attackers to read source code for ASP files if the file is in a virtual directory whose name includes extensions such as .com, .exe, .sh, .cgi, or .dll, aka the "Virtual Directory Naming" vulnerability. Q238606 MS99-058 Buffer overflow in UnixWare i2odialogd daemon allows remote attackers to gain root access via a long username/password authorization string. 19991223 FYI, SCO Security patches available. 876 IBM Network Station Manager NetStation allows local users to gain privileges via a symlink attack. ibm-netstat-race-condition(5381) 19991227 IBM NetStation/UnixWare local root exploit 900 Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function. UnixWare pis and mkpis commands allow local users to gain privileges via a symlink attack. 20000113 Info on some security holes reported against SCO Unixware. 901 Solaris dmispd dmi_cmd allows local users to fill up restricted disk space by adding files to the /var/dmi/db database. 878 The initscripts package in Red Hat Linux allows local users to gain privileges via a symlink attack. Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database. 878 InterScan VirusWall SMTP scanner does not properly scan messages with malformed attachments. 899 Netscape 4.7 records user passwords in the preferences.js file during an IMAP or POP session, even if the user has not enabled "remember passwords." resend command in Majordomo allows local users to gain privileges via shell metacharacters. 20000113 Info on some security holes reported against SCO Unixware. 902 Outlook Express 5 for Macintosh downloads attachments to HTML mail without prompting the user, aka the "HTML Mail Attachment" vulnerability. Q249082 MS99-060 Majordomo wrapper allows local users to gain privileges by specifying an alternate configuration file. 20000113 Info on some security holes reported against SCO Unixware. RHSA-2000:005 903 glFtpD includes a default glftpd user account with a default password and a UID of 0. AltaVista search engine allows remote attackers to read files above the document root via a .. (dot dot) in the query.cgi CGI program. 896 glFtpD allows local users to gain privileges via metacharacters in the SITE ZIPCHK command. Macintosh systems generate large ICMP datagrams in response to malformed datagrams, allowing them to be used as amplifiers in a flood attack. 890 Buffer overflow in CSM mail server allows remote attackers to cause a denial of service or execute commands via a long HELO command. 895 Buffer overflow in CamShot WebCam HTTP server allows remote attackers to execute commands via a long GET request. 905 Macros in War FTP 1.70 and 1.67b2 allow local or remote attackers to read arbitrary files or execute commands. 919 MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege. 926 Buffer overflow in ICQ 99b 1.1.1.1 client allows remote attackers to execute commands via a malformed URL within an ICQ message. 929 Buffer overflow in Yahoo Pager/Messenger client allows remote attackers to cause a denial of service via a long URL within a message. get_it program in Corel Linux Update allows local users to gain root access by specifying an alternate PATH for the cp program. http://linux.corel.com/support/clos_patch1.htm 928 Buffer overflow in Winamp client allows remote attackers to execute commands via a long entry in a .pls file. 925 The Allaire Spectra Webtop allows authenticated users to access other Webtop sections by specifying explicit URLs. ASB00-01 915 The Allaire Spectra Configuration Wizard allows remote attackers to cause a denial of service by repeatedly resubmitting data collections for indexing via a URL. ASB00-02 916 Red Hat userhelper program in the usermode package allows local users to gain root access via PAM and a .. (dot dot) attack. 20000104 PamSlam RHSA-2000:001 913 linux-pam-userhelper Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service via a malformed IMAP request. Q246731 912 MS00-001 search.cgi in the SolutionScripts Home Free package allows remote attackers to view directories via a .. (dot dot) attack. 921 Buffer overflow in Solaris chkperm command allows local users to gain root access via a long -n option. 918 IMail IMONITOR status.cgi CGI script allows remote attackers to cause a denial of service with many calls to status.cgi. 914 Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information. ASB00-03 917 Network HotSync program in Handspring Visor does not have authentication, which allows remote attackers to retrieve email and files. 20000105 Handspring Visor Network HotSync Security Hole 920 PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands. 911 Buffer overflow in aVirt Rover POP3 server 1.1 allows remote attackers to cause a denial of service via a long user name. 19991227 Local / Remote Remote DoS Attack in Rover POP3 Server V1.1 NT From aVirt 19991227 Local / Remote Remote DoS Attack in Rover POP3 Server V1.1 NT From aVirt avirt-rover-pop3-dos(3765) 894 Internet Explorer 5 does not modify the security zone for a document that is being loaded into a window until after the document has been loaded, which could allow remote attackers to execute Javascript in a different security context while the document is loading. 923 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities. 922 20000104 [petrilli@digicool.com: [Zope] SECURITY ALERT] cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter to the script. 938 cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters. 938 Buffer overflow in InetServ 3.0 allows remote attackers to execute commands via a long GET request. WebSite Pro allows remote attackers to determine the real pathname of webdirectories via a malformed URL request. CyberCash Merchant Connection Kit (MCK) allows local users to modify files via a symlink attack. daynad program in Intel InBusiness E-mail Station does not require authentication, which allows remote attackers to modify its configuration, delete files, or read mail. 20000104 [rootshell] Security Bulletin #27 The recover program in Solstice Backup allows local users to restore sensitive files. NtImpersonateClientOfPort local procedure call in Windows NT 4.0 allows local users to gain privileges, aka "Spoofed LPC Port Request." Q247869 20000113 Local Promotion Vulnerability in Windows NT 4 934 nt-spoofed-lpc-port MS00-003 IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions. 20000111 IIS still revealing paths for web directories 20000113 SV: IIS still revealing paths for web directories Visual Casel (Vcasel) does not properly prevent users from executing files, which allows local users to use a relative pathname to specify an alternate file which has an approved name and possibly gain privileges. 20000118 Warning: VCasel security hole. vcasel-filename-trusting(3867) 937 Buffer overflow in Microsoft Rich Text Format (RTF) reader allows attackers to cause a denial of service via a malformed control word. Q249973 win-malformed-rtf-control-word MS00-005 PowerScripts PlusMail CGI program allows remote attackers to execute commands via a password file with improper permissions. Super Mail Transfer Package (SMTP), later called MsgCore, has a memory leak which allows remote attackers to cause a denial of service by repeating multiple HELO, MAIL FROM, RCPT TO, and DATA commands in the same session. 930 nviboot boot script in the Debian nvi package allows local users to delete files via malformed entries in vi.recover. 19991230 vibackup.sh 1439 The October 1998 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the ps and grep commands. oval:org.mitre.oval:def:5549 The June 1999 version of the HP-UX aserver program allows local users to gain privileges by specifying an alternate PATH which aserver uses to find the awk command. oval:org.mitre.oval:def:5728 The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of some commands via a request for a nonexistent URL. 936 AIX techlibss allows local users to overwrite files via a symlink attack. 20000110 2nd attempt: AIX techlibss follows links 931 Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: protocol, e.g. j&#x41;vascript. WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML. http://net4tv.com/voice/story.cfm?StoryID=1823 http://www.wired.com/news/technology/0,1282,33420,00.html HP asecure creates the Audio Security File audio.sec with insecure permissions, which allows local users to cause a denial of service or gain additional privileges. HPSBUX0001-109 CuteFTP uses weak encryption to store password information in its tree.dat file. Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag. Netopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing. 935 Netscape Mail Notification (nsnotify) utility in Netscape Communicator uses IMAP without SSL, even if the user has set a preference for Communicator to use an SSL connection, allowing a remote attacker to sniff usernames and passwords in plaintext. 20000113 Misleading sense of security in Netscape netscape-mail-notify-plaintext(4385) Buffer overflow in the conversion utilities for Japanese, Korean and Chinese Word 5 documents allows an attacker to execute commands, aka the "Malformed Conversion Data" vulnerability. 946 MS00-002 The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability. Q249108 947 MS00-004 VMWare 1.1.2 allows local users to cause a denial of service via a symlink attack. 943 Buffer overflow in vchkpw/vpopmail POP authentication package allows remote attackers to gain root privileges via a long username or password. http://www.inter7.com/vpopmail/ http://www.inter7.com/vpopmail/ChangeLog 942 The BSD make program allows local users to modify files via a symlink attack when the -j option is being used. FreeBSD-SA-00:01 939 An installation of Red Hat uses DES password encryption with crypt() for the initial password, instead of md5. procfs in BSD systems allows local users to gain root privileges by modifying the /proc/pid/mem interface via a modified file descriptor for stderr. NetBSD-SA2000-001 940 netbsd-procfs(3995) The PMTU discovery procedure used by HP-UX 10.30 and 11.00 for determining the optimum MTU generates large amounts of traffic in response to small packets, allowing remote attackers to cause the system to be used as a packet amplifier. 944 HPSBUX0001-110 Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command. 948 The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability. 950 MS00-006 Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist. MS00-006 Buffer overflow in UnixWare ppptalk command allows local users to gain privileges via a long prompt argument. 20000119 Unixware ppptalk The SMS Remote Control program is installed with insecure permissions, which allows local users to gain privileges by modifying or replacing the program. 20000115 Security Vulnerability with SMS 2.0 Remote Control MS00-012 The Make-a-Store OrderPage shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The SmartCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The Shoptron shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. Outlook Express 5.01 and Internet Explorer 5.01 allow remote attackers to view a user's email messages via a script that accesses a variable that references subsequent email messages that are read by the client. 962 The EasyCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. Linux apcd program allows local attackers to modify arbitrary files via a symlink attack. 20000201 958 The Intellivend shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The mcsp Client Site Processor system (MultiCSP) in Standard and Poor's ComStock is installed with several accounts that have no passwords or easily guessable default passwords. The WebSiteTool shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The RightFax web client uses predictable session numbers, which allows remote attackers to hijack user sessions. 953 The default installation of Debian GNU/Linux uses an insecure Master Boot Record (MBR) which allows a local user to boot from a floppy disk during the installation. 20000202 vulnerability in Linux Debian default boot configuration 960 The SyGate Remote Management program does not properly restrict access to its administration service, which allows remote attackers to cause a denial of service, or access network traffic statistics. 20000128 SyGate 3.11 Port 7323 / Remote Admin hole 20000202 SV: SyGate 3.11 Port 7323 / Remote Admin hole 20000203 UPDATE: Sygate 3.11 Port 7323 Telnet Hole 952 http://www.sybergen.com/support/fix.htm Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory. IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page. Firewall-1 does not properly filter script tags, which allows remote attackers to bypass the "Strip Script Tags" restriction by including an extra < in front of the SCRIPT tag. 954 The siteUserMod.cgi program in Cobalt RaQ2 servers allows any Site Administrator to modify passwords for other users, site administrators, and possibly admin (root). 951 The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing. 20000130 RedHat 6.1 /and others/ PAM The default configurations for McAfee Virus Scan and Norton Anti-Virus virus checkers do not check files in the RECYCLED folder that is used by the Windows Recycle Bin utility, which allows attackers to store malicious code without detection. 20000130 Bypass Virus Checking The Remote Access Service invoke.cfm template in Allaire Spectra 1.0 allows users to bypass authentication via the bAuthenticated parameter. 955 allaire-spectra-ras-access(4025) The Recycle Bin utility in Windows NT and Windows 2000 allows local users to read or modify files by creating a subdirectory with the victim's SID in the recycler directory, aka the "Recycle Bin Creation" vulnerability. Q248399 963 MS00-007 Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program. 20070603 CERN &#304;mage Map Dispatcher 964 frontpage-cern-information-disclosure(34719) The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields. surfCONTROL SuperScout does not properly asign a category to web sites with a . (dot) at the end, which may allow users to bypass web access restrictions. 965 wwwthreads does not properly cleanse numeric data or table names that are passed to SQL queries, which allows remote attackers to gain privileges for wwwthreads forums. 967 20000203 RFP2K01 - "How I hacked Packetstorm" (wwwthreads advisory) Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack. The Webspeed configuration program does not properly disable access to the WSMadmin utility, which allows remote attackers to gain privileges via wsisa.dll. http://www.progress.com/services/support/cgi-bin/techweb-kbase.cgi/webkb.html?kbid=19412&keywords=security%20Webspeed 969 The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters. http://www.glazed.org/finger/changelog.txt Buffer overflow in the SHGetPathFromIDList function of the Serv-U FTP server allows attackers to cause a denial of service by performing a LIST command on a malformed .lnk file. Buffer overflow in SCO scohelp program allows remote attackers to execute commands. SB-00.02a 20000127 New SCO patches... Buffer overflow in War FTPd 1.6x allows users to cause a denial of service via long MKD and CWD commands. 20000201 war-ftpd 1.6x DoS 966 Microsoft Java Virtual Machine allows remote attackers to read files via the getSystemResourceAsStream function. 957 Buffer overflows in Tiny FTPd 0.52 beta3 FTP server allows users to execute commands via the STOR, RNTO, MKD, XMKD, RMD, XRMD, APPE, SIZE, and RNFR commands. 961 The Check It Out shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The @Retail shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The Cart32 shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. The CartIt shopping cart application allows remote users to modify sensitive purchase information via hidden form fields. A system has a distributed denial of service (DDOS) attack master, agent, or zombie installed, such as (1) Trinoo, (2) Tribe Flood Network (TFN), (3) Tribe Flood Network 2000 (TFN2K), (4) stacheldraht, (5) mstream, or (6) shaft. 20000429 Source code to mstream, a DDoS tool 20000501 Re: Source code to mstream, a DDoS tool 20000502 "mstream" Distributed Denial of Service Tool Internet Anywhere POP3 Mail Server allows local users to cause a denial of service via a malformed RETR command. 20000210 remote DoS on Internet Anywhere Mail Server Ver.3.1.3 982 Internet Anywhere POP3 Mail Server allows remote attackers to cause a denial of service via a large number of connections. 20000210 remote DoS on Internet Anywhere Mail Server Ver.3.1.3 980 Infopop Ultimate Bulletin Board (UBB) allows remote attackers to execute commands via shell metacharacters in the topic hidden field. 991 20000225 FW: Important UBB News For Licensed Users 20000211 perl-cgi hole in UltimateBB by Infopop Corp. http://www.ultimatebb.com/home/versions.shtml The authentication protocol in Timbuktu Pro 2.0b650 allows remote attackers to cause a denial of service via connections to port 407 and 1417. The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP. Axis 700 Network Scanner does not properly restrict access to administrator URLs, which allows users to bypass the password protection via a .. (dot dot) attack. 20000207 Infosec.20000207.axis700.a 971 The libguile.so library file used by gnucash in Debian GNU/Linux is installed with world-writable permissions. The Java Server in the Novell GroupWise Web Access Enhancement Pack allows remote attackers to cause a denial of service via a long URL to the servlet. 20000207 Novell GroupWise 5.5 Enhancement Pack Web Access Denial of Servic e 972 snmpd in SCO OpenServer has an SNMP community string that is writable by default, which allows local attackers to modify the host's configuration. SB-00.04a 20000207 SNMPD default writable community string 973 MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string. 20000208 Remote access vulnerability in all MySQL server versions 975 Zeus web server allows remote attackers to view the source code for CGI programs via a null character (%00) at the end of a URL. 20000208 Zeus Web Server: Null Terminated Strings 977 zeus-server-null-string(3982) Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt. VU#328867 979 GNU make follows symlinks when it reads a Makefile from stdin, which allows other local users to execute commands. 981 Remote attackers can cause a denial of service in Novell BorderManager 3.5 by pressing the enter key in a telnet connection to port 2000. 976 FrontPage Personal Web Server (PWS) allows remote attackers to read files via a .... (dot dot) attack. 989 20000216 Doubledot bug in FrontPage FrontPage Personal Web Server. The ARCserve agent in UnixWare allows local attackers to modify arbitrary files via a symlink attack. http://www.sco.com/security/ 988 20000215 ARCserve symlink vulnerability Windows NT Autorun executes the autorun.inf file on non-removable media, which allows local attackers to specify an alternate program to execute when other users access a drive. 993 20000218 AUTORUN.INF Vulnerability Internet Explorer 4.x and 5.x allows remote web servers to access files on the client that are outside of its security domain, aka the "Image Source Redirect" vulnerability. MS00-009 ie-image-source-redirect(3996) NetBSD ptrace call on VAX allows local users to gain privileges by modifying the PSL contents in the debugging process. 1999-012 992 Buffer overflow in MMDF server allows remote attackers to gain privileges via a long MAIL FROM command to the SMTP daemon. SB-00.06a 997 20000215 Remote Vulnerability in the MMDF SMTP Daemon 20000218 MMDF HP Ignite-UX does not save /etc/passwd when it creates an image of a trusted system, which can set the password field to a blank and allow an attacker to gain privileges. HPSBUX0002-111 The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft. 20000221 Microsoft signed software can be install software without prompting users Sample web sites on Microsoft Site Server 3.0 Commerce Edition do not validate an identification number, which allows remote attackers to execute SQL commands. 994 MS00-010 The Microsoft virtual machine (VM) in Internet Explorer 4.x and 5.x allows a remote attacker to read files via a malicious Java applet that escapes the Java sandbox, aka the "VM File Reading" vulnerability. MS00-011 asmon and ascpu in FreeBSD allow local users to gain root privileges via a configuration file. 996 FreeBSD-SA-00:03 The installation of Sun Internet Mail Server (SIMS) creates a world-readable file that allows local users to obtain passwords. 1004 20000220 Sun Internet Mail Server The Delegate application proxy has several buffer overflows which allow a remote attacker to execute commands. K-023 FreeBSD-SA-00:04 delegate-proxy-bo(4105) Buffer overflow in the InterAccess telnet server TelnetD allows remote attackers to execute commands via a long login name. 20000223 Pragma Systems response to USSRLabs report 995 20000221 Local / Remote Exploiteable Buffer Overflow Vulnerability in InterAccess TelnetD Server 4.0 for Windows NT IIS Inetinfo.exe allows local users to cause a denial of service by creating a mail file with a long name and a .txt.eml extension in the pickup directory. 20000215 Crashing Inetinfo.exe by using a longfilename in the \mailroot\pickup directory Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability. 1043 MS00-017 20000306 con\con is a old thing (anyway is cool) Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'. 20000314 Oracle Web Listener 4.0.x 1053 Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable. 1011 atsadc in the atsar package for Linux does not properly check the permissions of an output file, which allows local users to gain root privileges. 20000311 TESO advisory -- atsadc 1048 The mtr program only uses a seteuid call when attempting to drop privileges, which could allow local users to gain root privileges. 1038 Vulnerability in the EELS system in SCO UnixWare 7.1.x allows remote attackers to cause a denial of service. SB-00.08a StarOffice StarScheduler web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000308 [SAFER 000309.EXP.1.4] StarScheduler (StarOffice) vulnerabilities 1040 Buffer overflow in StarOffice StarScheduler web server allows remote attackers to gain root access via a long GET command. 20000308 [SAFER 000309.EXP.1.4] StarScheduler (StarOffice) vulnerabilities 1039 The default configuration of Serv-U 2.5d and earlier allows remote attackers to determine the real pathname of the server by requesting a URL for a directory or file that does not exist. 20000228 Serv-U FTP-Server v2.4a showing real path 1016 DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters. 20000302 DNSTools v1.08 has no input validation 1028 ServerIron switches by Foundry Networks have predictable TCP/IP sequence numbers, which allows remote attackers to spoof or hijack sessions. http://www.foundrynet.com/bugTraq.html 1017 HP OpenView OmniBack 2.55 allows remote attackers to cause a denial of service via a large number of connections to port 5555. 20000228 HP Omniback remote DoS 1015 HPSBUX0006-115 Sojourn search engine allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000313 SOJOURN Search engine exposes files 1052 sojourn-file-read(4197) Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection. 20000311 Our old friend Firewall-1 1054 iPlanet Web Server 4.1 allows remote attackers to cause a denial of service via a large number of GET commands, which consumes memory and causes a kernel panic. Buffer overflow in ircII 4.4 IRC client allows remote attackers to execute commands via the DCC chat capability. 20000310 Fwd: ircii-4.4 buffer overflow RHSA-2000:008 1046 Linux printtool sets the permissions of printer configuration files to be world-readable, which allows local attackers to obtain printer share passwords. 20000309 1037 RealMedia RealServer reveals the real IP address of a Real Server, even if the address is supposed to be private. 20000308 RealServer exposes internal IP addresses 1049 Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges via a long command line argument. RHSA-2000:100 1020 EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters. 20000227 EZ Shopper 3.0 shopping cart CGI remote command execution 1014 EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters. 20000227 EZ Shopper 3.0 shopping cart CGI remote command execution 1014 ColdFusion Server 4.x allows remote attackers to determine the real pathname of the server via an HTTP request to the application.cfm or onrequestend.cfm files. 1021 AOL Instant Messenger (AIM) client allows remote attackers to cause a denial of service via a message with a malformed ASCII value. 20000303 Aol Instant Messenger DoS vulnerability Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. (dot dot) attack. 1025 20000229 Infosec.20000229.axisstorpointcd.a The default installation of Caldera OpenLinux 2.3 includes the CGI program rpm_query, which allows remote attackers to determine what packages are installed on the system. 20000304 OpenLinux 2.3: rpm_query 1036 The default configuration of Dosemu in Corel Linux 1.0 allows local users to execute the system.com program and gain privileges. 1030 20000302 Corel Linux 1.0 dosemu default configuration: Local root vuln buildxconf in Corel Linux allows local users to modify or create arbitrary files via the -x or -f parameters. 20000224 Corel Linux 1.0 local root compromise 1007 setxconf in Corel Linux allows local users to gain root access via the -T parameter, which executes the user's .xserverrc file. 20000224 Corel Linux 1.0 local root compromise 1008 Buffer overflow in mhshow in the Linux nmh package allows remote attackers to execute commands via malformed MIME headers in an email message. RHSA-2000:006 1018 The Windows NT scheduler uses the drive mapping of the interactive user who is currently logged onto the system, which allows the local user to gain privileges by providing a Trojan horse batch file in place of the original batch file. 20000313 AT Jobs - Denial of serice/Privilege Elevation 1050 Buffer overflow in POP3 and IMAP servers in the MERCUR mail server suite allows remote attackers to cause a denial of service. 20000314 Local / Remote Multiples Remote DoS Attacks in MERCUR v3.2* for Windows 98/NT Vulnerability 20000314 Local / Remote Multiples Remote DoS Attacks in MERCUR v3.2* for Windows 98/NT Vulnerability 1051 When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password. 1055 Buffer overflow in Microsoft Clip Art Gallery allows remote attackers to cause a denial of service or execute commands via a malformed CIL (clip art library) file, aka the "Clip Art Buffer Overrun" vulnerability. 1034 MS00-015 The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be executed from the local host, which allows remote attackers to execute arbitrary commands via Microsoft Networking. 1033 Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0 allow remote attackers to gain privileges via a malformed Select statement in an SQL query. 1041 MS00-014 The Trend Micro OfficeScan client tmlisten.exe allows remote attackers to cause a denial of service via malformed data to port 12345. http://www.antivirus.com/download/ofce_patch_35.htm 1013 20000228 Re: TrendMicro OfficeScan tmlisten.exe DoS 20000315 Trend Micro release patch for "OfficeScan DoS & Message Replay" V ulnerabilies The Trend Micro OfficeScan client allows remote attackers to cause a denial of service by making 5 connections to port 12345, which raises CPU utilization to 100%. 20000226 DOS in Trendmicro OfficeScan http://www.antivirus.com/download/ofce_patch_35.htm 1013 20000315 Trend Micro release patch for "OfficeScan DoS & Message Replay" V ulnerabilies Trend Micro OfficeScan allows remote attackers to replay administrative commands and modify the configuration of OfficeScan clients. 20000303 TrendMicro OfficeScan, numerous security holes, remote files modification. http://www.antivirus.com/download/ofce_patch_35.htm 1013 20000315 Trend Micro release patch for "OfficeScan DoS & Message Replay" V ulnerabilies The installation of Oracle 8.1.5.x on Linux follows symlinks and creates the orainstRoot.sh file with world-writeable permissions, which allows local users to gain privileges. 20000305 Oracle installer problem 1035 SGI InfoSearch CGI program infosrch.cgi allows remote attackers to execute commands via shell metacharacters. 20000501-01-P 1031 The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks (`) in parameters to htsearch. 1026 Buffer overflow in Lynx 2.x allows remote attackers to crash Lynx and possibly execute commands via a long URL in a malicious web page. 1012 The lit program in Sun Flex License Manager (FlexLM) follows symlinks, which allows local users to modify arbitrary files. 998 The Windows Media server allows remote attackers to cause a denial of service via a series of client handshake packets that are sent in an improper sequence, aka the "Misordered Windows Media Services Handshake" vulnerability. 1000 MS00-013 InterAccess TelnetD Server 4.0 allows remote attackers to conduct a denial of service via malformed terminal client configuration information. 1001 interaccess-telnet-dos(4033) The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters. http://www.sambar.com/session/highlight?url=/syshelp/history.htm&words=security+&color=red 1002 20000223 Sambar Server alert! FTP Explorer uses weak encryption for storing the username, password, and profile of FTP sites. 1003 20000224 How the password could be recover using FTP Explorer's registry! Vulnerability in SCO cu program in UnixWare 7.x allows local users to gain privileges. 1019 Microsoft email clients in Outlook, Exchange, and Windows Messaging automatically respond to Read Receipt and Delivery Receipt tags, which could allow an attacker to flood a mail system with responses by forging a Read Receipt request that is redirected to a large distribution list. 20000229 mailbombing DoS easily exploitable against mail systems using MS mail clients. The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program. 1006 Buffer overflow in Linux mount and umount allows local users to gain root privileges via a long relative pathname. CSSA-2000-002.0 Red Hat 6.0 allows local users to gain root access by booting single user and hitting ^C at the password prompt. 1005 20000223 redhat 6.0: single user boot security hole https://kc.mcafee.com/corporate/index?page=content&id=SB10053 ZoneAlarm sends sensitive system and network information in cleartext to the Zone Labs server if a user requests more information about an event. The Nautica Marlin bridge allows remote attackers to cause a denial of service via a zero length UDP packet to the SNMP port. 1009 The installation for Windows 2000 does not activate the Administrator password until the system has rebooted, which allows remote attackers to connect to the ADMIN$ share without a password until the reboot occurs. 990 20000215 Windows 2000 installation process weakness Buffer overflow in the wmcdplay CD player program for the WindowMaker desktop allows local users to gain root privileges via a long parameter. 20000311 TESO advisory -- wmcdplay 1047 ARCserve agent in SCO UnixWare 7.x allows local attackers to gain root privileges via a symlink attack. 20000215 ARCserve symlink vulnerability The Pocsag POC32 program does not properly prevent remote users from accessing its server port, even if the option has been disabled. 1032 20000303 Pocsag remote access to client can't be disabled. IIS 4.0 allows attackers to cause a denial of service by requesting a large buffer in a POST or PUT command which consumes memory, aka the "Chunked Transfer Encoding Buffer Overflow Vulnerability." 1066 MS00-018 The Linux 2.2.x kernel does not restrict the number of Unix domain sockets as defined by the wmem_max parameter, which allows local users to cause a denial of service by requesting a large number of sockets. 20000323 Local Denial-of-Service attack against Linux 20000328 Re: Local Denial-of-Service attack against Linux 1072 linux-domain-socket-dos(4186) Microsoft Windows Media License Manager allows remote attackers to cause a denial of service by sending a malformed request that causes the manager to halt, aka the "Malformed Media License Request" Vulnerability. 1058 MS00-016 gpm-root in the gpm package does not properly drop privileges, which allows local users to gain privileges by starting a utility from gpm-root. 20000322 gpm-root 20000405 Security hole in gpm < 1.18.1 RHSA-2000:009 RHSA-2000:045 1069 Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable. 20000316 TESO & C-Skills development advisory -- imwheel RHSA-2000:016 1060 Linux kreatecd trusts a user-supplied path that is used to find the cdrecord program, allowing local users to gain root privileges. 20000316 "TESO & C-Skills development advisory -- kreatecd" at: 1061 Microsoft TCP/IP Printing Services, aka Print Services for Unix, allows an attacker to cause a denial of service via a malformed TCP/IP print request. 20000330 Remote DoS Attack in Windows 2000/NT 4.0 TCP/IP Print Request Server Vulnerability 1082 MS00-021 SuSE Linux IMAP server allows remote attackers to bypass IMAP authentication and gain privileges. 20000327 Security hole in SuSE Linux IMAP Server The default configuration of Cobalt RaQ2 and RaQ3 as specified in access.conf allows remote attackers to view sensitive contents of a .htaccess file. 1083 http://www.securityfocus.com/templates/advisory.html?id=2150 20000330 Cobalt apache configuration exposes .htaccess Buffer overflow in the huh program in the orville-write package allows local users to gain root privileges. FreeBSD-SA-00:10 1070 Netscape Enterprise Server with Directory Indexing enabled allows remote attackers to list server directories via web publishing tags such as ?wp-ver-info and ?wp-cs-dump. 1063 20000317 [SAFER 000317.EXP.1.5] Netscape Enterprise Server and '?wp' tags Netscape Enterprise Server with Web Publishing enabled allows remote attackers to list arbitrary directories via a GET request for the /publisher directory, which provides a Java applet that allows the attacker to browse the directories. 1075 http://zsh.stupidphat.com/advisory.cgi?000311-1 Buffer overflow in the web server for Norton AntiVirus for Internet Email Gateways allows remote attackers to cause a denial of service via a long URL. 1064 20000317 DoS with NAVIEG Buffer overflow in the MERCUR WebView WebMail server allows remote attackers to cause a denial of service via a long mail_user parameter in the GET request. 20000315 Local / Remote DoS Attack in MERCUR WebView WebMail-Client 1.0 1056 20000315 Local / Remote DoS Attack in MERCUR WebView WebMail-Client 1.0 vqSoft vqServer program allows remote attackers to read arbitrary files via a /........../ in the URL, a variation of a .. (dot dot) attack. 1067 20000321 vqserver /........../ http://www.vqsoft.com/vq/server/faqs/dotdotbug.html vqSoft vqServer stores sensitive information such as passwords in cleartext in the server.cfg file, which allows attackers to gain privileges. 1068 20000321 vqserver /........../ WindMail allows remote attackers to read arbitrary files or execute commands via shell metacharacters. 1073 20000325 Windmail allow web user get any file AnalogX SimpleServer:WWW HTTP server 1.03 allows remote attackers to cause a denial of service via a short GET request to cgi-bin. http://www.analogx.com/contents/download/network/sswww.htm 1076 20000324 AnalogX SimpleServer 1.03 Remote Crash" at: simpleserver-exception-dos(4189) The Citrix ICA (Independent Computing Architecture) protocol uses weak encryption (XOR) for user authentication. 1077 20000328 Citrix ICA Basic Encryption Vulnerability in SGI IRIX objectserver daemon allows remote attackers to create user accounts. 20000303-01-PX K-030 1079 20000328 Objectserver vulnerability irix-objectserver-create-accounts(4206) IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability. Q249599 1081 MS00-019 Unknown vulnerability in Generic-NQS (GNQS) allows local users to gain root privileges. FreeBSD-SA-00:13 20000322 Local root compromise in GNQS 3.50.6 and 3.50.7 http://ftp.gnqs.org/pub/gnqs/source/by-version-number/v3.50/Generic-NQS-3.50.8-ChangeLog.txt 1842 generic-nqs-local-root(4306) The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands. 20000424 Backdoor Password in Red Hat Linux Virtual Server Package The AIX Fast Response Cache Accelerator (FRCA) allows local users to modify arbitrary files via the configuration capability in the frcactrl program. 1152 20000426 Insecure file handling in IBM AIX frcactrl program The crypt function in QNX uses weak encryption, which allows local users to decrypt passwords. 20000414 qnx crypt comprimised 1114 HP-UX 11.04 VirtualVault (VVOS) sends data to unprivileged processes via an interface that has multiple aliased IP addresses. HPSBUX0004-112 1090 The dansie shopping cart application cart.pl allows remote attackers to execute commands via a shell metacharacters in a form variable. 20000411 Back Door in Commercial Shopping Cart 1115 dansie-shell-metacharacters(4975) The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields. 1115 shopping-cart-form-tampering(4621) The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables. 1115 dansie-form-variables(4954) The Nbase-Xyplex EdgeBlaster router allows remote attackers to cause a denial of service via a scan for the FormMail CGI program. 20000405 SilverBack Security Advisory: Nbase-Xyplex DoS 1091 Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability. 20070603 CERN &#304;mage Map Dispatcher 1117 MS00-028 frontpage-cern-bo(34720) Buffer overflow in the NetWare remote web administration utility allows remote attackers to cause a denial of service or execute commands via a long URL. 1118 20000418 Novell Netware 5.1 (server 5.00h, Dec 11, 1999)... IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability. 1101 MS00-023 The default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromise the cryptographic keys of other users. 1105 MS00-024 Buffer overflow in the dvwssr.dll DLL in Microsoft Visual Interdev 1.0 allows users to cause a denial of service or execute commands, aka the "Link View Server-Side Component" vulnerability. 1109 MS00-025 The AVM KEN! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000415 (no subject) 1103 20000418 AVM's Statement The AVM KEN! ISDN Proxy server allows remote attackers to cause a denial of service via a malformed request. 20000415 (no subject) 1103 20000418 AVM's Statement The X font server xfs in Red Hat Linux 6.x allows an attacker to cause a denial of service via a malformed request. 20000416 xfs 1111 Panda Security 3.0 with registry editing disabled allows users to edit the registry and gain privileges by directly executing a .reg file or using other methods. http://updates.pandasoftware.com/docs/us/Avoidvulnerability.zip 1119 20000417 bugs in Panda Security 3.0 Panda Security 3.0 allows users to uninstall the Panda software via its Add/Remove Programs applet. http://updates.pandasoftware.com/docs/us/Avoidvulnerability.zip 1119 20000417 bugs in Panda Security 3.0 Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL. 1121 20000418 IE 5 security vulnerablity - circumventing Cross-frame security policy using Java/JavaScript (and disabling Active Scripting is not that easy) Cisco Catalyst 5.4.x allows a user to gain access to the "enable" mode without a password. 20000419 Cisco Catalyst Enable Password Bypass Vulnerability 1122 Cisco IOS 11.x and 12.x allows remote attackers to cause a denial of service by sending the ENVIRON option to the Telnet daemon before it is ready to accept it, which causes the system to reboot. 20000420 Cisco IOS Software TELNET Option Handling Vulnerability 1123 Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess. 1125 20000418 RUS-CERT Advisory 200004-01: GNU Emacs 20 The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack. 1125 20000418 RUS-CERT Advisory 200004-01: GNU Emacs 20 read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, which allows an attacker to read unencrypted passwords. 1125 20000418 RUS-CERT Advisory 200004-01: GNU Emacs 20 RealNetworks RealServer allows remote attackers to cause a denial of service by sending malformed input to the server at port 7070. 20000420 Remote DoS attack in Real Networks Real Server Vulnerability http://service.real.com/help/faq/servg270.html 1128 PCAnywhere allows remote attackers to cause a denial of service by terminating the connection before PCAnywhere provides a login prompt. 20000409 A funny way to DOS pcANYWHERE8.0 and 9.0 1095 The Linux trustees kernel patch allows attackers to cause a denial of service by accessing a file or directory with a long name. 20000410 linux trustees 1.5 long path name vulnerability http://www.braysystems.com/linux/trustees.html 1096 CRYPTOCard CryptoAdmin for PalmOS uses weak encryption to store a user's PIN number, which allows an attacker with access to the .PDB file to generate valid PT-1 tokens after cracking the PIN. 20000410 CRYPTOAdmin 4.1 server with PalmPilot PT-1 token 1.04 PIN Extract ion 20000410 CRYPTOCard PalmToken PIN Extraction 1097 BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37. 1098 20000410 BeOS syscall bug Microsoft Excel 97 and 2000 does not warn the user when executing Excel Macro Language (XLM) macros in external text files, which could allow an attacker to execute a macro virus, aka the "XLM Text Macro" vulnerability. 1272 1087 MS00-022 The SalesLogix Eviewer allows remote attackers to cause a denial of service by accessing the URL for the slxweb.dll administration program, which does not authenticate the user. 20000331 SalesLogix Eviewer Web App Bug: URL request crashes eviewer web application 1089 BeOS allows remote attackers to cause a denial of service via malformed packets whose length field is less than the length of the headers. 20000407 BeOS Networking DOS http://bebugs.be.com/devbugs/detail.php3?oid=2505312 1100 Buffer overflow in the RealNetworks RealPlayer client versions 6 and 7 allows remote attackers to cause a denial of service via a long Location URL. 20000403 Win32 RealPlayer 6/7 Buffer Overflow 1088 Buffer overflow in the Napster client beta 5 allows remote attackers to cause a denial of service via a long message. 20000326 neat little napster bug 20000330 Napster, Inc. response to Colten Edwards TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. (dot dot) attack on the webplus CGI program. ftp://ftp.talentsoft.com/Download/Webplus/Unix/Patches/Webplus46p%20Read%20me.html 20000412 TalentSoft Web+ Input Validation Bug Vulnerability 1102 The default installation of IRIX Performance Copilot allows remote attackers to access sensitive system information via the pmcd daemon. 20000412 Performance Copilot for IRIX 6.5 1106 Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands. 20000416 imapd4r1 v12.264 20000416 imapd4r1 v12.264 1110 Buffer overflow in XFree86 3.3.x allows local users to execute arbitrary commands via a long -xkbmap parameter. 20000416 XFree86 server overflow 1306 X fontserver xfs allows local users to cause a denial of service via malformed input to the server. 20000416 xfs 1111 The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter. 20000412 BizDB Search Script Enables Shell Command Execution at the Server 1104 Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable. 20000412 Infonautic's getdoc.cgi may allow unauthorized access to documents IP masquerading in Linux 2.2.x allows remote attackers to route UDP packets through the internal interface by modifying the external source IP address and port number to match those of an established connection. 20000327 Security Problems with Linux 2.2.x IP Masquerading 20000520 Security hole in kernel < 2.2.15 1078 Buffer overflow in Webstar HTTP server allows remote attackers to cause a denial of service via a long GET request. 20000331 Webstar 4.0 Buffer overflow vulnerability 1822 macos-webstar-get-bo(4792) Buffer overflow in Star Office 5.1 allows attackers to cause a denial of service by embedding a long URL within a document. 20000416 StarOffice 5.1 1112 The Adtran MX2800 M13 Multiplexer allows remote attackers to cause a denial of service via a ping flood to the Ethernet interface, which causes the device to crash. 1129 20000418 Adtran DoS aaa_base in SuSE Linux 6.3, and cron.daily in earlier versions, allow local users to delete arbitrary files by creating files whose names include spaces, which are then incorrectly interpreted by aaa_base when it deletes expired files from the /tmp directory. 1130 Buffer overflow in healthd for FreeBSD allows local users to gain root privileges. 1107 FreeBSD-SA-00:12 Buffer overflow in LCDproc allows remote attackers to gain root privileges via the screen_add command. GLSA-200301-07 1131 20000420 Remote vulnerability in LCDproc 0.4 lcdproc-remote-overflow(4315) fcheck allows local users to gain privileges by embedding shell metacharacters into file names that are processed by fcheck. 20000331 fcheck v.2.7.45 and insecure use of Perl's system() 1086 Allaire Forums 2.0.5 allows remote attackers to bypass access restrictions to secure conferences via the rightAccessAllForums or rightModerateAllForums variables. 1085 ASB00-06 The unattended installation of Windows 2000 with the OEMPreinstall option sets insecure permissions for the All Users and Default Users directories. 20000407 All Users startup folder left open if unattended install and OEMP reinstall=1 1758 win2k-unattended-install(4278) Buffer overflow in WebObjects.exe in the WebObjects Developer 4.5 package allows remote attackers to cause a denial of service via an HTTP request with long headers such as Accept. 20000404 WebObjects DoS The default encryption method of PcAnywhere 9.x uses weak encryption, which allows remote attackers to sniff and decrypt PcAnywhere or NT domain accounts. 1093 20000405 PcAnywhere weak password encryption Ipswitch IMAIL server 6.02 and earlier allows remote attackers to cause a denial of service via the AUTH CRAM-MD5 command. 20000405 Re: IMAIL (Ipswitch) DoS with Eudora (Qualcomm) http://support.ipswitch.com/kb/IM-20000208-DM02.htm 1094 Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL. 20000331 Alert: MS Index Server (CISADV000330) 1084 MS00-006 Quake3 Arena allows malicious server operators to read or modify files on a client via a dot dot (..) attack. http://www.quake3arena.com/news/index.html 1169 20000503 Vulnerability in Quake3Arena Auto-Download Feature Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program, aka the "Undelimited .HTR Request" vulnerability. 1191 20000511 Microsoft IIS Remote Denial of Service Attack MS00-031 Windows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a large number of identical fragmented IP packets, aka jolt2 or the "IP Fragment Reassembly" vulnerability. 1236 20000519 jolt2 - Remote DoS against NT, W2K, 9x MS00-029 Buffer overflow in calserver in SCO OpenServer allows remote attackers to gain root access via a long message. SB-99.02 19981229 Local/remote exploit for SCO UNIX. Vulnerability in xserver in SCO UnixWare 2.1.x and OpenServer 5.05 and earlier allows an attacker to cause a denial of service which prevents access to reserved port numbers below 1024. SB-99.07 Insecure file permissions for Netscape FastTrack Server 2.x, Enterprise Server 2.0, and Proxy Server 2.5 in SCO UnixWare 7.0.x and 2.1.3 allow an attacker to gain root privileges. SB-99.08 The i386 trace-trap handling in OpenBSD 2.4 with DDB enabled allows a local user to cause a denial of service. 19990212 i386 trace-trap handling when DDB was configured could cause a system crash. IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets. 19990217 IP fragment assembly can bog the machine excessively and cause problems. The Windows 2000 domain controller allows a malicious user to modify Active Directory information by modifying an unprotected attribute, aka the "Mixed Object Access" vulnerability. 1145 MS00-026 cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function. 19990830 In cron(8), make sure argv[] is NULL terminated in the fake popen() and run sendmail as the user, not as root. Vulnerability in OpenBSD 2.6 allows a local user to change interface media configurations. 19991109 Any user can change interface media configurations. traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute with a large waittime (-w) option, which is not parsed properly and sets the time delay for sending packets to zero. NetBSD-SA1999-004 19990213 traceroute as a flooder traceroute in NetBSD 1.3.3 and Linux systems allows local unprivileged users to modify the source address of the packets, which could be used in spoofing attacks. NetBSD-SA1999-004 19990213 traceroute as a flooder Buffer overflow in Solaris 7 lp allows local users to gain root privileges via a long -d option. 20000424 Solaris 7 x86 lp exploit 1143 Buffer overflow in Solaris 7 lpset allows local users to gain root privileges via a long -r option. 20000424 Solaris 7 x86 lpset exploit. 20000424 Solaris 7 x86 lpset exploit. 20000427 Re: Solaris/SPARC 2.7 lpset exploit (well not likely !) 1138 Atrium Mercur Mail Server 3.2 allows local attackers to read other user's email and create arbitrary files via a dot dot (..) attack. 20000413 Security problems with Atrium Mercur Mailserver 3.20 1144 mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n. 1146 20000424 unsafe fgets() in sendmail's mail.local Qpopper 2.53 and 3.0 does not properly identify the \n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 1023 characters long and ends in \n. 1133 20000421 unsafe fgets() in qpopper Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name. 20000424 Buffer Overflow in version .14 1147 The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters. RHSA-2000:014 1149 20000424 piranha default password/exploit The Microsoft Jet database engine allows an attacker to modify text files via a database query, aka the "Text I-ISAM" vulnerability. 19990728 Alert : MS Office 97 Vulnerability MS99-030 jet-text-isam 595 pcAnywhere 8.x and 9.0 allows remote attackers to cause a denial of service via a TCP SYN scan, e.g. by nmap. 20010211 Symantec pcAnywhere 9.0 DoS / Buffer Overflow 20010212 Re: Symantec pcAnywhere 9.0 DoS / Buffer Overflow pcanywhere-tcpsyn-dos(4347) 1150 20000425 Denial of Service Against pcAnywhere. The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability. 548 MS99-030 jet-vba-shell(3155) Meeting Maker uses weak encryption (a polyalphabetic substitution cipher) for passwords, which allows remote attackers to sniff and decrypt passwords for Meeting Maker accounts. http://support.on.com/support/mmxp.nsf/31af51e08bcc93eb852565a90056138b/11af70407a16b165852568c50056a952?OpenDocument 1151 Microsoft Virtual Machine (VM) allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, aka the "Virtual Machine Verifier" vulnerability. 19991014 Another Microsoft Java Flaw Disovered MS99-045 Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), which allows remote attackers to perform spoofing and session hijacking. 604 19990824 NT Predictable Initial TCP Sequence numbers - changes observed with SP4 MS99-046 A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability. MS99-048 The networking software in Windows 95 and Windows 98 allows remote attackers to execute commands via a long file name string, aka the "File Access URL" vulnerability. MS99-049 Buffer overflow in Microsoft command processor (CMD.EXE) for Windows NT and Windows 2000 allows a local user to cause a denial of service via a long environment variable, aka the "Malformed Environment Variable" vulnerability. 20000421 CMD.EXE overflow (CISADV000420) 1135 MS00-027 UltraBoard.pl or UltraBoard.cgi CGI scripts in UltraBoard 1.6 allows remote attackers to read arbitrary files via a pathname string that includes a dot dot (..) and ends with a null byte. 1164 20000502 Fun with UltraBoard V1.6X tcpdump, Ethereal, and other sniffer packages allow remote attackers to cause a denial of service via malformed DNS packets in which a jump offset refers to itself, which causes tcpdump to enter an infinite loop while decompressing the packet. 1165 20000502 Denial of service attack against tcpdump The Allaire Spectra container editor preview tool does not properly enforce object security, which allows an attacker to conduct unauthorized activities via an object-method that is added to the container object with a publishing rule. ASB00-10 1181 The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results. 1166 Linux OpenLDAP server allows local users to modify arbitrary files via a symlink attack. CSSA-2000-009.0 RHSA-2000:012 1232 TLSA2000010-1 Buffer overflow in Xsun X server in Solaris 7 allows local users to gain root privileges via a long -dev parameter. 20000424 Solaris x86 Xsun overflow. 1140 Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user. 1136 20000423 CVS DoS ZoneAlarm 2.1.10 and earlier does not filter UDP packets with a source port of 67, which allows remote attackers to bypass the firewall rules. 1137 20000420 ZoneAlarm Buffer overflow in Gnomelib in SuSE Linux 6.3 allows local users to execute arbitrary commands via the DISPLAY environmental variable. 1155 20000428 SuSE 6.3 Gnomelib buffer overflow http://www.suse.com/us/support/download/updates/axp_63.html ATRIUM Cassandra NNTP Server 1.10 allows remote attackers to cause a denial of service via a long login name. 20000501 Remote DoS attack in CASSANDRA NNTPServer v1.10 from ATRIUM 1156 Eudora 4.x allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment." http://news.cnet.com/news/0-1005-200-1773077.html?tag=st.ne.fd.lthd.1005-200-1773077 http://www.peacefire.org/security/stealthattach/explanation.html 1157 Buffer overflow in Sniffit 0.3.x with the -L logging option enabled allows remote attackers to execute arbitrary commands via a long MAIL FROM mail header. 1158 20000502 spj-003-000 - S0ftPj Advisory The knfsd NFS server in Linux kernel 2.2.x allows remote attackers to cause a denial of service via a negative size value. 1160 20000501 Linux knfsd DoS issue The on-line help system options in Cisco routers allows non-privileged users without "enabled" access to obtain sensitive information via the show command. 1161 20000502 Possible issue with Cisco on-line help? AppleShare IP 6.1 and later allows a remote attacker to read potentially sensitive information via an invalid range request to the web server. http://asu.info.apple.com/swupdates.nsf/artnum/n11670 1162 20000502 INFO:AppleShare IP 6.3.2 squashes security bug Windows 95 and Windows 98 allow a remote attacker to cause a denial of service via a NetBIOS session request packet with a NULL source name. 20000501 el8.org advisory - Win 95/98 DoS (RFParalyze.c) 1163 A vulnerability in the Sendmail configuration file sendmail.cf as installed in SCO UnixWare 7.1.0 and earlier allows an attacker to gain root privileges. SB-99.10 Vulnerability in the passthru driver in SCO UnixWare 7.1.0 allows an attacker to cause a denial of service. SB-99.13 A debugging feature in NetworkICE ICEcap 2.0.23 and earlier is enabled, which allows a remote attacker to bypass the weak authentication and post unencrypted events. http://advice.networkice.com/advice/Support/KB/q000166/ 1216 http://www.securityfocus.com/templates/advisory.html?id=2220 Some packaging commands in SCO UnixWare 7.1.0 have insecure privileges, which allows local users to add or remove software packages. SB-99.09 Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL. CSSA-1999-036.0 19991227 Security hole in Pine < 4.21 810 19991117 Pine: expanding env vars in URLs (seems to be fixed as of 4.21) Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server, which is then executed by Pine. 19990911 Update for Pine (fixed IMAP support) 19990628 Execution of commands in Pine 4.x http://www.securiteam.com/unixfocus/HHP-Pine_remote_exploit.html 1247 mirror 2.8.x in Linux systems allows remote attackers to create files one level above the local target directory. 19991018 Incorrect directory name handling in mirror 19991001 Security hole in mirror 681 19990928 mirror 2.9 hole pg and pb in SuSE pbpg 1.x package allows an attacker to read arbitrary files. 19990920 Security hole in pbpg Pluggable Authentication Modules (PAM) in Red Hat Linux 6.1 does not properly lock access to disabled NIS accounts. 697 RHSA-1999:040 ORBit and esound in Red Hat Linux 6.1 do not use sufficiently random numbers, which allows local users to guess the authentication keys. RHSA-1999:058-01 ORBit and gnome-session in Red Hat Linux 6.1 allows remote attackers to crash a program. RHSA-1999:058-01 Buffer overflow in Trivial HTTP (THTTPd) allows remote attackers to cause a denial of service or execute arbitrary commands via a long If-Modified-Since header. 19991113 thttpd 2.04 stack overflow (VD#6) 19991116 Security hole in thttpd 1.90a - 2.04 1248 Buffer overflow in INN 2.2.1 and earlier allows remote attackers to cause a denial of service via a maliciously formatted article. CSSA-1999-038.0 19991124 Security hole in inn <= 2.2.1 1249 The PPP wvdial.lxdialog script in wvdial 1.4 and earlier creates a .config file with world readable permissions, which allows a local attacker in the dialout group to access login and password information. 19991214 Security hole in wvdial <= 1.4 Buffer overflows in Linux cdwtools 093 and earlier allows local users to gain root privileges. 19991019 Security hole in cdwtools < 093 738 Linux cdwtools 093 and earlier allows local users to gain root privileges via the /tmp directory. 19991019 Security hole in cdwtools < 093 738 screen and rxvt in Red Hat Linux 6.0 do not properly set the modes of tty devices, which allows local users to write to other ttys. 19990606 RedHat 6.0, /dev/pts permissions bug when using xterm 19990606 RedHat 6.0, /dev/pts permissions bug when using xterm RHSA1999014_01 309 Red Hat Linux 6.0 installs the /dev/pts file system with insecure modes, which allows local users to write to other tty devices. 19990606 RedHat 6.0, /dev/pts permissions bug when using xterm 19990606 RedHat 6.0, /dev/pts permissions bug when using xterm RHSA1999014_01 308 dump in Debian GNU/Linux 2.1 does not properly restore symlinks, which allows a local user to modify the ownership of arbitrary files. 19991202 problem restoring symlinks 1442 Vulnerability in eterm 0.8.8 in Debian GNU/Linux allows an attacker to gain root privileges. 19990218 Root exploit in eterm Classic Cisco IOS 9.1 and later allows attackers with access to the login prompt to obtain portions of the command history of previous users, which may allow the attacker to access sensitive data. J-009 19981014 Cisco IOS Command History Release at Login Prompt The IDENT server in Caldera Linux 2.3 creates multiple threads for each IDENT request, which allows remote attackers to cause a denial of service. CSSA-1999-029.1 1266 The debug option in Caldera Linux smail allows remote attackers to execute commands via shell metacharacters in the -D option for the rmail command. CSSA-1999-001.0 1268 The libmediatool library used for the KDE mediatool allows local users to create arbitrary files via a symlink attack. CSSA-1999-005.0 1269 Vulnerability in Caldera rmt command in the dump package 0.4b4 allows a local user to gain root privileges. CSSA-1999-014.0 linux-rmt(2268) Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges. CSSA-1999-015.0 RHSA-1999:015-01 kde-kvt(2266) The default configuration of kdm in Caldera and Mandrake Linux, and possibly other distributions, allows XDMCP connections from any host, which allows remote attackers to obtain sensitive information or bypass additional access restrictions. CSSA-1999-021.0 MDKSA-2002:025 1446 xdmcp-kdm-default-configuration(4856) The kernel in FreeBSD 3.2 follows symbolic links when it creates core dump files, which allows local attackers to modify arbitrary files. Buffer overflow in the HTTP proxy server for the i-drive Filo software allows remote attackers to execute arbitrary commands via a long HTTP GET request. 1324 The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the winlogon process to fail, aka the "Remote Registry Access Authentication" vulnerability. Q264684 1331 MS00-040 oval:org.mitre.oval:def:1021 The pam_console PAM module in Linux systems performs a chown on various devices upon a user login, but an open file descriptor for those devices can be maintained after the user logs out, which allows that user to sniff activity on these devices when subsequent users log in. 20000502 pam_console bug 1176 The Netopia R9100 router does not prevent authenticated users from modifying SNMP tables, even if the administrator has configured it to do so. http://www.netopia.com/equipment/purchase/fmw_update.html 1177 20000507 Advisory: Netopia R9100 router vulnerability The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string. 20000426 Cisco HTTP possible bug: 20000514 Cisco IOS HTTP Server Vulnerability 1154 The Gossamer Threads DBMan db.cgi CGI script allows remote attackers to view environmental variables and setup information by referencing a non-existing database in the db parameter. 20000505 Black Watch Labs Vulnerability Alert http://www.perfectotech.com/blackwatchlabs/vul5_05.html 1178 ColdFusion ClusterCATS appends stale query string arguments to a URL during HTML redirection, which may provide sensitive information to the redirected site. ASB00-12 1179 The file transfer component of AOL Instant Messenger (AIM) reveals the physical path of the transferred file to the remote recipient. 1180 20000507 AOL Instant Messenger NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the NetStructure's MAC address, which could allow remote attackers to gain root access. http://216.188.41.136/ 20000508 NetStructure 7110 console backdoor 20000508 NetStructure 7180 remote backdoor vulnerability 1182 1183 FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities. http://www.blueworld.com/blueworld/news/05.01.00-FM5_Security.html http://www.filemaker.com/support/webcompanion.html FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email. http://www.blueworld.com/blueworld/news/05.01.00-FM5_Security.html http://www.filemaker.com/support/webcompanion.html The makelev program in the golddig game from the FreeBSD ports collection allows local users to overwrite arbitrary files. FreeBSD-SA-00:16 1184 Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental variable. FreeBSD-SA-00:17 1185 Buffer overflow in krb_rd_req function in Kerberos 4 and 5 allows remote attackers to gain root privileges. 20000516 BUFFER OVERRUN VULNERABILITIES IN KERBEROS FreeBSD-SA-00:20 CA-2000-06 RHSA-2000:025 1220 Buffer overflow in krb425_conv_principal function in Kerberos 5 allows remote attackers to gain root privileges. 20000516 BUFFER OVERRUN VULNERABILITIES IN KERBEROS FreeBSD-SA-00:20 CA-2000-06 RHSA-2000:025 1220 Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges. 20000516 BUFFER OVERRUN VULNERABILITIES IN KERBEROS FreeBSD-SA-00:20 CA-2000-06 RHSA-2000:025 1220 Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges. 20000516 BUFFER OVERRUN VULNERABILITIES IN KERBEROS FreeBSD-SA-00:20 CA-2000-06 RHSA-2000:025 1220 The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, which allows the user to gain privileges by specifying an alternate program to execute. 20000516 kscd vulnerability 20000529 kmulti <= 1.1.2 1206 NetProwler 3.0 allows remote attackers to cause a denial of service by sending malformed IP packets that trigger NetProwler's Man-in-the-Middle signature. 20000519 RFP2K05: NetProwler vs. RFProwler 1225 20000522 RFP2K05 - NetProwler "Fragmentation" Issue Buffer overflow in CProxy 3.3 allows remote users to cause a denial of service via a long HTTP request. 1213 20000516 CProxy v3.3 SP 2 DoS The add.exe program in the Carello shopping cart software allows remote attackers to duplicate files on the server, which could allow the attacker to read source code for web scripts such as .ASP files. 20000524 Alert: Carello File Creation flaw 1245 The EMURL web-based email account software encodes predictable identifiers in user session URLs, which allows a remote attacker to access a user's email account. 20000515 Vulnerability in EMURL-based e-mail providers 1203 Buffer overflow in wconsole.dll in Rockliffe MailSite Management Agent allows remote attackers to execute arbitrary commands via a long query_string parameter in the HTTP GET request. 20000524 Alert: Buffer overflow in Rockliffe's MailSite 1244 Buffer overflow in MDaemon POP server allows remote attackers to cause a denial of service via a long user name. 20000524 Deerfield Communications MDaemon Mail Server DoS 1250 The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, which allows an attacker to download any type of file to a user's system by encoding it within an email message or news post. 20000516 MICROSOFT SECURITY FLAW? 1221 Buffer overflows in redirect.exe and changepw.exe in PDGSoft shopping cart allow remote attackers to execute arbitrary commands via a long query string. 20000525 Alert: PDG Cart Overflows 20000525 Alert: PDG Cart Overflows http://www.pdgsoft.com/Security/security2.html 1256 The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability. Q263968 1281 MS00-035 The CIFS Computer Browser service on Windows NT 4.0 allows a remote attacker to cause a denial of service by sending a large number of host announcement requests to the master browse tables, aka the "HostAnnouncement Flooding" or "HostAnnouncement Frame" vulnerability. Q263307 1261 MS00-036 The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowser Frame" vulnerability. Q262694 1262 MS00-036 Buffer overflow in L0pht AntiSniff allows remote attackers to execute arbitrary commands via a malformed DNS response packet. 20000515 AntiSniff version 1.01 and Researchers version 1 DNS overflow 1207 Netscape Communicator before version 4.73 and Navigator 4.07 do not properly validate SSL certificates, which allows remote attackers to steal information by redirecting traffic from a legitimate web server to their own malicious server, aka the "Acros-Suencksen SSL" vulnerability. http://www.acrossecurity.com/aspr/ASPR-2000-04-06-1-PUB.txt CA-2000-05 RHSA-2000:028 1188 Buffer overflow in Solaris netpr program allows local users to execute arbitrary commands via a long -p option. 20000512 New Solaris root exploit for /usr/lib/lp/bin/netpr 1200 IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed Extension Data in URL" vulnerability. Q260205 1190 http://www.ussrback.com/labs40.html MS00-030 Netscape 4.73 and earlier follows symlinks when it imports a new certificate, which allows local users to overwrite files of the user importing the certificate. 20000510 Possible symlink problems with Netscape 4.73 1201 ColdFusion Server 4.5.1 allows remote attackers to cause a denial of service by making repeated requests to a CFCACHE tagged cache file that is not stored in memory. 20000510 Cold Fusion Server 4.5.1 DoS Vulnerability. 1192 Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter. 20000510 Black Watch Labs Vulnerability Alert http://www.perfectotech.com/blackwatchlabs/vul5_10.html 1187 The gnapster and knapster clients for Napster do not properly restrict access only to MP3 files, which allows remote attackers to read arbitrary files from the client by specifying the full pathname for the file. FreeBSD-SA-00:18 20000510 KNapster Vulnerability Compromises User-readable Files 20000510 Gnapster Vulnerability Compromises User-readable Files 1186 The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path. 20000506 shtml.exe reveal local path of IIS web directory 1174 Vulnerability in shutdown command for HP-UX 11.X and 10.X allows allows local users to gain privileges via malformed input variables. HPSBUX0005-113 1214 Buffer overflow in Outlook Express 4.x allows attackers to cause a denial of service via a mail or news message that has a .jpg or .bmp attachment with a long file name. 20000512 Overflow in Outlook Express 4.* - too long filenames with graphic format extension 1195 NTMail 5.x allows network users to bypass the NTMail proxy restrictions by redirecting their requests to NTMail's web configuration server. http://www.gordano.com/support/archives/ntmail/2000-05/00001114.htm 1196 20000511 NTMail Proxy Exploit The HTTP administration interface to the Cayman 3220-H DSL router allows remote attackers to cause a denial of service via a long username or password. 20000505 Cayman 3220-H DSL Router DOS 20000523 Cayman 3220H DSL Router Software Update and New Bonus Attack 1219 The Cayman 3220-H DSL router allows remote attackers to cause a denial of service via oversized ICMP echo (ping) requests. 20000523 Cayman 3220H DSL Router Software Update and New Bonus Attack 1240 The Office 2000 UA ActiveX Control is marked as "safe for scripting," which allows remote attackers to conduct unauthorized activities via the "Show Me" function in Office Help, aka the "Office 2000 UA Control" vulnerability. CA-2000-07 Q262767 1197 MS00-034 The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker tor ecover it and use it to decrypt Encrypted File System (EFS) data. 20000511 ISS SAVANT Advisory 00/26 1198 The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters. 20000510 Advisory: Unchecked system(blaat $var blaat) call in Bugzilla 2.8 1199 Buffer overflow in Netwin DMailWeb CGI program allows remote attackers to execute arbitrary commands via a long utoken parameter. 20000504 Alert: DMailWeb buffer overflow 1171 Buffer overflow in Netwin DNEWSWEB CGI program allows remote attackers to execute arbitrary commands via long parameters such as group, cmd, and utag. 20000505 Alert: DNewsWeb buffer overflow 1172 The CGI counter 4.0.7 by George Burgyan allows remote attackers to execute arbitrary commands via shell metacharacters. 1202 20000514 Vulnerability in CGI counter 4.0.7 by George Burgyan Buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8 allows remote attackers to execute arbitrary commands. 20000505 Alert: Listserv Web Archives (wa) buffer overflow http://www.lsoft.com/news/default.asp?item=Advisory0 1167 UltraBoard 1.6 and other versions allow remote attackers to cause a denial of service by referencing UltraBoard in the Session parameter, which causes UltraBoard to fork copies of itself. 20000505 Re: Fun with UltraBoard V1.6X 1175 The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the PIN of the owner by resetting the PIN in the EEPROM. 20000504 eToken Private Information Extraction and Physical Attack 1170 Buffer overflow in the SMTP gateway for InterScan Virus Wall 3.32 and earlier allows a remote attacker to execute arbitrary commands via a long filename for a uuencoded attachment. 20000503 Trend Micro InterScan VirusWall Remote Overflow 1168 A backdoor password in Cart32 3.0 and earlier allows remote attackers to execute arbitrary commands. 20000427 Alert: Cart32 secret password backdoor (CISADV000427) http://www.cart32.com/kbshow.asp?article=c048 Cart32 allows remote attackers to access sensitive debugging information by appending /expdate to the URL request. 20000503 Another interesting Cart32 command 1358 Cobalt RaQ2 and RaQ3 does not properly set the access permissions and ownership for files that are uploaded via FrontPage, which allows attackers to bypass cgiwrap and modify files. http://archives.neohapsis.com/archives/bugtraq/2000-05/0305.html 1238 20000522 Problem with FrontPage on Cobalt RaQ2/RaQ3 The calender.pl and the calendar_admin.pl calendar scripts by Matt Kruse allow remote attackers to execute arbitrary commands via shell metacharacters. 20000516 Vuln in calender.pl (Matt Kruse calender script) 1215 The SuSE aaa_base package installs some system accounts with home directories set to /tmp, which allows local users to gain privileges to those accounts by creating standard user startup scripts such as profiles. 20000502 aaabase < 2000.5.2 The administrative password for the Allmanage web site administration software is stored in plaintext in a file which could be accessed by remote attackers. 20000516 Allmanage.pl Vulnerabilities 1217 The allmanageup.pl file upload CGI script in the Allmanage Website administration software 2.6 can be called directly by remote attackers, which allows them to modify user accounts or web pages. 20000516 Allmanage.pl Vulnerabilities 1217 MetaProducts Offline Explorer 1.2 and earlier allows remote attackers to access arbitrary files via a .. (dot dot) attack. 20000522 MetaProducts Offline Explorer Directory Traversal Vulnerability http://www.metaproducts.com/mpOE-HY.html 1231 Buffer overflow in the CyberPatrol daemon "cyberdaemon" used in gauntlet and WebShield allows remote attackers to cause a denial of service or execute arbitrary commands. 20000522 Gauntlet CyberPatrol Buffer Overflow http://www.pgp.com/jump/gauntlet_advisory.asp 1234 http://www.tis.com/support/cyberadvisory.html Buffer overflow in fdmount on Linux systems allows local users in the "floppy" group to execute arbitrary commands via a long mountpoint parameter. 20000522 fdmount buffer overflow 1239 Internet Explorer 4.0 and 5.0 allows a malicious web site to obtain client cookies from another domain by including that domain name and escaped characters in a URL, aka the "Unauthorized Cookie Access" vulnerability. 1194 20000510 IE Domain Confusion Vulnerability 20000511 IE Domain Confusion Vulnerability is an Email problem also MS00-033 ie-cookie-disclosure(4447) NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option. NetBSD-SA2000-002 20000506 [NHC20000504a.0: NetBSD Panics when sent unaligned IP options] 1173 Vulnerability in AIX 3.2.x and 4.x allows local users to gain write access to files on locally or remotely mounted AIX filesystems. ERS-OAR-E01-2000:087.1 1241 Qpopper 2.53 and earlier allows local users to gain privileges via a formatting string in the From: header, which is processed by the euidl command. 20000523 Qpopper 2.53 remote problem, user can gain gid=mail 20000608 pop <= 2000.3.4 1242 The web interface server in HP Web JetAdmin 5.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000524 HP Web JetAdmin Version 5.6 Web interface Server Directory Traversal Vulnerability 1243 HP Web JetAdmin 6.0 allows remote attackers to cause a denial of service via a malformed URL to port 8000. 20000524 HP Web JetAdmin Version 6.0 Remote DoS attack Vulnerability 1246 The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys. 20000523 Key Generation Security Flaw in PGP 5.0 CA-2000-09 1251 Buffer overflow in MDBMS database server allows remote attackers to execute arbitrary commands via a long string. 20000524 Remote xploit for MDBMS 1252 Buffer overflow in WebShield SMTP 4.5.44 allows remote attackers to execute arbitrary commands via a long configuration parameter to the WebShield remote management service. 1254 20000525 DST2K0003 : Buffer Overrun in NAI WebShield SMTP v4.5.44 Managem ent Tool The WebShield SMTP Management Tool version 4.5.44 does not properly restrict access to the management port when an IP address does not resolve to a hostname, which allows remote attackers to access the configuration via the GET_CONFIG command. 1253 20000525 DST2K0003 : Buffer Overrun in NAI WebShield SMTP v4.5.44 Managem ent Tool Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields. 20000525 Omnis Weak Encryption - Many products affected 1255 Vulnerability in bbd server in Big Brother System and Network Monitor allows an attacker to execute arbitrary commands. 20000518 FW: Security Notice: Big Brother System and Network Monitor 1257 The Intel express 8100 ISDN router allows remote attackers to cause a denial of service via oversized or fragmented ICMP packets. 20000518 Remote Dos attack against Intel express 8100 router 1228 Buffer overflow in the ESMTP service of Lotus Domino Server 5.0.1 allows remote attackers to cause a denial of service via a long MAIL FROM command. 20000518 Lotus ESMTP Service (Lotus Domino Release 5.0.1 (Intl)) 1229 XFree86 3.3.x and 4.0 allows a user to cause a denial of service via a negative counter value in a malformed TCP packet that is sent to port 6000. CSSA-2000-012.0 20000518 Nasty XFree Xserver DoS 1235 Buffer overflow in Linux cdrecord allows local users to gain privileges via the dev parameter. 20000527 Mandrake 7.0: /usr/bin/cdrecord gid=80 (strike #2) 20000603 [Gael Duval ] [Security Announce] cdrecord 20000607 Conectiva Linux Security Announcement - cdrecord 1265 Buffer overflow in xlockmore xlock program version 4.16 and earlier allows local users to read sensitive data from memory via a long -mode option. NetBSD-SA2000-003 TLSA2000012-1 20000529 Initialized Data Overflow in Xlock 1267 NetBSD 1.4.2 and earlier allows local users to cause a denial of service by repeatedly running certain system calls in the kernel which do not yield the CPU, aka "cpu-hog". NetBSD-SA2000-005 1272 ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability. 20000511 Alert: IIS ism.dll exposes file contents 1193 MS00-031 iis-ism-file-access(4448) The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information. 20000424 Two Problems in IMP 2 1360 IMP does not remove files properly if the MSWordView application quits, which allows local users to cause a denial of service by filling up the disk space by requesting a large number of documents and prematurely stopping the request. 20000424 Two Problems in IMP 2 1361 Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable. 20000526 KDE: /usr/bin/kdesud, gid = 0 exploit 1274 The undocumented semconfig system call in BSD freezes the state of semaphores, which allows local users to cause a denial of service of the semaphore system by using the semconfig call. FreeBSD-SA-00:19 NetBSD-SA2000-004 20000526 1270 ftpd in NetBSD 1.4.2 does not properly parse entries in /etc/ftpchroot and does not chroot the specified users, which allows those users to access other files outside of their home directory. NetBSD-SA2000-006 1273 BeOS 5.0 allows remote attackers to cause a denial of service via fragmented TCP packets. 20000517 AUX Security Advisory on Be/OS 5.0 (DoS) 1222 Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer overflow in the ActiveX parameter parsing capability, aka the "Malformed Component Attribute" vulnerability. Q261257 1223 MS00-033 Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files via the frame, aka the "Frame Domain Verification" vulnerability. Q251108 Q255676 1224 MS00-033 AIX cdmount allows local users to gain root privileges via shell metacharacters. 1384 20000620 Insecure call of external program in AIX cdmount Buffer overflow in Linux splitvt 1.6.3 and earlier allows local users to gain root privileges via a long password in the screen locking function. 20000614 Splitvt exploit 1346 man in HP-UX 10.20 and 11 allows local attackers to overwrite files via a symlink attack. 1302 20000601 HP Security vulnerability in the man command Selena Sol WebBanner 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 1347 20000613 CGI: Selena Sol's WebBanner ( Random Banner Generator ) Vulnerability 20000620 Re: CGI: Selena Sol's WebBanner ( Random Banner Generator ) Vulnerability Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a malformed authentication request. 20000601 Hardware Exploit - Gets network Down 1290 rompager-malformed-dos(4588) Buffer overflow in ufsrestore in Solaris 8 and earlier allows local users to gain root privileges via a long pathname. 20000614 Vulnerability in Solaris ufsrestore 00210 VU#36866 1348 sol-ufsrestore-bo(4711) Buffer overflow in innd 2.2.2 allows remote attackers to execute arbitrary commands via a cancel request containing a long message ID. CSSA-2000-016.0 20000106 innd 2.2.2 remote buffer overflow 20000707 inn update 20000721 [ANNOUNCE] INN 2.2.3 available 20000722 MDKSA-2000:023 inn update 1316 innd-cancel-overflow(4615) Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker to cause a denial of service via a long GET request for a program in the cgi-bin directory. http://www.analogx.com/contents/download/network/sswww.htm 1349 Real Networks RealServer 7.x allows remote attackers to cause a denial of service via a malformed request for a page in the viewsource directory. 20000601 Remote DoS attack in Real Networks Real Server (Strike #2) Vulnerability 20000601 Remote DoS attack in RealServer: USSR-2000043 1288 realserver-malformed-remote-dos(4587) Windows 2000 allows a local user process to access another user's desktop within the same windows station, aka the "Desktop Separation" vulnerability. 1350 MS00-020 win2k-desktop-separation(4714) xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized. 20000601 [rootshell.com] Xterm DoS Attack 20000601 [rootshell.com] Xterm DoS Attack 1298 Buffer overflow in Norton Antivirus for Exchange (NavExchange) allows remote attackers to cause a denial of service via a .zip file that contains long file names. 20000614 Vulnerabilities in Norton Antivirus for Exchange 1351 antivirus-nav-zip-bo(4710) In some cases, Norton Antivirus for Exchange (NavExchange) enters a "fail-open" state which allows viruses to pass through the server. 20000614 Vulnerabilities in Norton Antivirus for Exchange 1351 antivirus-nav-fail-open(4709) Dragon FTP server allows remote attackers to cause a denial of service via a long USER command. 20000616 Multiples Remotes DoS Attacks in Dragon Server v1.00 and v2.00 1352 Dragon telnet server allows remote attackers to cause a denial of service via a long username. 20000616 Multiples Remotes DoS Attacks in Dragon Server v1.00 and v2.00 1352 Buffer overflow in KDE Kmail allows a remote attacker to cause a denial of service via an attachment with a long file name. 20000601 Kmail heap overflow 1380 kde-kmail-attachment-dos(4993) Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets. 20000605 FW-1 IP Fragmentation Vulnerability http://www.checkpoint.com/techsupport/alerts/list_vun.html#IP_Fragmentation 1312 fw1-packet-fragment-dos(4609) The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization. FreeBSD-SA-00:38 20000615 [Brian@digicool.com: [Zope] Zope security alert and 2.1.7 update [*important*]] 20000728 MDKSA-2000:026 Zope update RHSA-2000:038 1354 2000615 Conectiva Linux Security Announcement - ZOPE http://www.zope.org/Products/Zope/Hotfix_06_16_2000/security_alert zope-dtml-remote-modify(4716) Buffer overflow in Small HTTP Server allows remote attackers to cause a denial of service via a long GET request. 20000616 Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability 20000616 Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability 1355 small-http-get-overflow-dos(4692) Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability. 20000530 Fw: Steal Passwords Using SQL Server EM 1292 MS00-041 mssql-dts-reveal-passwords(4582) Buffer overflow in Cisco TACACS+ tac_plus server allows remote attackers to cause a denial of service via a malformed packet with a long length field. 20000530 An Analysis of the TACACS+ Protocol and its Implementations http://archives.neohapsis.com/archives/bugtraq/2000-05/0370.html 1293 tacacsplus-packet-length-dos(4985) The Protected Store in Windows 2000 does not properly select the strongest encryption when available, which causes it to use a default of 40-bit encryption instead of 56-bit DES encryption, aka the "Protected Store Key Length" vulnerability. 1295 MS00-032 Buffer overflow in ITHouse mail server 1.04 allows remote attackers to execute arbitrary commands via a long RCPT TO mail command. 20000601 DST2K0007: Buffer Overrun in ITHouse Mail Server v1.04 1285 ithouse-rcpt-overflow(4580) FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers. 622 20000601 Local FreeBSD, Openbsd, NetBSD, DoS Vulnerability - Mac OS X affected 19990826 Local DoS in FreeBSD bsd-setsockopt-dos(3298) Buffer overflow in the NetWin DSMTP 2.7q in the NetWin dmail package allows remote attackers to execute arbitrary commands via a long ETRN request. 20000601 Netwin's Dmail package http://netwinsite.com/dmail/security.htm 1297 dmail-etrn-dos(4579) Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request. CSSA-2000-013.0 20000521 "gdm" remote hole 20000607 Conectiva Linux Security Announcement - gdm 20000524 Security hole in gdm <= 2.0beta4-25 1233 1279 1370 PassWD 1.2 uses weak encryption (trivial encoding) to store passwords, which allows an attacker who can read the password file to easliy decrypt the passwords. 20000609 Insecure encryption in PassWD v1.2 1300 Buffer overflow in Simple Network Time Sync (SMTS) daemon allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long string. 20000601 Vulnerability in SNTS 1289 timesync-bo-execute(4602) Veritas Volume Manager creates a world writable .server_pids file, which allows local users to add arbitrary commands into the file, which is then executed by the vmsa_server script. 20000616 Veritas Volume Manager 3.0.x hole http://seer.support.veritas.com/tnotes/volumeman/230053.htm 1356 Microsoft Windows Media Encoder allows remote attackers to cause a denial of service via a malformed request, aka the "Malformed Windows Media Encoder Request" vulnerability. 1282 MS00-038 ms-malformed-media-dos(4585) IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. 20000612 IBM WebSphere JSP showcode vulnerability 1328 http://www-4.ibm.com/software/webservers/appserv/efix.html Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. 20000608 Potential vulnerability in Unify eWave ServletExec 1328 ewave-servletexec-jsp-source-read(4649) The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case. 20000612 BEA WebLogic JSP showcode vulnerability http://developer.bea.com/alerts/security_000612.html 1328 weblogic-jsp-source-read(4694) The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing. 20000621 BEA WebLogic /file/ showcode vulnerability 1378 http://www.weblogic.com/docs51/admindocs/http.html#file weblogic-file-source-read(4775) Race condition in MDaemon 2.8.5.0 POP server allows local users to cause a denial of service by entering a UIDL command and quickly exiting the server. 20000616 mdaemon 2.8.5.0 WinNT and Win9x remote DoS 1366 mdaemon-pass-dos(4745) Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion. 20000607 Mcafee Alerting DOS vulnerability 1326 mcafee-alerting-dos(4641) The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event. 20000606 IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control 1311 libICE in XFree86 allows remote attackers to cause a denial of service by specifying a large value which is not properly checked by the SKIP_STRING macro. 20000619 XFree86: libICE DoS 1369 http://www.xfree86.org/security/ The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters. 1284 20000603 Re: IBM HTTP SERVER / APACHE ibm-http-file-retrieve(4575) The "capabilities" feature in Linux before 2.2.16 allows local users to cause a denial of service or gain privileges by setting the capabilities to prevent a setuid program from dropping privileges, aka the "Linux kernel setuid/setcap vulnerability." 20000802-01-P 20000609 Trustix Security Advisory 20000608 CONECTIVA LINUX SECURITY ANNOUNCEMENT - kernel RHSA-2000:037 1322 20000609 Sendmail & procmail local root exploits on Linux kernel up to 2.2.16pre5 Imate Webmail Server 2.5 allows remote attackers to cause a denial of service via a long HELO command. 20000601 DST2K0006: Denial of Service Possibility in Imate WebMail Server 1286 nt-webmail-dos(4586) rpc.lockd in Red Hat Linux 6.1 and 6.2 allows remote attackers to cause a denial of service via a malformed request. 20000608 Remote DOS in linux rpc.lockd 1372 linux-lockd-remote-dos(5050) Buffer overflows in the finger and whois demonstration scripts in Sambar Server 4.3 allow remote attackers to execute arbitrary commands via a long hostname. 20000601 DST2K0008: Buffer Overrun in Sambar Server 4.3 1287 CUPS (Common Unix Printing System) 1.04 and earlier allows remote attackers to cause a denial of service via a malformed IPP request. ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch 20000620 CUPS DoS Bugs 1373 debian-cups-malformed-ipp(4846) CUPS (Common Unix Printing System) 1.04 and earlier allows remote attackers to cause a denial of service via a CGI POST request. ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch 20000620 CUPS DoS Bugs 1373 debian-cups-posts(4846) CUPS (Common Unix Printing System) 1.04 and earlier does not properly delete request files, which allows a remote attacker to cause a denial of service. ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch 20000620 CUPS DoS Bugs 1373 debian-cups-posts(4846) CUPS (Common Unix Printing System) 1.04 and earlier allows remote attackers to cause a denial of service by authenticating with a user name that does not exist or does not have a shadow password. ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch 20000620 CUPS DoS Bugs 1373 debian-cups-posts(4846) GSSFTP FTP daemon in Kerberos 5 1.1.x does not properly restrict access to some FTP commands, which allows remote attackers to cause a denial of service, and local users to gain root privileges. http://web.mit.edu/kerberos/www/advisories/ftp.txt 1374 20000614 Security Advisory: REMOTE ROOT VULNERABILITY IN GSSFTP DAEMON kerberos-gssftpd-dos(4734) The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges. 1327 20000607 [ Hackerslab bug_paper ] HP-UX SNMP daemon vulnerability 20000608 Re: HP-UX SNMP daemon vulnerability hpux-snmp-daemon(4643) When configured to store configuration information in an LDAP directory, Shiva Access Manager 5.0.0 stores the root DN (Distinguished Name) name and password in cleartext in a file that is world readable, which allows local users to compromise the LDAP server. 20000606 Shiva Access Manager 5.0.0 Plaintext LDAP root password. 1329 shiva-plaintext-ldap-password(4612) Netscape 4.73 and earlier does not properly warn users about a potentially invalid certificate if the user has previously accepted the certificate for a different web site, which could allow remote attackers to spoof a legitimate web site by compromising that site's DNS information. CA-2000-08 1260 netscape-ssl-certificate(4550) Internet Explorer 4.x and 5.x does not properly verify all contents of an SSL certificate if a connection is made to the server via an image or a frame, aka one of two different "SSL Certificate Validation" vulnerabilities. http://www.acrossecurity.com/aspr/ASPR-1999-12-15-1-PUB.txt CA-2000-10 1309 MS00-039 ie-invalid-frame-image-certificate(4624) Internet Explorer 4.x and 5.x does not properly re-validate an SSL certificate if the user establishes a new SSL session with the same server during the same Internet Explorer session, aka one of two different "SSL Certificate Validation" vulnerabilities. http://www.acrossecurity.com/aspr/ASPR-1999-12-15-1-PUB.txt CA-2000-10 1309 MS00-039 ie-revalidate-certificate(4627) Buffer overflow in restore program 0.4b17 and earlier in dump package allows local users to execute arbitrary commands via a long tape name. http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=11880 20000630 CONECTIVA LINUX SECURITY ANNOUNCEMENT - dump 1330 Savant web server allows remote attackers to read source code of CGI scripts via a GET request that does not include the HTTP version number. 20000605 MDMA Advisory #5: Reading of CGI Scripts under Savant Webserver 1313 savant-source-read(4616) RSA ACE/Server allows remote attackers to cause a denial of service by flooding the server's authentication request port with UDP packets, which causes the server to crash. ftp://ftp.securid.com/support/outgoing/dos/readme.txt 20000714 Re: RSA Aceserver UDP Flood Vulnerability 1332 20000608 Potential DoS Attack on RSA's ACE/Server aceserver-udp-packet-dos(5053) Buffer overflow in the logging feature of EServ 2.9.2 and earlier allows an attacker to execute arbitrary commands via a long MKD command. 20000606 MDMA Advisory #6: EServ Logging Heap Overflow Vulnerability 1315 eserv-logging-overflow(4614) Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From. 20000604 Microsoft Outlook (Express) bug.. 1333 OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon. 20000609 OpenSSH's UseLogin option allows remote access with root privilege. 20000606 The non-default UseLogin feature in /etc/sshd_config is broken and should not be used. 1334 openssh-uselogin-remote-exec(4646) mailview.cgi CGI program in MailStudio 2000 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000609 Mailstudio2000 CGI Vulnerabilities [S0ftPj.4] 1335 userreg.cgi CGI program in MailStudio 2000 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters. 20000609 Mailstudio2000 CGI Vulnerabilities [S0ftPj.4] 1335 Net Tools PKI Server does not properly restrict access to remote attackers when the XUDA template files do not contain absolute pathnames for other files. ftp://ftp.tis.com/gauntlet/hide/pki/hotfix.txt 20000619 Net Tools PKI server exploits 1364 nettools-pki-unauthenticated-access(4743) Net Tools PKI Server allows remote attackers to cause a denial of service via a long HTTP request. ftp://ftp.tis.com/gauntlet/hide/pki/hotfix.txt 20000619 Net Tools PKI server exploits 1363 nettools-pki-http-bo(4744) The KApplication class in the KDE 1.1.2 configuration file management capability allows local users to overwrite arbitrary files. CSSA-2000-015.0 20000531 KDE::KApplication feature? RHSA-2000:032 1291 kde-configuration-file-creation(4583) Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets. 20000728 MDKSA:2000-025 gpm update RHSA-2000:045 1377 20000620 Bug in gpm linux-gpm-gpmctl-dos(5010) A FreeBSD patch for SSH on 2000-01-14 configures ssh to listen on port 722 as well as port 22, which might allow remote attackers to access SSH through port 722 even if port 22 is otherwise filtered. FreeBSD-SA-00:21 1323 freebsd-ssh-ports(4638) Vulnerability in cvconnect in SGI IRIX WorkShop allows local users to overwrite arbitrary files. 20000601-01-P 1379 irix-workshop-cvconnect-overwrite(4725) The apsfilter software in the FreeBSD ports package does not properly read user filter configurations, which allows local users to execute commands as the lpd user. 1325 apsfilter-elevate-privileges(4617) OpenSSL 0.9.4 and OpenSSH for FreeBSD do not properly check for the existence of the /dev/random or /dev/urandom devices, which are absent on FreeBSD Alpha systems, which causes them to produce weak keys which may be more easily broken. FreeBSD-SA-00:25 1340 xinetd 2.1.8.x does not properly restrict connections if hostnames are used for access control and the connecting host does not have a reverse DNS entry. 20000619 xinetd: bug in access control mechanism 1381 http://www.synack.net/xinetd/ xinetd-improper-restrictions(4986) BRU backup software allows local users to append data to arbitrary files by specifying an alternate configuration file with the BRUEXECLOG environmental variable. 20000606 BRU Vulnerability CSSA-2000-018.0 1321 bru-execlog-env-variable(4644) ColdFusion Administrator for ColdFusion 4.5.1 and earlier allows remote attackers to cause a denial of service via a long login password. 20000607 New Allaire ColdFusion DoS ASB00-14 1314 coldfusion-parse-dos(4611) Servlet examples in Allaire JRun 2.3.x allow remote attackers to obtain sensitive information, e.g. listing HttpSession ID's via the SessionServlet servlet. ASB00-015 1386 jrun-read-sample-files(4774) JSP sample files in Allaire JRun 2.3.x allow remote attackers to access arbitrary files (e.g. via viewsource.jsp) or obtain configuration information. ASB00-015 1386 jrun-read-sample-files(4774) The Panda Antivirus console on port 2001 allows local users to execute arbitrary commands without authentication via the CMD command. 20000617 Infosec.20000617.panda.a 1359 panda-antivirus-remote-admin(4707) Tigris remote access server before 11.5.4.22 does not properly record Radius accounting information when a user fails the initial login authentication but subsequently succeeds. 20000612 ACC/Ericsson Tigris Accounting Failure 1345 tigris-radius-login-failure(4705) The command port for PGP Certificate Server 2.5.0 and 2.5.1 allows remote attackers to cause a denial of service if their hostname does not have a reverse DNS entry and they connect to port 4000. 20000614 Remote DoS attack in Networks Associates PGP Certificate Server Version 2.5 Vulnerability 1343 pgp-cert-server-dos(4695) Windows NT and Windows 2000 hosts allow a remote attacker to cause a denial of service via malformed DCE/RPC SMBwriteX requests that contain an invalid data length. 20000604 anonymous SMBwriteX DoS 1304 Buffer overflow in mailx mail command (aka Mail) on Linux systems allows local users to gain privileges via a long -c (carbon copy) parameter. 20000602 /usr/bin/Mail exploit for Slackware 7.0 (mail-slack.c) 20000605 mailx: mail group exploit in mailx 1305 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the lastrealm variable in the set_tgtkey function. 20000609 Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC K-051 http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt CA-2000-11 1338 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the localrealm variable in the process_v4 function. 20000609 Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC K-051 http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt CA-2000-11 1338 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the e_msg variable in the kerb_err_reply function. 20000609 Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC K-051 http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt CA-2000-11 RHSA-2000:031 Kerberos 4 KDC program does not properly check for null termination of AUTH_MSG_KDC_REQUEST requests, which allows remote attackers to cause a denial of service via a malformed request. 20000609 Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC K-051 http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt CA-2000-11 RHSA-2000:031 Kerberos 4 KDC program improperly frees memory twice (aka "double-free"), which allows remote attackers to cause a denial of service. 20000609 Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC K-051 http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt CA-2000-11 RHSA-2000:031 1465 The file transfer mechanism in Danware NetOp 6.0 does not provide authentication, which allows remote attackers to access and modify arbitrary files. 20000523 I think 1263 danware-netop-bypass-security(4569) ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information. 20000606 ICQ2000A ICQmail temparary internet link vulnearbility 1307 icq-temp-link(4607) Race condition in IPFilter firewall 3.4.3 and earlier, when configured with overlapping "return-rst" and "keep state" rules, allows remote attackers to bypass access restrictions. 20000525 Security Vulnerability in IPFilter 3.3.15 and 3.4.3 1308 ipfilter-firewall-race-condition(4994) Ceilidh allows remote attackers to obtain the real path of the Ceilidh directory via the translated_path hidden form field. 20000608 DST2K0010: DoS & Path Revealing Vulnerability in Ceilidh v2.60a 1320 Ceilidh allows remote attackers to cause a denial of service via a large number of POST requests. 20000608 DST2K0010: DoS & Path Revealing Vulnerability in Ceilidh v2.60a 1320 ceilidh-post-dos(4622) Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog running on port 8002. 20000608 DST2K0011: DoS & BufferOverrun in CMail v2.4.7 WebMail http://www.computalynx.net/news/Jun2000/news0806200001.html 1319 cmail-long-username-dos(4625) Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to execute arbitrary commands via a long GET request. 20000608 DST2K0011: DoS & BufferOverrun in CMail v2.4.7 WebMail 1318 cmail-get-overflow-execute(4626) Buffer overflow in HP Openview Network Node Manager 6.1 allows remote attackers to execute arbitrary commands via the Alarm service (OVALARMSRV) on port 2345. 20000608 DST2K0012: BufferOverrun in HP Openview Network Node Manager v6.1 1317 eTrust Intrusion Detection System (formerly SessionWall-3) uses weak encryption (XOR) to store administrative passwords in the registry, which allows local users to easily decrypt the passwords. 1341 20000607 SessionWall-3 Paper + (links to) code Buffer overflow in WebBBS 1.15 allows remote attackers to execute arbitrary commands via a long HTTP GET request. 20000620 DST2K0018: Multiple BufferOverruns in WebBBS HTTP Server v1.15 1365 webbbs-get-request-overflow(4742) BlackIce Defender 2.1 and earlier, and BlackIce Pro 2.0.23 and earlier, do not properly block Back Orifice traffic when the security setting is Nervous or lower. 20000620 BlackICE by Network ICE Corp vulnerability against Back Orifice 1.2 The URLConnection function in MacOS Runtime Java (MRJ) 2.1 and earlier and the Microsoft virtual machine (VM) for MacOS allows a malicious web site operator to connect to arbitrary hosts using a HTTP redirection, in violation of the Java security model. 20000609 Security Holes Found in URLConnection of MRJ and IE of Mac OS (was Re: Reappearance of an old IE security bug) 1336 20000513 Re: Reappearance of an old IE security bug The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long name parameter. 20000529 ICQ Web Front Remote DoS Attack Vulnerability SmartFTP Daemon 0.2 allows a local user to access arbitrary files by uploading and specifying an alternate user configuration file via a .. (dot dot) attack. 20000613 SmartFTP Daemon v0.2 Beta Build 9 - Remote Exploit 1344 smartftp-directory-traversal(4706) makewhatis in Linux man package allows local users to overwrite files via a symlink attack. CSSA-2000-021.0 20000727 CONECTIVA LINUX SECURITY ANNOUNCEMENT - MAN MDKSA-2000:015 RHSA-2000:041 1434 linux-man-makewhatis-tmp(4900) Buffer overflow in Microsoft Outlook and Outlook Express allows remote attackers to execute arbitrary commands via a long Date field in an email header, aka the "Malformed E-mail Header" vulnerability. 1481 MS00-043 outlook-date-overflow(4953) Sybergen Secure Desktop 2.1 does not properly protect against false router advertisements (ICMP type 9), which allows remote attackers to modify default routes. 1417 20000630 Multiple vulnerabilities in Sybergen Secure Desktop Sybergen Sygate allows remote attackers to cause a denial of service by sending a malformed DNS UDP packet to its internal interface. 20000630 Any LAN user can crash Sygate 1420 sygate-udp-packet-dos(5049) FirstClass Internet Services server 5.770, and other versions before 6.1, allows remote attackers to cause a denial of service by sending an email with a long To: mail header. 20000627 DoS in FirstClass Internet Services 5.770 1421 firstclass-large-bcc-dos(4843) LocalWEB HTTP server 1.2.0 allows remote attackers to cause a denial of service via a long GET request. 1423 20000703 Remote DoS Attack in LocalWEB HTTP Server 1.2.0 Vulnerability localweb-get-bo(4896) The Razor configuration management tool uses weak encryption for its password file, which allows local users to gain privileges. 1424 20000704 Recovering Passwords in Visible Systems' Razor The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command. AA-2000.02 FreeBSD-SA-00:29 NetBSD-SA2000-009 20000723 CONECTIVA LINUX SECURITY ANNOUNCEMENT - WU-FTPD (re-release) 20000702 [Security Announce] wu-ftpd update 20000622 WuFTPD: Providing *remote* root since at least1994 20000623 WUFTPD 2.6.0 remote root exploit 20000707 New Released Version of the WuFTPD Sploit CSSA-2000-020.0 CA-2000-13 RHSA-2000:039 1387 20000623 ftpd: the advisory version wuftp-format-string-stack-overwrite(4773) FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands. NetBSD-SA2000-009 20000705 proftp advisory 20000706 ftpd and setproctitle() 20000710 opieftpd setproctitle() patches CA-2000-13 1425 1438 SSH 1.2.27 with Kerberos authentication support stores Kerberos tickets in a file which is created in the current directory of the user who is logging in, which could allow remote attackers to sniff the ticket cache if the home directory is installed on NFS. 20000630 Kerberos security vulnerability in SSH-1.2.27 1426 ssh-kerberos-tickets-disclosure(4903) Oracle Web Listener for AIX versions 4.0.7.0.0 and 4.0.8.1.0 allows remote attackers to cause a denial of service via a malformed URL. 20000704 Oracle Web Listener for AIX DoS 1427 Netscape Professional Services FTP Server 1.3.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000629 (forw) Re: Netscape ftp Server (fwd) 1411 20000621 Netscape FTP Server - "Professional" as hell :> SGI MIPSPro compilers C, C++, F77 and F90 generate temporary files in /tmp with predictable file names, which could allow local users to insert malicious contents into these files as they are being compiled by another user. 20000621 Predictability Problems in IRIX Cron and Compilers 1412 IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited. 20000621 Predictability Problems in IRIX Cron and Compilers 1413 Windows 2000 Server allows remote attackers to cause a denial of service by sending a continuous stream of binary zeros to various TCP and UDP ports, which significantly increases the CPU utilization. 1415 20000630 SecureXpert Advisory [SX-20000620-2] Windows 2000 Telnet Server allows remote attackers to cause a denial of service by sending a continuous stream of binary zeros, which causes the server to crash. 1414 20000630 SecureXpert Advisory [SX-20000620-1] Check Point FireWall-1 4.0 and 4.1 allows remote attackers to cause a denial of service by sending a stream of invalid commands (such as binary zeros) to the SMTP Security Server proxy. http://www.checkpoint.com/techsupport/alerts/list_vun.html#SMTP_Security 1416 20000630 SecureXpert Advisory [SX-20000620-3] vchkpw program in vpopmail before version 4.8 does not properly cleanse an untrusted format string used in a call to syslog, which allows remote attackers to cause a denial of service via a USER or PASS command that contains arbitrary formatting directives. 1418 20000626 vpopmail-3.4.11 problems http://www.vpopmail.cx/vpopmail-ChangeLog Buffer overflow in Canna input system allows remote attackers to execute arbitrary commands via an SR_INIT command with a long user name or group name. FreeBSD-SA-00:31 http://shadowpenguin.backsection.net/advisories/advisory038.html 1445 canna-bin-execute-bo(4912) ISC DHCP client program dhclient allows remote attackers to execute arbitrary commands via shell metacharacters. FreeBSD-SA-00:34 NetBSD-SA2000-008 20000624 Possible root exploit in ISC DHCP client. 20000702 [Security Announce] dhcp update 20000628 dhcp client: remote root exploit in dhcp client 20000711 Security Hole in dhclient < 2.0 1388 openbsd-isc-dhcp(4772) Buffer overflow in Dalnet IRC server 4.6.5 allows remote attackers to cause a denial of service or execute arbitrary commands via the SUMMON command. 20000628 dalnet 4.6.5 remote vulnerability 1404 The privpath directive in glftpd 1.18 allows remote attackers to bypass access restrictions for directories by using the file name completion capability. 20000627 Re: Glftpd privpath bugs... +fix 1401 20000626 Glftpd privpath bugs... +fix SawMill 5.0.21 CGI program allows remote attackers to read the first line of arbitrary files by listing the file in the rfcf parameter, whose contents SawMill attempts to parse as configuration commands. 20000626 sawmill5.0.21 old path bug & weak hash algorithm 20000706 Patch for Flowerfire Sawmill Vulnerabilities Available 1402 SawMill 5.0.21 uses weak encryption to store passwords, which allows attackers to easily decrypt the password and modify the SawMill configuration. 20000626 sawmill5.0.21 old path bug & weak hash algorithm 20000706 Patch for Flowerfire Sawmill Vulnerabilities Available 1403 Poll It 2.0 CGI script allows remote attackers to read arbitrary files by specifying the file name in the data_dir parameter. 20000706 Vulnerability in Poll_It cgi v2.0 1431 http-cgi-pollit-variable-overwrite(4878) Novell BorderManager 3.0 and 3.5 allows remote attackers to bypass URL filtering by encoding characters in the requested URL. 20000705 Novell BorderManager 3.0 EE - Encoded URL rule bypass 1432 Buffer overflows in POP3 service in WinProxy 2.0 and 2.0.1 allow remote attackers to execute arbitrary commands via long USER, PASS, LIST, RETR, or DELE commands. 1400 20000627 [SPSadvisory #37]WinProxy 2.0.0/2.0.1 DoS and Exploitable Buffer Overflow WinProxy 2.0 and 2.0.1 allows remote attackers to cause a denial of service by sending an HTTP GET request without listing an HTTP version number. 1400 20000627 [SPSadvisory #37]WinProxy 2.0.0/2.0.1 DoS and Exploitable Buffer Overflow winproxy-get-dos(4831) BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause a denial of service via an invite to a channel whose name includes special formatting characters. 20000704 BitchX exploit possibly waiting to happen, certain DoS 20000707 CONECTIVA LINUX SECURITY ANNOUNCEMENT - BitchX 20000707 BitchX update FreeBSD-SA-00:32 20000704 BitchX /ignore bug CSSA-2000-022.0 RHSA-2000:042 1436 irc-bitchx-invite-dos(4897) libedit searches for the .editrc file in the current directory instead of the user's home directory, which may allow local users to execute arbitrary commands by installing a modified .editrc in another directory. FreeBSD-SA-00:24 1437 Internet Explorer 5.x does not warn a user before opening a Microsoft Access database file that is referenced within ActiveX OBJECT tags in an HTML document, which could allow remote attackers to execute arbitrary commands, aka the "IE Script" vulnerability. CA-2000-16 1398 20000627 FW: IE 5 and Access 2000 vulnerability - executing programs 20000627 IE 5 and Access 2000 vulnerability - executing programs MS00-049 Microsoft Office 2000 (Excel and PowerPoint) and PowerPoint 97 are marked as safe for scripting, which allows remote attackers to force Internet Explorer or some email clients to save files to arbitrary locations via the Visual Basic for Applications (VBA) SaveAs function, aka the "Office HTML Script" vulnerability. 1399 20000627 IE 5 and Excel 2000, PowerPoint 2000 vulnerability - executing programs MS00-049 Fortech Proxy+ allows remote attackers to bypass access restrictions for to the administration service by redirecting their connections through the telnet proxy. 20000626 Proxy+ Telnet Gateway Problems http://www.proxyplus.cz/faq/articles/EN/art01002.htm 1395 Buffer overflow in iMesh 1.02 allows remote attackers to execute arbitrary commands via a long string to the iMesh port. 20000629 iMesh 1.02 vulnerability http://www.imesh.com/download/download.html 1407 Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed URL. 20000626 Netscape Enterprise Server for NetWare Virtual Directory Vulnerab ility 1393 netscape-virtual-directory-bo(4780) LeafChat 1.7 IRC client allows a remote IRC server to cause a denial of service by rapidly sending a large amount of error messages. http://www.leafdigital.com/Software/leafChat/history.html 1396 20000625 LeafChat Denial of Service Secure Locate (slocate) in Red Hat Linux allows local users to gain privileges via a malformed configuration file that is specified in the LOCATE_PATH environmental variable. 1385 20000621 rh 6.2 - gid compromises, etc Microsoft SQL Server 7.0 allows a local user to bypass permissions for stored procedures by referencing them via a temporary stored procedure, aka the "Stored Procedure Permissions" vulnerability. 1444 MS00-048 mssql-procedure-perms(4921) gkermit in Red Hat Linux is improperly installed with setgid uucp, which allows local users to modify files owned by uucp. 1383 20000621 rh 6.2 - gid compromises, etc Blackboard CourseInfo 4.0 stores the local and SQL administrator user names and passwords in cleartext in a registry key whose access control allows users to access the passwords. 20000710 Two issues: Blackboard CourseInfo 4.0 stores admin password in clear text; strange settings on the winreg key. 1460 Buffer overflow in kon program in Kanji on Console (KON) package on Linux may allow local users to gain root privileges via a long -StartupMessage parameter. 1371 20000619 Problems with "kon2" package Buffer overflow in fld program in Kanji on Console (KON) package on Linux may allow local users to gain root privileges via an input file containing long CHARSET_REGISTRY or CHARSET_ENCODING settings. 1371 20000619 Problems with "kon2" package NetWin dMailWeb and cwMail 2.6i and earlier allows remote attackers to cause a denial of service via a long POP parameter (pophost). 1376 20000620 NetWin dMailWeb Denial of Service NetWin dMailWeb and cwMail 2.6g and earlier allows remote attackers to cause a denial of service via a long username parameter. 1376 20000620 NetWin dMailWeb Denial of Service NetWin dMailWeb and cwMail 2.6g and earlier allows remote attackers to bypass authentication and use the server for mail relay via a username that contains a carriage return. 20000623 NetWin dMailWeb Unrestricted Mail Relay 1390 netwin-dmailweb-newline(4770) The default configuration of NetWin dMailWeb and cwMail trusts all POP servers, which allows attackers to bypass normal authentication and cause a denial of service. 20000623 NetWin dMailWeb Unrestricted Mail Relay 1391 netwin-dmailweb-auth(4771) Windows 95 and Windows 98 do not properly process spoofed ARP packets, which allows remote attackers to overwrite static entries in the cache table. 1406 20000629 Buggy ARP handling in Windoze Cisco Secure PIX Firewall does not properly identify forged TCP Reset (RST) packets, which allows remote attackers to force the firewall to close legitimate connections. 20000711 Cisco Secure PIX Firewall TCP Reset Vulnerability 1454 20000320 PIX DMZ Denial of Service - TCP Resets cisco-pix-firewall-tcp(4928) Tnef program in Linux systems allows remote attackers to overwrite arbitrary files via TNEF encoded compressed attachments which specify absolute path names for the decompressed output. 20000710 Security Hole in tnef < 0-124 1450 LPRng 3.6.x improperly installs lpd as setuid root, which can allow local users to append lpd trace and logging messages to files. 20000709 LPRng lpd should not be SETUID root 1447 lpd-suid-root(7361) Vulnerability in HP TurboIMAGE DBUTIL allows local users to gain additional privileges via DBUTIL.PUB.SYS. HPSBMP0006-007 1405 Buffer overflow in xconq and cconq game programs on Red Hat Linux allows local users to gain additional privileges via long USER environmental variable. 20000622 RHL 6.2 xconq package - overflows yield gid games Buffer overflow in xconq and cconq game programs on Red Hat Linux allows local users to gain additional privileges via long DISPLAY environmental variable. 20000622 RHL 6.2 xconq package - overflows yield gid games Top Layer AppSwitch 2500 allows remote attackers to cause a denial of service via malformed ICMP packets. 20000520 TopLayer layer 7 switch Advisory 20000614 Update on TopLayer Advisory 1258 toplayer-icmp-dos(7364) libX11 X library allows remote attackers to cause a denial of service via a resource mask of 0, which causes libX11 to go into an infinite loop. 20000619 XFree86: Various nasty libX11 holes 1409 libx11-infinite-loop-dos(4996) Microsoft Outlook 98 and 2000, and Outlook Express 4.0x and 5.0x, allow remote attackers to read files on the client's system via a malformed HTML message that stores files outside of the cache, aka the "Cache Bypass" vulnerability. CA-2000-14 1501 MS00-046 outlook-cache-bypass(5013) Buffer overflow in Webfind CGI program in O'Reilly WebSite Professional web server 2.x allows remote attackers to execute arbitrary commands via a URL containing a long "keywords" parameter. http://website.oreilly.com/support/software/wspro25_releasenotes.txt 20000719 O'Reilly WebSite Professional Overflow 1487 website-webfind-bo(4962) Buffer overflow in O'Reilly WebSite Professional web server 2.4 and earlier allows remote attackers to execute arbitrary commands via a long GET request or Referrer header. 20000719 Alert: Buffer Overrun is O'Reilly WebsitePro httpd32.exe (CISADV000717) 1492 Buffer overflow in Winamp 2.64 and earlier allows remote attackers to execute arbitrary commands via a long #EXTINF: extension in the M3U playlist. 20000720 Winamp M3U playlist parser buffer overflow security vulnerability 1496 http://www.winamp.com/getwinamp/newfeatures.jhtml winamp-playlist-parser-bo(4956) NetZero 3.0 and earlier uses weak encryption for storing a user's login information, which allows a local user to decrypt the password. 20000718 NetZero Password Encryption Algorithm 1483 Buffer overflow in Alibaba web server allows remote attackers to cause a denial of service via a long GET request. 20000718 Multiple bugs in Alibaba 2.0 1482 BlackBoard CourseInfo 4.0 does not properly authenticate users, which allows local users to modify CourseInfo database information and gain privileges by directly calling the supporting CGI programs such as user_update_passwd.pl and user_update_admin.pl. 20000718 Blackboard Courseinfo v4.0 User Authentication 1486 20000719 Security Fix for Blackboard CourseInfo 4.0 blackboard-courseinfo-dbase-modification(4946) The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files. 20000710 ANNOUNCE Apache::ASP v1.95 - Security Hole Fixed http://www.nodeworks.com/asp/changes.html 1457 apache-source-asp-file-write(4931) The default configuration of the Sun Java web server 2.0 and earlier allows remote attackers to execute arbitrary commands by uploading Java code to the server via board.html, then directly calling the JSP compiler servlet. 20000711 Sun's Java Web Server remote command execution vulnerability 1459 http://www.sun.com/software/jwebserver/faq/jwsca-2000-02.html IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability. 1488 MS00-044 iis-htr-obtain-code(5104) An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular argument, aka the "Absent Directory Browser Argument" vulnerability. 20000718 ISBASE Security Advisory(SA2000-02) 1476 MS00-044 iis-absent-directory-dos(4951) Buffer overflow in the web archive component of L-Soft Listserv 1.8d and earlier allows remote attackers to execute arbitrary commands via a long query string. http://www.lsoft.com/news/default.asp?item=Advisory1 20000717 [COVERT-2000-07] LISTSERV Web Archive Remote Overflow 1490 lsoft-listserv-querystring-bo(4952) Vulnerability in Mandrake Linux usermode package allows local users to to reboot or halt the system. 20000718 MDKSA-2000:020 usermode update 20000812 Conectiva Linux security announcement - usermode RHSA-2000:053 1489 linux-usermode-dos(4944) The web administration interface for CommuniGate Pro 3.2.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000717 S21SEC-003: Vulnerabilities in CommuniGate Pro v3.2.4 1493 communigate-pro-file-read(5105) The view_page.html sample page in the MiniVend shopping cart program allows remote attackers to execute arbitrary commands via shell metacharacters. 20000711 Akopia MiniVend Piped Command Execution Vulnerability 1449 http://www.zdnet.com/zdnn/stories/news/0,4586,2600258,00.html minivend-viewpage-sample(4880) HP JetDirect printers versions G.08.20 and H.08.20 and earlier allow remote attackers to cause a denial of service via a malformed FTP quote command. 20000719 HP Jetdirect - Invalid FTP Command DoS 1491 hp-jetdirect-quote-dos(4947) Microsoft Excel 97 and 2000 allows an attacker to execute arbitrary commands by specifying a malicious .dll using the Register.ID function, aka the "Excel REGISTER.ID Function" vulnerability. 1451 20000711 Excel 2000 vulnerability - executing programs MS00-051 excel-register-function(5016) bb-hostsvc.sh in Big Brother 1.4h1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack on the HOSTSVC parameter. 20000711 BIG BROTHER EXPLOIT 20000711 REMOTE EXPLOIT IN ALL CURRENT VERSIONS OF BIG BROTHER http://bb4.com/README.CHANGES 1455 http-cgi-bigbrother-bbhostsvc(4879) The default configuration of Big Brother 1.4h2 and earlier does not include proper access restrictions, which allows remote attackers to execute arbitrary commands by using bbd to upload a file whose extension will cause it to be executed as a CGI script by the web server. 20000711 Big Brother filename extension vulnerability 1494 big-brother-filename-extension(5103) Guild FTPd allows remote attackers to determine the existence of files outside the FTP root via a .. (dot dot) attack, which provides different error messages depending on whether the file exists or not. 20000708 gnu-pop3d (FTGate problem), Savant Webserver, Guild FTPd 1452 guild-ftpd-disclosure(4922) Savant web server allows remote attackers to execute arbitrary commands via a long GET request. 20000708 gnu-pop3d (FTGate problem), Savant Webserver, Guild FTPd 1453 savant-get-bo(4901) The default configuration of WebActive HTTP Server 1.00 stores the web access log active.log in the document root, which allows remote attackers to view the logs by directly requesting the page. 1497 20000711 Lame DoS in WEBactive win65/NT server webactive-active-log(5184) Buffer overflow in WebActive HTTP Server 1.00 allows remote attackers to cause a denial of service via a long URL. 1470 20000711 Lame DoS in WEBactive win65/NT server webactive-long-get-dos(4949) WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by executing a STAT command while the LIST command is still executing. 20000721 WFTPD/WFTPD Pro 2.41 RC11 vulnerabilities. 1506 wftpd-stat-dos(5003) WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by using the RESTART (REST) command and writing beyond the end of a file, or writing to a file that does not exist, via commands such as STORE UNIQUE (STOU), STORE (STOR), or APPEND (APPE). 20000721 WFTPD/WFTPD Pro 2.41 RC11 vulnerabilities. 1506 WFTPD and WFTPD Pro 2.41 allows remote attackers to obtain the real pathname for a file by executing a STATUS (STAT) command while the file is being transferred. 20000721 WFTPD/WFTPD Pro 2.41 RC11 vulnerabilities. 1506 WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by executing an MLST command before logging into the server. 20000721 WFTPD/WFTPD Pro 2.41 RC11 vulnerabilities. 1506 WFTPD and WFTPD Pro 2.41 allows local users to cause a denial of service by executing the RENAME TO (RNTO) command before a RENAME FROM (RNFR) command. 1456 20000711 WFTPD/WFTPD Pro 2.41 RC10 denial-of-service IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined. 20000713 IIS4 Basic authentication realm issue 1499 The default installation of VirusScan 4.5 and NetShield 4.5 has insecure permissions for the registry key that identifies the AutoUpgrade directory, which allows local users to execute arbitrary commands by replacing SETUP.EXE in that directory with a Trojan Horse. 20000711 Potential Vulnerability in McAfee Netshield and VirusScan 4.5 1458 nai-virusscan-netshield-autoupgrade(5177) The ClientTrust program in Novell BorderManager does not properly verify the origin of authentication requests, which could allow remote attackers to impersonate another user by replaying the authentication requests and responses from port 3024 of the victim's machine. 1440 20000707 Novell Border Manger - Anyone can pose as an authenticated user novell-bordermanager-verification(5186) IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string. 20000723 IBM WebSphere default servlet handler showcode vulnerability 1500 websphere-showcode(5012) Microsoft Outlook Express allows remote attackers to monitor a user's email by creating a persistent browser link to the Outlook Express windows, aka the "Persistent Mail-Browser Link" vulnerability. 1502 MS00-045 Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability. 1466 MS00-041 mssql-dts-reveal-passwords(4582) Netscape Communicator 4.73 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment with an illegal field length of 1. FreeBSD-SA-00:39 NetBSD-SA2000-011 20000801 MDKSA-2000:027-1 netscape update 20000810 Conectiva Linux Security Announcement - netscape 20000823 Security Hole in Netscape, Versions 4.x, possibly others RHSA-2000:046 1503 20000724 JPEG COM Marker Processing Vulnerability in Netscape Browsers TLSA2000017-1 Buffer overflow in AnalogX proxy server 4.04 and earlier allows remote attackers to cause a denial of service via a long USER command in the FTP protocol. 20000724 AnalogX Proxy DoS http://www.analogx.com/contents/download/network/proxy.htm 1504 Buffer overflow in AnalogX proxy server 4.04 and earlier allows remote attackers to cause a denial of service via a long HELO command in the SMTP protocol. 20000724 AnalogX Proxy DoS http://www.analogx.com/contents/download/network/proxy.htm 1504 Buffer overflow in AnalogX proxy server 4.04 and earlier allows remote attackers to cause a denial of service via a long USER command in the POP3 protocol. 20000724 AnalogX Proxy DoS http://www.analogx.com/contents/download/network/proxy.htm 1504 Buffer overflow in AnalogX proxy server 4.04 and earlier allows remote attackers to cause a denial of service via a long user ID in a SOCKS4 CONNECT request. 20000724 AnalogX Proxy DoS 1504 The WDaemon web server for WorldClient 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000712 Infosec.20000712.worldclient.2.1 http://www.altn.com/Downloads/WorldClient/Release/RelNotes.txt 1462 worldclient-dir-traverse(4913) WircSrv IRC Server 5.07s allows remote attackers to cause a denial of service via a long string to the server port. 20000710 Remote DoS Attack in WircSrv Irc Server v5.07s Vulnerability 1448 wircsrv-character-flood-dos(4914) Internet Explorer 5.x and Microsoft Outlook allows remote attackers to read arbitrary files by redirecting the contents of an IFRAME using the DHTML Edit Control (DHTMLED). 1474 20000714 IE 5.5 and 5.01 vulnerability - reading at least local and from any host text and parsed html files ie-dhtmled-file-read(5107) The registry entry for the Windows Shell executable (Explorer.exe) in Windows NT and Windows 2000 uses a relative path name, which allows local users to execute arbitrary commands by inserting a Trojan Horse named Explorer.exe into the %Systemdrive% directory, aka the "Relative Shell Path" vulnerability. Q269049 1507 MS00-052 explorer-relative-path-name(5040) AnalogX SimpleServer:WWW 1.06 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack that uses the %2E URL encoding for the dots. 20000726 AnalogX "SimpleServer:WWW" dot dot bug http://www.analogx.com/contents/download/network/sswww.htm 1508 analogx-simpleserver-directory-path(4999) GAMSoft TelSrv telnet server 1.5 and earlier allows remote attackers to cause a denial of service via a long username. 20000717 DoS in Gamsoft TelSrv telnet server for MS Windows 95/98/NT/2k. 20000729 TelSrv Reveals Usernames & Passwords After DoS Attack 1478 gamsoft-telsrv-dos(4945) rpc.statd in the nfs-utils package in various Linux distributions does not properly cleanse untrusted format strings, which allows remote attackers to gain root privileges. 20000716 Lots and lots of fun with rpc.statd 20000717 CONECTIVA LINUX SECURITY ANNOUNCEMENT - nfs-utils 20000718 Trustix Security Advisory - nfs-utils 20000718 [Security Announce] MDKSA-2000:021 nfs-utils update CSSA-2000-025.0 CA-2000-17 RHSA-2000:043 1480 linux-rpcstatd-format-overwrite(4939) Vulnerability in gpm in Caldera Linux allows local users to delete arbitrary files or conduct a denial of service. CSSA-2000-024.0 1512 pam_console PAM module in Linux systems allows a user to access the system console and reboot the system when a display manager such as gdm or kdm has XDMCP enabled. 20000727 CONECTIVA LINUX SECURITY ANNOUNCEMENT - PAM 20000801 MDKSA-2000:029 pam update RHSA-2000:044 1513 linux-pam-console(5001) Novell NetWare 5.0 allows remote attackers to cause a denial of service by flooding port 40193 with random data. 1467 20000711 Remote Denial Of Service -- NetWare 5.0 with SP 5 The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters. FreeBSD-SA-00:37 20000712 cvsweb: remote shell for cvs committers 20000714 MDKSA-2000:019 cvsweb update 1469 TLSA2000016-1 cvsweb-shell-access(4925) Roxen web server earlier than 2.0.69 allows allows remote attackers to bypass access restrictions, list directory contents, and read source code by inserting a null character (%00) to the URL. 20000721 Roxen Web Server Vulnerability 20000721 Roxen security alert: Problems with URLs containing null characters. 1510 roxen-null-char-url(4965) The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory. 20000721 Jakarta-tomcat.../admin 1548 jakarta-tomcat-admin(5160) The NetBIOS Name Server (NBNS) protocol does not perform authentication, which allows remote attackers to cause a denial of service by sending a spoofed Name Conflict or Name Release datagram, aka the "NetBIOS Name Server Protocol Spoofing" vulnerability. 20000727 Windows NetBIOS Name Conflicts 1514 1515 MS00-047 netbios-name-server-spoofing(5035) ftp.pl CGI program for Virtual Visions FTP browser allows remote attackers to read directories outside of the document root via a .. (dot dot) attack. 20000712 ftp.pl vulnerability 1471 virtualvision-ftp-browser(5187) Buffer overflow in Infopulse Gatekeeper 3.5 and earlier allows remote attackers to execute arbitrary commands via a long string. 1477 20000713 The MDMA Crew's GateKeeper Exploit gatekeeper-long-string-bo(4948) Netscape Communicator and Navigator 4.04 through 4.74 allows remote attackers to read arbitrary files by using a Java applet to open a connection to a URL using the "file", "http", "https", and "ftp" protocols, as demonstrated by Brown Orifice. FreeBSD-SA-00:39 20000804 Dangerous Java/Netscape Security Hole 20000810 MDKSA-2000:033 Netscape Java vulnerability 20000818 Conectiva Linux Security Announcement - netscape 20000821 MDKSA-2000:036 - netscape update CSSA-2000-027.1 CA-2000-15 20000823 Security Hole in Netscape, Versions 4.x, possibly others RHSA-2000:054 1546 Buffer overflow in IBM Net.Data db2www CGI program allows remote attackers to execute arbitrary commands via a long PATH_INFO environmental variable. 20000907 Buffer Overflow in IBM Net.Data db2www CGI program. ibm-netdata-db2www-bo(4976) PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key (ADK) is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate. CA-2000-18 1606 The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force the client to create arbitrary files. 1523 20000728 cvs security problem The CVS 1.10.8 server does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs, which allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then performing a CVS commit action. 1524 20000728 cvs security problem Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension. 20000815 BEA Weblogic server proxy library vulnerabilities 1570 BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet. 20000728 BEA's WebLogic force handlers show code vulnerability http://developer.bea.com/alerts/security_000731.html 1518 BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /*.shtml/ into the URL, which invokes the SSIServlet. 20000728 BEA's WebLogic force handlers show code vulnerability http://developer.bea.com/alerts/security_000728.html 1517 BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file. 20000731 BEA's WebLogic *.jsp/*.jhtml remote command execution http://developer.bea.com/alerts/security_000731.html 1525 BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file. 20000731 BEA's WebLogic *.jsp/*.jhtml remote command execution http://developer.bea.com/alerts/security_000731.html 1525 Auction Weaver CGI script 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the fromfile parameter. 20000823 Auction WeaverT LITE 1.0 1630 Auction Weaver CGI script 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the catdir parameter. 20000823 Auction WeaverT LITE 1.0 1630 Subscribe Me LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter. 20000823 Subscribe Me Vulnerability 20000823 Re: Subscribe Me CGI Vulnerability http://www.cgiscriptcenter.com/subscribe/ 1607 Account Manager LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for the Account Manager by directly calling the amadmin.pl script with the setpasswd parameter. 20000823 Account Manager CGI Vulnerability http://www.cgiscriptcenter.com/acctlite/ 1604 account-manager-overwrite-password(5125) Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter. 20000830 More problems with Auction Weaver & CGI Script Center. 20000830 More problems with Auction Weaver & CGI Script Center. The faxrunq and faxrunqd in the mgetty package allows local users to create or modify arbitrary files via a symlink attack which creates a symlink in from /var/spool/fax/outgoing/.last_run to the target file. 20000826 Advisory: mgetty local compromise http://archives.neohapsis.com/archives/bugtraq/2000-08/0330.html CSSA-2000-029.0 1612 ISS RealSecure 3.2.1 and 3.2.2 allows remote attackers to cause a denial of service via a flood of fragmented packets with the SYN flag set. 20000822 DOS on RealSecure 3.2 1597 pgxconfig in the Raptor GFX configuration tool uses a relative path name for a system call to the "cp" program, which allows local users to execute arbitrary commands by modifying their path to point to an alternate "cp" program. 20000802 Local root compromise in PGX Config Sun Sparc Solaris 1563 pgxconfig in the Raptor GFX configuration tool allows local users to gain privileges via a symlink attack. 20000802 Local root compromise in PGX Config Sun Sparc Solaris Buffer overflows in pgxconfig in the Raptor GFX configuration tool allow local users to gain privileges via command line options. 20000802 Local root compromise in PGX Config Sun Sparc Solaris The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, which allows remote attackers to add user accounts to the interface by directly calling the admin CGI script. 00196 20000807 Vulnerabilities in Sun Solaris AnswerBook2 dwhttpd server http://www.s21sec.com/en/avisos/s21sec-004-en.txt 1554 solaris-answerbook2-admin-interface(5069) The administration interface for the dwhttpd web server in Solaris AnswerBook2 allows interface users to remotely execute commands via shell metacharacters. 00196 20000807 Vulnerabilities in Sun Solaris AnswerBook2 dwhttpd server solaris-answerbook2-remote-execution(5058) http://www.s21sec.com/en/avisos/s21sec-004-en.txt 1556 Minicom 1.82.1 and earlier on some Linux systems allows local users to create arbitrary files owned by the uucp user via a symlink attack. 20000819 RH 6.1 / 6.2 minicom vulnerability 1599 minicom-capture-groupown(5151) Format string vulnerability in ftpd in HP-UX 10.20 allows remote attackers to cause a denial of service or execute arbitrary commands via format strings in the PASS command. 20000806 HPUX FTPd vulnerability 1560 Cisco Gigabit Switch Routers (GSR) with Fast Ethernet / Gigabit Ethernet cards, from IOS versions 11.2(15)GS1A up to 11.2(19)GS0.2 and some versions of 12.0, do not properly handle line card failures, which allows remote attackers to bypass ACLs or force the interface to stop forwarding packets. 20000803 Possible Access Control Bypass and Denial of Service in Gigabit Switch Routers Using Gigabit Ethernet or Fast Ethernet Cards 1541 The wrapper program in mailman 2.0beta3 and 2.0beta4 does not properly cleanse untrusted format strings, which allows local users to gain privileges. 20000802 CONECTIVA LINUX SECURITY ANNOUNCEMENT - mailman 20000802 MDKSA-2000:030 - Linux-Mandrake not affected by mailman problem RHSA-2000:030 20000801 Advisory: mailman local compromise 1539 http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000802105050.A11733@rak.isternet.sk The net.init rc script in HP-UX 11.00 (S008net.init) allows local users to overwrite arbitrary files via a symlink attack that points from /tmp/stcp.conf to the targeted file. 20000821 [HackersLab bugpaper] HP-UX net.init rc script 1602 hp-netinit-symlink(5131) suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence. 20000805 sperl 5.00503 (and newer ;) exploit 20000808 MDKSA-2000:031 perl update 20000810 Conectiva Linux security announcemente - PERL 20000814 Trustix Security Advisory - perl and mailx CSSA-2000-026.0 20000810 Security Hole in perl, all versions RHSA-2000:048 1547 TLSA2000018-1 Buffer overflow in SGI Omron WorldView Wnn allows remote attackers to execute arbitrary commands via long JS_OPEN, JS_MKDIR, or JS_FILE_INFO commands. 20000803-01-A 1603 irix-worldview-wnn-bo(5163) ntop running in web mode allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000802 [ Hackerslab bug_paper ] ntop web mode vulnerabliity RHSA-2000:049 1550 Buffer overflows in ntop running in web mode allows remote attackers to execute arbitrary commands. FreeBSD-SA-00:36 20000830 ntop: Still remotely exploitable using buffer overflows 1576 PCCS MySQLDatabase Admin Tool Manager 1.2.4 and earlier installs the file dbconnect.inc within the web root, which allows remote attackers to obtain sensitive information such as the administrative password. 20000804 PCCS MySQL DB Admin Tool v1.2.3- Advisory http://pccs-linux.com/public/view.php3?bn=agora_pccslinux&key=965951324 1557 Buffer overflow in Pragma Systems TelnetServer 2000 version 4.0 allows remote attackers to cause a denial of service via a long series of null characters to the rexec port. 20000824 Remote DoS Attack in Pragma TelnetServer 2000 (Remote Execute Daemon) Vulnerability http://www.pragmasys.com/TelnetServer/ 1605 The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to cause a denial of service in some components by requesting a URL whose name includes a standard DOS device name. 20000823 Xato Advisory: FrontPage DOS Device DoS http://msdn.microsoft.com/workshop/languages/fp/2000/sr12.asp 1608 The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name. 20000823 Xato Advisory: FrontPage DOS Device DoS http://msdn.microsoft.com/workshop/languages/fp/2000/sr12.asp 1608 Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice. CA-2000-15 1545 20000805 Dangerous Java/Netscape Security Hole 20000816 JDK 1.1.x Listening Socket Vulnerability (was Re: BrownOrifice can break firewalls!) Linux Intrusion Detection System (LIDS) 0.9.7 allows local users to gain root privileges when LIDS is disabled via the security=0 boot option. 2000803 LIDS severe bug http://www.egroups.com/message/lids/1038 http://www.lids.org/changelog.html 1549 Buffer overflow in Adobe Acrobat 4.05, Reader, Business Tools, and Fill In products that handle PDF files allows attackers to execute arbitrary commands via a long /Registry or /Ordering specifier. 20000726 [SPSadvisory#39]Adobe Acrobat Series PDF File Buffer Overflow http://www.adobe.com/misc/pdfsecurity.html 1509 umb-scheme 3.2-11 for Red Hat Linux is installed with world-writeable files. RHSA-2000:047 1551 DiskCheck script diskcheck.pl in Red Hat Linux 6.2 allows local users to create or overwrite arbitrary files via a symlink attack on a temporary file. 20000805 Diskcheck 3.1.1 Symlink Vulnerability 20000807 Re: Diskcheck 3.1.1 Symlink Vulnerability 20000622 Re: rh 6.2 - gid compromises, etc [+ MORE!!!] 1552 WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email. 20000809 Session hijacking in Alt-N's MDaemon 2.8 1553 mdaemon-session-id-hijack(5070) GoodTech FTP server allows remote attackers to cause a denial of service via a large number of RNTO commands. 1619 20000830 [EXPL] GoodTech's FTP Server vulnerable to a DoS (RNTO) ftp-goodtech-rnto-dos(5166) A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed. 20000812 MDKSA-2000:034 MandrakeUpdate update 1567 VariCAD 7.0 is installed with world-writeable files, which allows local users to replace the VariCAD programs with a Trojan horse program. 20000810 VariCAD 7.0 premission vulnerability news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to add new authors by directly posting an HTTP request to the new.cgi program with an addAuthor parameter, and setting the Referer to the news.cgi program. 1621 20000829 News Publisher CGI Vulnerability news-publisher-add-author(5169) The FSserial, FlagShip_c, and FlagShip_p programs in the FlagShip package are installed world-writeable, which allows local users to replace them with Trojan horses. 20000810 FlagShip v4.48.7449 premission vulnerability 1586 Helix GNOME Updater helix-update 0.5 and earlier allows local users to install arbitrary RPM packages by creating the /tmp/helix-install installation directory before root has begun installing packages. 20000820 Helix Code Security Advisory - Helix GNOME Update 20000820 [Helix Beta] Helix Code Security Advisory - Helix GNOME Installer 1593 20000819 Multiple Local Vulnerabilities in Helix Gnome Installer Helix GNOME Updater helix-update 0.5 and earlier does not properly create /tmp directories, which allows local users to create empty system configuration files such as /etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.config. 20000820 [Helix Beta] Helix Code Security Advisory - Helix GNOME Installer 1596 20000819 Multiple Local Vulnerabilities in Helix Gnome Installer The go-gnome Helix GNOME pre-installer allows local users to overwrite arbitrary files via a symlink attack on various files in /tmp, including uudecode, snarf, and some installer files. 20000829 More Helix Code installation problems (go-gnome) 20000829 Helix Code Security Advisory - go-gnome pre-installer 1622 Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request. 20000816 MDKSA-2000:035 Zope update 20000821 Conectiva Linux Security Announcement - Zope 20000821 zope: unauthorized escalation of privilege (update) RHSA-2000:052 1577 http://www.zope.org/Products/Zope/Hotfix_08_09_2000/security_alert CGIMail.exe CGI program in Stalkerlab Mailers 1.1.2 allows remote attackers to read arbitrary files by specifying the file in the $Attach$ hidden form variable. 1623 20000829 Stalker's CGImail Gives Read Access to All Server Files mailers-cgimail-spoof(5165) xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's, which allows an attacker to execute arbitrary commands via a URL that contains shell metacharacters. 20000829 MDKSA-2000:041 - xpdf update 20000913 Conectiva Linux Security Announcement - xpdf CSSA-2000-031.0 20000910 xpdf: local exploit RHSA-2000:060 1624 xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack. 20000829 MDKSA-2000:041 - xpdf update 20000913 Conectiva Linux Security Announcement - xpdf CSSA-2000-031.0 RHSA-2000:060 1624 FreeBSD 5.x, 4.x, and 3.x allows local users to cause a denial of service by executing a program with a malformed ELF image header. FreeBSD-SA-00:41 1625 freebsd-elf-dos(5967) Vulnerability in newgrp command in HP-UX 11.0 allows local users to gain privileges. HPSBUX0008-118 1580 Directory traversal vulnerability in Worm HTTP server allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000825 DST2K0023: Directory Traversal Possible & Denial of Service in Wo rm HTTP Server 1626 wormhttp-dir-traverse(5148) Worm HTTP server allows remote attackers to cause a denial of service via a long URL. 20000825 DST2K0023: Directory Traversal Possible & Denial of Service in Wo rm HTTP Server 1626 wormhttp-filename-dos(5149) Telnetd telnet server in IRIX 5.2 through 6.1 does not properly cleans user-injected format strings, which allows remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPT_ENVIRON request. 20000801-02-P 20000814 [LSD] IRIX telnetd remote vulnerability 1572 eEye IRIS 1.01 beta allows remote attackers to cause a denial of service via a large number of UDP connections. 20000831 Remote DoS Attack in Eeye Iris 1.01 and SpyNet CaptureNet v3.12 1627 Buffer overflow in Becky! Internet Mail client 1.26.03 and earlier allows remote attackers to cause a denial of service via a long Content-type: MIME header when the user replies to a message. 20000818 Becky! Internet Mail Buffer overflow http://member.nifty.ne.jp/rimarts/becky-e/Readme.txt 1588 Buffer overflow in Becky! Internet Mail client 1.26.04 and earlier allows remote attackers to cause a denial of service via a long Content-type: MIME header when the user forwards a message. 20000818 Becky! Internet Mail Buffer overflow http://member.nifty.ne.jp/rimarts/becky-e/Readme.txt 1588 The Service Control Manager (SCM) in Windows 2000 creates predictable named pipes, which allows a local user with console access to gain administrator privileges, aka the "Service Control Manager Named Pipe Impersonation" vulnerability. 1535 MS00-053 WebShield SMTP 4.5 allows remote attackers to cause a denial of service by sending e-mail with a From: address that has a . (period) at the end, which causes WebShield to continuously send itself copies of the e-mail. 20000818 WebShield SMTP infinite loop DoS Attack 1589 webshield-smtp-dos(5100) Directory traversal vulnerability in strong.exe program in NAI Net Tools PKI server 1.0 before HotFix 3 allows remote attackers to read arbitrary files via a .. (dot dot) attack in an HTTPS request to the enrollment server. 20000802 NAI Net Tools PKI Server vulnerabilities http://download.nai.com/products/licensed/pgp/hf3pki10.txt 1537 nettools-pki-dir-traverse(5066) Buffer overflow in strong.exe program in NAI Net Tools PKI server 1.0 before HotFix 3 allows remote attackers to execute arbitrary commands via a long URL in the HTTPS port. 20000802 NAI Net Tools PKI Server vulnerabilities http://download.nai.com/products/licensed/pgp/hf3pki10.txt 1536 nai-nettools-strong-bo(5026) Format string vulnerability in strong.exe program in NAI Net Tools PKI server 1.0 before HotFix 3 allows remote attackers to execute arbitrary code via format strings in a URL with a .XUDA extension. 20000802 NAI Net Tools PKI Server vulnerabilities http://download.nai.com/products/licensed/pgp/hf3pki10.txt 1538 The IPX protocol implementation in Microsoft Windows 95 and 98 allows remote attackers to cause a denial of service by sending a ping packet with a source IP address that is a broadcast address, aka the "Malformed IPX Ping Packet" vulnerability. 1544 20000602 ipx storm MS00-054 win-ipx-ping-packet(5079) Buffer overflow in University of Minnesota (UMN) gopherd 2.x allows remote attackers to execute arbitrary commands via a DES key generation request (GDESkey) that contains a long ticket value. 20000810 Remote vulnerability in Gopherd 2.x 1569 DEPRECATED. This entry has been deprecated. It is a duplicate of CVE-2000-0743. admin.php3 in PHP-Nuke does not properly verify the PHP-Nuke administrator password, which allows remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameter. 20000821 Vuln. in all sites using PHP-Nuke, versions less than 3 1592 Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities. 1594 1595 20000821 IIS 5.0 cross site scripting vulnerability - using .shtml files or /_vti_bin/shtml.dll MS00-060 The logrotate script for OpenLDAP before 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon (klogd) and kills it. 20000726 CONECTIVA LINUX SECURITY ANNOUNCEMENT - OPENLDAP openldap-logrotate-script-dos(5036) OpenLDAP 1.2.11 and earlier improperly installs the ud binary with group write permissions, which could allow any user in that group to replace the binary with a Trojan horse. 20000726 Group-writable executable in OpenLDAP 1511 Buffer overflow in the Linux binary compatibility module in FreeBSD 3.x through 5.x allows local users to gain root privileges via long filenames in the linux shadow file system. FreeBSD-SA-00:42 1628 freebsd-linux-module-bo(5968) Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name. 20000808 OpenBSD 2.7 / NetBSD 1.4.2 mopd buffer overflow FreeBSD-SA-00:40 http://cvsweb.netbsd.org/bsdweb.cgi/basesrc/usr.sbin/mopd/mopd/process.c.diff?r1=1.7&r2=1.8&f=h 20000705 Mopd contained a buffer overflow. RHSA-2000:050 1558 mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands. 20000808 OpenBSD 2.7 / NetBSD 1.4.2 mopd buffer overflow FreeBSD-SA-00:40 http://cvsweb.netbsd.org/bsdweb.cgi/basesrc/usr.sbin/mopd/mopd/process.c.diff?r1=1.7&r2=1.8&f=h 20000705 Mopd contained a buffer overflow. RHSA-2000:050 1559 Buffer overflows in brouted in FreeBSD and possibly other OSes allows local users to gain root privileges via long command line arguments. FreeBSD-SA-00:43 1629 The Microsoft Outlook mail client identifies the physical path of the sender's machine within a winmail.dat attachment to Rich Text Format (RTF) files. 20010802 Outlook 2000 Rich Text information disclosure 20000824 Outlook winmail.dat 1631 outlook-reveal-path(5508) Vulnerability in HP OpenView Network Node Manager (NMM) version 6.1 related to passwords. HPSBUX0008-119 1581 Vulnerability in the newgrp command in HP-UX 11.00 allows local users to gain privileges. HPSBUX0008-118 1581 Microsoft Outlook 2000 does not properly process long or malformed fields in vCard (.vcf) files, which allows attackers to cause a denial of service. 1633 20000831 vCard DoS on Outlook 2000 The sysgen service in Aptis Totalbill does not perform authentication, which allows remote attackers to gain root privileges by connecting to the service and specifying the commands to be executed. 20000808 Exploit for Totalbill... 1555 The web interface for Lyris List Manager 3 and 4 allows list subscribers to obtain administrative access by modifying the value of the list_admin hidden form field. 20000811 Lyris List Manager Administration Hole http://www.lyris.com/lm/lm_updates.html 1584 Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path. tomcat-error-path-reveal(4967) 1531 20000719 [LoWNOISE] Tomcat 3.1 Path Revealing Problem. The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension. 1532 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0) OS2/Warp 4.5 FTP server allows remote attackers to cause a denial of service via a long username. ftp://ftp.software.ibm.com/ps/products/tcpip/fixes/v4.3os2/ic27721/README 20000815 OS/2 Warp 4.5 FTP Server DoS 1582 The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, which allows remote attackers to spoof the eTrust administrator and gain privileges. http://support.ca.com/techbases/eTrust/etrust_access_control-response.html 1583 20000811 eTrust Access Control - Root compromise for default install etrust-access-control-default(5076) xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option. 20000817 Conectiva Linux Security Announcement - xlockmore 20000823 MDKSA-2000:038 - xlockmore update FreeBSD-SA-00:44.xlockmore 20000816 xlockmore: possible shadow file compromise 1585 20000816 xlock vulnerability Intel Express 500 series switches allow a remote attacker to cause a denial of service via a malformed IP packet. 20000828 Intel Express Switch 500 series DoS 1609 intel-express-switch-dos(5154) Buffer overflow in the HTML interpreter in Microsoft Office 2000 allows an attacker to execute arbitrary commands via a long embedded object tag, aka the "Microsoft Office HTML Object Tag" vulnerability. 1561 MS00-056 Buffer overflow in vqSoft vqServer 1.4.49 allows remote attackers to cause a denial of service or possibly gain privileges via a long HTTP GET request. 1610 20000819 D.o.S Vulnerability in vqServer vqserver-get-dos(5152) The ActiveX control for invoking a scriptlet in Internet Explorer 4.x and 5.x renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka the "Scriptlet Rendering" vulnerability. 1564 MS00-055 A function in Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files, aka a variant of the "Frame Domain Verification" vulnerability. 1564 MS00-055 O'Reilly WebSite Pro 2.3.7 installs the uploader.exe program with execute permissions for all users, which allows remote attackers to create and execute arbitrary files by directly calling uploader.exe. 20000824 WebServer Pro 2.3.7 Vulnerability 1611 IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability. 1565 MS00-057 Microsoft Windows 2000 allows local users to cause a denial of service by corrupting the local security policy via malformed RPC traffic, aka the "Local Security Policy Corruption" vulnerability. 1613 MS00-062 The installation of Tumbleweed Messaging Management System (MMS) 4.6 and earlier (formerly Worldtalk Worldsecure) creates a default account "sa" with no password. 20000810 Tumbleweed Worldsecure (MMS) BLANK 'sa' account password vulnerability http://thompson.tumbleweed.com/NewKB/bulletin/UPFiles/sa-official.htm 1562 tumbleweed-mms-blank-password(5072) Bajie HTTP web server 0.30a allows remote attackers to read arbitrary files via a URL that contains a "....", a variant of the dot dot directory traversal attack. 20000731 Two security flaws in Bajie Webserver 1522 bajie-view-arbitrary-files(5021) The sample Java servlet "test" in Bajie HTTP web server 0.30a reveals the real pathname of the web document root. 20000731 Two security flaws in Bajie Webserver 1521 Buffer overflow in RobTex Viking server earlier than 1.06-370 allows remote attackers to cause a denial of service or execute arbitrary commands via a long HTTP GET request, or long Unless-Modified-Since, If-Range, or If-Modified-Since headers. http://www.robtex.com/viking/bugs.htm 1614 20000828 [NT] Viking security vulnerabilities enable remote code execution (long URL, date parsing) Mediahouse Statistics Server 5.02x allows remote attackers to execute arbitrary commands via a long HTTP GET request. 20000810 [DeepZone Advisory] Statistics Server 5.02x stack overflow (Win2k remote exploit) 1568 mediahouse-stats-livestats-bo(5113) The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the password, aka the "Money Password" vulnerability. 1615 MS00-061 IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability. 20000816 Translate: f 1578 20000815 Translate:f summary, history and thoughts MS00-058 oval:org.mitre.oval:def:927 Checkpoint Firewall-1 with the RSH/REXEC setting enabled allows remote attackers to bypass access restrictions and connect to a RSH/REXEC client via malformed connection requests. http://www.checkpoint.com/techsupport/alerts/list_vun.html#Improper_stderr 1534 The web server in IPSWITCH IMail 6.04 and earlier allows remote attackers to read and delete arbitrary files via a .. (dot dot) attack. 20000830 Vulnerability Report On IPSWITCH's IMail http://www.ipswitch.com/Support/IMail/news.html 1617 uagentsetup in ARCServeIT Client Agent 6.62 does not properly check for the existence or ownership of a temporary file which is moved to the agent.cfg configuration file, which allows local users to execute arbitrary commands by modifying the temporary file before it is moved. 20000728 Client Agent 6.62 for Unix Vulnerability 1519 arcserveit-clientagent-temp-file(5023) netauth.cgi program in Netwin Netauth 4.2e and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. http://netwinsite.com/netauth/updates.htm 1587 20000817 Netauth: Web Based Email Management System netwin-netauth-dir-traverse(5090) Watchguard Firebox II allows remote attackers to cause a denial of service by sending a malformed URL to the authentication service on port 4100. 20000815 Watchguard Firebox Authentication DoS 1573 firebox-url-dos(5098) sshd program in the Rapidstream 2.1 Beta VPN appliance has a hard-coded "rsadmin" account with a null password, which allows remote attackers to execute arbitrary commands via ssh. 20000816 Remote Root Compromise On All RapidStream VPN Appliances 1574 WircSrv IRC Server 5.07s allows IRC operators to read arbitrary files via the importmotd command, which sets the Message of the Day (MOTD) to the specified file. 20000713 More wIRCSrv stupidity GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERV_GROUPS and USERV_GIDS environmental variables and allow local users to bypass some access restrictions. 20000726 userv security boundary tool 1.0.1 (SECURITY FIX) http://marc.info/?l=bugtraq&m=96473640717095&w=2 20000727 userv: local exploit 1516 IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web browser. 20000817 XChat URL handler vulnerabilty 20000824 MDKSA-2000:039 - xchat update 20000825 Conectiva Linux Security Announcement - xchat RHSA-2000:055 1601 The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands. 1566 20000807 MS Word and MS Access vulnerability - executing arbitrary programs, may be exploited by IE/Outlook MS00-071 word-mail-merge(5322) WinU 5.x and earlier uses weak encryption to store its configuration password, which allows local users to decrypt the password and gain privileges. 20000816 WinU 4/5 weak password vulnerability The web-based folder display capability in Microsoft Internet Explorer 5.5 on Windows 98 allows local users to insert Trojan horse programs by modifying the Folder.htt file and using the InvokeVerb method in the ShellDefView ActiveX control to specify a default execute option for the first file that is listed in the folder. 1571 20000828 IE 5.5/5.x for Win98 may execute arbitrary files that can be accessed thru Microsoft Networking. Also local Administrator compromise at least on default Windows 2000. ie-folder-remote-exe(5097) Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse. 20000815 Trustix security advisory - apache-ssl 1575 Gnome Lokkit firewall package before 0.41 does not properly restrict access to some ports, even if a user does not make any services available. 20000819 Security update for Gnome-Lokkit 1590 Norton AntiVirus 5.00.01C with the Novell Netware client does not properly restart the auto-protection service after the first user has logged off of the system. 1533 20000728 Norton Antivirus Protection Disabled under Novell Netware Buffer overflow in IRIX libgl.so library allows local users to gain root privileges via a long HOME variable to programs such as (1) gmemusage and (2) gr_osview. irix-libgl-bo(5063) 1527 20000802 [LSD] some unpublished LSD exploit codes Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option. 1529 20000802 [LSD] some unpublished LSD exploit codes Buffer overflow in dmplay in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long command line option. 1528 20000802 [LSD] some unpublished LSD exploit codes irix-dmplay-bo(5064) Buffer overflow in gr_osview in IRIX 6.2 and 6.3 allows local users to gain privileges via a long -D option. 20040104-01-P 1526 20000802 [LSD] some unpublished LSD exploit codes irix-grosview-bo(5062) The truncate function in IRIX 6.x does not properly check for privileges when the file is in the xfs file system, which allows local users to delete the contents of arbitrary files. 1540 20000802 [LSD] some unpublished LSD exploit codes inpview in InPerson in SGI IRIX 5.3 through IRIX 6.5.10 allows local users to gain privileges via a symlink attack on the .ilmpAAA temporary file. 20001101-01-I 1530 20000802 [LSD] some unpublished LSD exploit codes irix-inpview-symlink(5065) String parsing error in rpc.kstatd in the linuxnfs or knfsd packages in SuSE and possibly other Linux systems allows remote attackers to gain root privileges. 20000810 Security Hole in knfsd, all versions Buffer overflow in bdf program in HP-UX 11.00 may allow local users to gain root privileges via a long -t option. 20000727 [ Hackerslab bug_paper ] HP-UX bdf -t option buffer overflow vul. 1520 The BAIR program does not properly restrict access to the Internet Explorer Internet options menu, which allows local users to obtain access to the menu by modifying the registry key that starts BAIR. 20000722 More bad censorware GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff. gnu-groff-utilities(5280) Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass the directionality check via fragmented TCP connection requests or reopening closed TCP connection requests, aka "One-way Connection Enforcement Bypass." http://www.checkpoint.com/techsupport/alerts/list_vun.html#One-way_Connection fw1-remote-bypass(5468) Check Point VPN-1/FireWall-1 4.1 and earlier improperly retransmits encapsulated FWS packets, even if they do not come from a valid FWZ client, aka "Retransmission of Encapsulated Packets." http://www.checkpoint.com/techsupport/alerts/list_vun.html#Retransmission_of fw1-client-spoof(5469) The inter-module authentication mechanism (fwa1) in Check Point VPN-1/FireWall-1 4.1 and earlier may allow remote attackers to conduct a denial of service, aka "Inter-module Communications Bypass." http://www.checkpoint.com/techsupport/alerts/list_vun.html#Inter-module_Communications fw1-fwa1-auth-replay(5162) The OPSEC communications authentication mechanism (fwn1) in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to spoof connections, aka the "OPSEC Authentication Vulnerability." http://www.checkpoint.com/techsupport/alerts/list_vun.html#OPSEC_Authentication fw1-opsec-auth-spoof(5471) The seed generation mechanism in the inter-module S/Key authentication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to bypass authentication via a brute force attack, aka "One-time (s/key) Password Authentication." http://www.checkpoint.com/techsupport/alerts/list_vun.html#One-time_Password fw1-localhost-auth(5137) Buffer overflow in Getkey in the protocol checker in the inter-module communication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to cause a denial of service. http://www.checkpoint.com/techsupport/alerts/list_vun.html#Getkey_Buffer fw1-getkey-bo(5139) Auction Weaver 1.0 through 1.04 does not properly validate the names of form fields, which allows remote attackers to delete arbitrary files and directories via a .. (dot dot) attack. 1782 auction-weaver-delete-files(5371) Auction Weaver 1.0 through 1.04 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the username or bidfile form fields. 1783 auction-weaver-username-bidfile(5372) The administration module in Sun Java web server allows remote attackers to execute arbitrary commands by uploading Java code to the module and invoke the com.sun.server.http.pagecompile.jsp92.JspServlet by requesting a URL that begins with a /servlet/ tag. 00197 1600 http://www.securityfocus.com/templates/advisory.html?id=2542 sunjava-webadmin-bbs(5135) Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to redirect FTP connections to other servers ("FTP Bounce") via invalid FTP commands that are processed improperly by FireWall-1, aka "FTP Connection Enforcement Bypass." http://www.checkpoint.com/techsupport/alerts/list_vun.html#FTP_Connection fw1-ftp-redirect(5474) Linux tmpwatch --fuser option allows local users to execute arbitrary commands by creating files whose names contain shell metacharacters. MDKSA-2000:056 RHSA-2000:080 1785 20001006 Insecure call of external programs in Red Hat Linux tmpwatch linux-tmpwatch-fuser(5320) Buffer overflow in the HTTP protocol parser for Microsoft Network Monitor (Netmon) allows remote attackers to execute arbitrary commands via malformed data, aka the "Netmon Protocol Parsing" vulnerability. 20001101 Buffer Overflow in Microsoft Windows NT 4.0 and Windows 2000 Network Monitor MS00-083 network-monitor-bo(5399) The default installation for the Oracle listener program 7.3.4, 8.0.6, and 8.1.6 allows an attacker to cause logging information to be appended to arbitrary files and execute commands via the SET TRC_FILE or SET LOG_FILE commands. http://otn.oracle.com/deploy/security/pdf/listener_alert.pdf 20001025 Vulnerability in the Oracle Listener Program oracle-listener-connect-statements(5380) The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LD_PRELOAD or LD_LIBRARY_PATH. 20000902 Conectiva Linux Security Announcement - glibc 20000905 Conectiva Linux Security Announcement - glibc 20000906 [slackware-security]: glibc 2.1.3 vulnerabilities patched 19990917 A few bugs... CSSA-2000-028.0 20000902 glibc: local root exploit MDKSA-2000:040 MDKSA-2000:045 20000924 glibc locale security problem RHSA-2000:057 20000831 glibc unsetenv bug 1639 648 TLSA2000020-1 glibc-ld-unsetenv(5173) Ipswitch Imail 6.0 allows remote attackers to cause a denial of service via a large number of connections in which a long Host: header is sent, which causes a thread to crash. 20000817 Imail Web Service Remote DoS Attack v.2 20000817 Imail Web Service Remote DoS Attack v.2 20000817 Imail Web Service Remote DoS Attack v.2 2011 ipswitch-imail-remote-dos(5475) Buffer overflow in ddicgi.exe program in Mobius DocumentDirect for the Internet 1.2 allows remote attackers to execute arbitrary commands via a long GET request. A090800-1 1657 documentdirect-get-bo(5210) Buffer overflow in the web authorization form of Mobius DocumentDirect for the Internet 1.2 allows remote attackers to cause a denial of service or execute arbitrary commands via a long username. A090800-1 1657 documentdirect-username-bo(5211) Buffer overflow in ddicgi.exe in Mobius DocumentDirect for the Internet 1.2 allows remote attackers to execute arbitrary commands via a long User-Agent parameter. A090800-1 1657 documentdirect-user-agent-bo(5212) The tmpwatch utility in Red Hat Linux forks a new process for each directory level, which allows local users to cause a denial of service by creating deeply nested directories in /tmp or /var/tmp/. RHSA-2000:080 20000909 tmpwatch: local DoS : fork()bomb as root 1664 linux-tmpwatch-fork-dos(5217) annclist.exe in webTV for Windows allows remote attackers to cause a denial of service by via a large, malformed UDP packet to ports 22701 through 22705. 20000913 trivial DoS in webTV 1671 MS00-074 webtv-udp-dos(5216) Buffer overflow in Fastream FTP++ 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long username. 20000912 DST2K0027: DoS in Faststream FTP++ 2.0 Htgrep CGI program allows remote attackers to read arbitrary files by specifying the full pathname in the hdr parameter. 20000817 Htgrep CGI Arbitrary File Viewing Vulnerability htgrep-cgi-view-files(5476) Buffer overflow in WinSMTP 1.06f and 2.X allows remote attackers to cause a denial of service via a long (1) USER or (2) HELO command. 2000911 WinSMTPD remote exploit/DoS problem 1680 winsmtp-helo-bo(5255) The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication" vulnerability. A091400-1 1683 MS00-067 win2k-telnet-ntlm-authentication(5242) search.dll Sambar ISAPI Search utility in Sambar Server 4.4 Beta 3 allows remote attackers to read arbitrary directories by specifying the directory in the query parameter. 20000915 Sambar Server search CGI vulnerability 1684 Buffer overflow in CamShot WebCam Trial2.6 allows remote attackers to execute arbitrary commands via a long Authorization header. 20000915 [NEWS] Vulnerability in CamShot server (Authorization) 1685 camshot-password-bo(5246) FTP Serv-U 2.5e allows remote attackers to cause a denial of service by sending a large number of null bytes. 20000804 FTP Serv-U 2.5e vulnerability. 1543 servu-null-character-dos(5029) Fastream FUR HTTP server 1.0b allows remote attackers to cause a denial of service via a long GET request. 20000914 DST2K0028: DoS in FUR HTTP Server v1.0b fur-get-dos(5237) WinCOM LPD 1.00.90 allows remote attackers to cause a denial of service via a large number of LPD options to the LPD port (515). 20000919 VIGILANTE-2000013: WinCOM LPD DoS 1701 wincom-lpd-dos(5258) Buffer overflow in XMail POP3 server before version 0.59 allows remote attackers to execute arbitrary commands via a long USER command. 20000906 [NEWS] XMail vulnerable to a remotely exploitable buffer overflow (APOP, USER) 1652 xmail-long-user-bo(5192) Buffer overflow in XMail POP3 server before version 0.59 allows remote attackers to execute arbitrary commands via a long APOP command. 20000906 [NEWS] XMail vulnerable to a remotely exploitable buffer overflow (APOP, USER) 1652 xmail-long-apop-bo(5191) The search97cgi/vtopic" in the UnixWare 7 scohelphttp webserver allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000911 SCO scohelhttp documentation webserver exposes local files 1663 Buffer overflow in pam_smb and pam_ntdom pluggable authentication modules (PAM) allow remote attackers to execute arbitrary commands via a login with a long user name. 20000910 (SRADV00002) Remote root compromise through pam_smb and pam_ntdom 20000911 Conectiva Linux Security Announcement - pam_smb 20000911 libpam-smb: remote root exploit MDKSA-2000:047 20000913 pam_smb remotely exploitable buffer overflow 1666 Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen. 20000901-01-P 20000902 Conectiva Linux Security Announcement - glibc 20000904 UNIX locale format string vulnerability IY13753 SSRT0689U CSSA-2000-030.0 20000902 glibc: local root exploit 20000906 glibc locale security problem RHSA-2000:057 1634 unix-locale-format-string(5176) kdebug daemon (kdebugd) in Digital Unix 4.0F allows remote attackers to read arbitrary files by specifying the full file name in the initialization packet. 20000918 [ENIGMA] Digital UNIX/Tru64 UNIX remote kdebug Vulnerability Buffer overflow in Darxite 0.4 and earlier allows a remote attacker to execute arbitrary commands via a long username or password. 20000821 Darxite daemon remote exploit/DoS problem 1598 darxite-login-bo(5134) Buffer overflow in University of Washington c-client library (used by pine and other programs) allows remote attackers to execute arbitrary commands via a long X-Keywords header. 20000901 UW c-client library vulnerability 20000901 More about UW c-client library FreeBSD-SA-00:47.pine 1646 1687 c-client-dos(5223) Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header. 20000915 WebSphere application server plugin issue & vendor fix 1691 http://www-4.ibm.com/software/webservers/appserv/doc/v3022/fxpklst.htm#Security websphere-header-dos(5252) Race condition in Microsoft Windows Media server allows remote attackers to cause a denial of service in the Windows Media Unicast Service via a malformed request, aka the "Unicast Service Race Condition" vulnerability. 1655 MS00-064 unicast-service-dos(5193) Netegrity SiteMinder before 4.11 allows remote attackers to bypass its authentication mechanism by appending "$/FILENAME.ext" (where ext is .ccc, .class, or .jpg) to the requested URL. A091100-1 1681 siteminder-bypass-authentication(5230) Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability. A090700-1 1651 MS00-065 w2k-still-image-service(5203) Multiple buffer overflows in eject on FreeBSD and possibly other OSes allows local users to gain root privileges. FreeBSD-SA-00:49 1686 freebsd-eject-port(5248) YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000909 YaBB 1.9.2000 Vulnerabilitie 1668 yabb-file-access(5254) When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and msi.dll, which could allow an attacker to execute arbitrary commands by inserting a Trojan Horse DLL into the same directory as the document. 20000922 Eudora + riched20.dll affects WinZip v8.0 as well 20000921 Mitigators for possible exploit of Eudora via Guninski #21,2000 20000918 Double clicking on MS Office documents from Windows Explorer may execute arbitrary programs in some cases 1699 office-dll-execution(5263) SunFTP build 9(1) allows remote attackers to cause a denial of service by connecting to the server and disconnecting before sending a newline. 20000901 [EXPL] SunFTP vulnerable to two Denial-of-Service attacks (long buffer, half-open) 1637 Buffer overflow in SunFTP build 9(1) allows remote attackers to cause a denial of service or possibly execute arbitrary commands via a long GET request. 20000901 [EXPL] SunFTP vulnerable to two Denial-of-Service attacks (long buffer, half-open) 1638 The logging capability in muh 2.05d IRC server does not properly cleanse user-injected format strings, which allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed nickname. 20000909 format string bug in muh 20000909 Re: format string bug in muh 1665 muh-log-dos(5215) Vulnerability in Microsoft Windows NT 4.0 allows remote attackers to cause a denial of service in IIS by sending it a series of malformed requests which cause INETINFO.EXE to fail, aka the "Invalid URL" vulnerability. MS00-063 20000906 VIGILANTE-2000009: "Invalid URL" DoS 1642 iis-invald-url-dos(5202) The web configuration server for NTMail V5 and V6 allows remote attackers to cause a denial of service via a series of partial HTTP requests. 20000904 VIGILANTE-2000008: NTMail Configuration Service DoS 1640 ntmail-incomplete-http-requests(5182) The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables. 20000903 (SRADV00001) Arbitrary file disclosure through PHP file upload 20000904 Re: [PHP-DEV] RE: (SRADV00001) Arbitrary file disclosure through PHP file upload MDKSA-2000:048 http://cvsweb.php.net/viewcvs.cgi/php4/main/rfc1867.c.diff?r1=1.38%3Aphp_4_0_2&tr1=1.1&r2=text&tr2=1.45&diff_format=u 1649 php-file-upload(5190) Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %(listname) macro expansion. 20000907 Mailman 1.1 + external archiver vulnerability FreeBSD-SA-00:51 1667 mailman-execute-external-commands(5493) Vulnerability in an administrative interface utility for Allaire Spectra 1.0.1 allows remote attackers to read and modify sensitive configuration information. ASB00-23 allaire-spectra-admin-access(5466) Buffer overflow in listmanager earlier than 2.105.1 allows local users to gain additional privileges. FreeBSD-SA-00:50 listmanager-port-bo(5503) Race condition in the creation of a Unix domain socket in GNOME esound 0.2.19 and earlier allows a local user to change the permissions of arbitrary files and directories, and gain additional privileges, via a symlink attack. 20000911 Patch for esound-0.2.19 20001006 Immunix OS Security Update for esound FreeBSD-SA-00:45 20001008 esound: race condition 20001012 esound daemon race condition RHSA-2000:077 1659 gnome-esound-symlink(5213) Buffer overflow in dvtermtype in Tridia Double Vision 3.07.00 allows local users to gain root privileges via a long terminal type argument. 20000916 Advisory: Tridia DoubleVision / SCO UnixWare 1697 doublevision-dvtermtype-bo(5261) Interbase 6 SuperServer for Linux allows an attacker to cause a denial of service via a query containing 0 bytes. 20000907 SEGFAULTING Interbase 6 SS Linux 1654 interbase-query-dos(5205) Kernel logging daemon (klogd) in Linux does not properly cleanse user-injected format strings, which allows local users to gain root privileges by triggering malformed kernel messages. CSSA-2000-032.0 20000917 klogd format bug MDKSA-2000:050 20000918 Conectiva Linux Security Announcement - sysklogd 20000920 syslogd + klogd format string parsing error RHSA-2000:061 TLSA2000022-2 klogd-format-string(5259) The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/. 20000907 A090700-2 1658 suse-apache-cgi-source-code(5197) The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method. 20000907 A090700-3 1656 apache-webdav-directory-listings(5204) Buffer overflow in EFTP allows remote attackers to cause a denial of service via a long string. 20000911[EXPL] EFTP vulnerable to two DoS attacks 1675 eftp-bo(5219) Buffer overflow in EFTP allows remote attackers to cause a denial of service by sending a string that does not contain a newline, then disconnecting from the server. 20000911[EXPL] EFTP vulnerable to two DoS attacks 1677 eftp-newline-dos(5220) explorer.php in PhotoAlbum 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000906 PhotoAlbum 0.9.9 explorer.php Vulnerability 1650 phpphoto-dir-traverse(5198) netstat in AIX 4.x.x does not properly restrict access to the -Zi option, which allows local users to clear network interface statistics and possibly hide evidence of unusual network activities. 20000903 aix allows clearing the interface stats 1660 aix-clear-netstat(5214) Eudora mail client includes the absolute path of the sender's host within a virtual card (VCF). 20000907 Eudora disclosure 1653 eudora-path-disclosure(5206) WFTPD and WFTPD Pro 2.41 RC12 allows remote attackers to cause a denial of service by sending a long string of unprintable characters. 20000905 WFTPD/WFTPD Pro 2.41 RC12 vulnerabilities http://www.wftpd.com/bug_gpf.htm wftpd-long-string-dos(5194) WFTPD and WFTPD Pro 2.41 RC12 allows remote attackers to obtain the full pathname of the server via a "%C" command, which generates an error message that includes the pathname. 20000905 WFTPD/WFTPD Pro 2.41 RC12 vulnerabilities wftpd-path-disclosure(5196) mailform.pl CGI script in MailForm 2.0 allows remote attackers to read arbitrary files by specifying the file name in the XX-attach_file parameter, which MailForm then sends to the attacker. 20000911 Unsafe passing of variables to mailform.pl in MailForm V2.0 1670 mailform-attach-file(5224) The mailto CGI script allows remote attacker to execute arbitrary commands via shell metacharacters in the emailadd form field. 20000911 Fwd: Poor variable checking in mailto.cgi 1669 mailto-piped-address(5241) LPPlus programs dccsched, dcclpdser, dccbkst, dccshut, dcclpdshut, and dccbkstshut are installed setuid root and world executable, which allows arbitrary local users to start and stop various LPD services. 20000906 Multiple Security Holes in LPPlus 1643 lpplus-permissions-dos(5199) LPPlus creates the lpdprocess file with world-writeable permissions, which allows local users to kill arbitrary processes by specifying an alternate process ID and using the setuid dcclpdshut program to kill the process that was specified in the lpdprocess file. 20000906 Multiple Security Holes in LPPlus 1643 lpplus-process-perms-dos(5200) The dccscan setuid program in LPPlus does not properly check if the user has the permissions to print the file that is specified to dccscan, which allows local users to print arbitrary files. 20000906 Multiple Security Holes in LPPlus 1644 lpplus-dccscan-file-read(5201) Intel Express 500 series switches allow a remote attacker to cause a denial of service via a malformed ICMP packet, which causes the CPU to crash. 20000906 VIGILANTE-2000010: Intel Express Switch series 500 DoS #2 1647 The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory. MDKSA-2000:046 1678 linux-mod-perl(5257) IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability. 1806 MS00-078 iis-unicode-translation(5377) oval:org.mitre.oval:def:44 Buffer overflows in Microsoft Network Monitor (Netmon) allow remote attackers to execute arbitrary commands via a long Browser Name in a CIFS Browse Frame, a long SNMP community name, or a long username or filename in an SMB session, aka the "Netmon Protocol Parsing" vulnerability. NOTE: It is highly likely that this candidate will be split into multiple candidates. MS00-083 network-monitor-bo(5399) IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. 1912 20001107 NSFOCUS SA2000-07 : Microsoft IIS 4.0/5.0 CGI File Name Inspection Vulnerability MS00-086 iis-invalid-filename-passing(5470) oval:org.mitre.oval:def:191 named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and performing a name service query on an authoritative record that is not cached, aka the "zxfr bug." 20001115 Trustix Security Advisory - bind and openssh (and modutils) SuSE-SA:2000:45 CLSA-2000:338 CLSA-2000:339 MDKSA-2000:067 CA-2000-20 20001112 bind: remote Denial of Service RHSA-2000:107 20001107 BIND 8.2.2-P5 Possible DOS 1923 bind-zxfr-dos(5540) named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by sending an SRV record to the server, aka the "srv bug." SuSE-SA:2000:45 CLSA-2000:338 CLSA-2000:339 MDKSA-2000:067 CA-2000-20 20001112 bind: remote Denial of Service RHSA-2000:107 bind-srv-dos(5814) Two Sun security certificates have been compromised, which could allow attackers to insert malicious code such as applets and make it appear that it is signed by Sun. 00198 CA-2000-19 periodic in FreeBSD 4.1.1 and earlier, and possibly other operating systems, allows local users to overwrite arbitrary files via a symlink attack. VU#626919 2325 periodic-temp-file-symlink(6047) A default ECL in Lotus Notes before 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email. VU#5962 http://www.notes.net/R5FixList.nsf/Search!SearchView&Query=CBAT45TU9S lotus-notes-bypass-ecl(5045) Some telnet clients allow remote telnet servers to request environment variables from the client that may contain sensitive information, or remote web servers to obtain the information via a telnet: URL. VU#22404 telnet-obtain-env-variable(6644) The presence of the Distributed GL Daemon (dgld) service on port 5232 on SGI IRIX systems allows remote attackers to identify the target host as an SGI system. VU#28027 HTTP server on the WatchGuard SOHO firewall does not properly restrict access to administrative functions such as password resets or rebooting, which allows attackers to cause a denial of service or conduct unauthorized activities. 2119 20001214 Multiple vulnerabilities in the WatchGuard SOHO Firewall watchguard-soho-web-auth(5554) Buffer overflow in HTTP server on the WatchGuard SOHO firewall allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long GET request. 2114 20001214 Multiple vulnerabilities in the WatchGuard SOHO Firewall watchguard-soho-web-dos(5218) WatchGuard SOHO firewall allows remote attackers to cause a denial of service via a flood of fragmented IP packets, which causes the firewall to drop connections and stop forwarding packets. 2113 20001214 Multiple vulnerabilities in the WatchGuard SOHO Firewall watchguard-soho-fragmented-packets(5749) Small HTTP Server 2.03 and earlier allows remote attackers to cause a denial of service by repeatedly requesting a URL that references a directory that does not contain an index.html file, which consumes memory that is not released after the request is completed. http://home.lanck.net/mf/srv/index.htm 20001114 Vulnerabilites in SmallHTTP Server 1941 small-http-nofile-dos(5524) Small HTTP Server 2.01 does not properly process Server Side Includes (SSI) tags that contain null values, which allows local users, and possibly remote attackers, to cause the server to crash by inserting the SSI into an HTML file. 20001114 Vulnerabilites in SmallHTTP Server Small HTTP Server 2.01 allows remote attackers to cause a denial of service by connecting to the server and sending out multiple GET, HEAD, or POST requests and closing the connection before the server responds to the requests. 20001114 Vulnerabilites in SmallHTTP Server 1942 Directory traversal vulnerability in ssi CGI program in thttpd 2.19 and earlier allows remote attackers to read arbitrary files via a "%2e%2e" string, a variation of the .. (dot dot) attack. FreeBSD-SA-00:73 20001002 thttpd ssi: retrieval of arbitrary world-readable files 1737 acme-thttpd-ssi(5313) Format string vulnerability in screen 3.9.5 and earlier allows local users to gain root privileges via format characters in the vbell_msg initialization variable. FreeBSD-SA-00:46 20000906 Screen-3.7.6 local compromise MDKSA-2000:044 20000906 screen format string parsing security problem RHSA-2000:058 20000905 screen 3.9.5 root vulnerability 1641 screen-format-string(5188) getalbum.php in PhotoAlbum before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000907 Re: PhotoAlbum 0.9.9 explorer.php Vulnerability phpphotoalbum-getalbum-directory-traversal(5209) Directory traversal vulnerability in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20000901 Multiple QNX Voyager Issues 1648 Voyager web server 2.01B in the demo disks for QNX 405 stores sensitive web client information in the .photon directory in the web document root, which allows remote attackers to obtain that information. 20000901 Multiple QNX Voyager Issues 1648 QNX Embedded Resource Manager in Voyager web server 2.01B in the demo disks for QNX 405 allows remote attackers to read sensitive system statistics information via the embedded.html web page. 20000901 Multiple QNX Voyager Issues 1648 Directory traversal vulnerability in Moreover.com cached_feed.cgi script version 4.July.00 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the category or format parameters. 20001002 Moreover Cached_Feed CGI Vulnerability 1762 moreover-cgi-dir-traverse(5334) EServ 2.92 Build 2982 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long HELO and MAIL FROM commands. 20000925 DST2K0030: DoS in EServ 2.92 Build 2982 BrowseGate 2.80 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long Authorization or Referer MIME headers in the HTTP request. 20000921 DST2K0031: DoS in BrowseGate(Home) v2.80(H) 20000921 DST2K0031: DoS in BrowseGate(Home) v2.80(H) http://www.netcplus.com/browsegate.htm#BGLatest 1702 browsegate-http-dos(5270) Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via a long From: header. FreeBSD-SA-00:59 20001031 FW: Pine 4.30 now available MDKSA-2000:073 RHSA-2000:102 20000922 [ no subject ] 1709 pine-check-mail-bo(5283) Horde library 1.02 allows attackers to execute arbitrary commands via shell metacharacters in the "from" address. 20000908 horde library bug - unchecked from-address http://ssl.coc-ag.de/sec/hordelib-1.2.0.frombug.patch 20000910 imp: remote compromise 1674 horde-imp-sendmail-command(5278) IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment. 20000912 (SRADV00003) Arbitrary file disclosure through IMP 1679 imp-attach-file(5227) MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the "multi" parameter. 20000913 MultiHTML vulnerability http-cgi-multihtml(5285) mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression. 20000929 Security vulnerability in Apache mod_rewrite 20001011 Conectiva Linux Security Announcement - apache HPSBUX0010-126 CSSA-2000-035.0 MDKSA-2000:060 RHSA-2000:088 RHSA-2000:095 1728 apache-rewrite-view-files(5310) OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests. 20001005 obsd_fun.c 1759 bsd-arp-request-dos(5340) fingerd in FreeBSD 4.1.1 allows remote attackers to read arbitrary files by specifying the target file name instead of a regular user name. FreeBSD-SA-00:54 20001002 [sa2c@and.or.jp: bin/21704: enabling fingerd makes files world readable] 1803 freebsd-fingerd-files(5385) FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an insufficient random number generator to generate initial TCP sequence numbers (ISN), which allows remote attackers to spoof TCP connections. FreeBSD-SA-00:52 1766 Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands. FreeBSD-SA-00:56 20000925 Format strings: bug #2: LPRng CSSA-2000-033.0 CA-2000-22 RHSA-2000:065 1712 lprng-format-string(5287) Format string vulnerability in kvt in KDE 1.1.2 may allow local users to execute arbitrary commands via a DISPLAY environmental variable that contains formatting characters. 20000919 kvt format bug 1700 Directory traversal vulnerability in PHPix Photo Album 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20001007 PHPix advisory 1773 phpix-dir-traversal(5331) Directory traversal vulnerability in BOA web server 0.94.8.2 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack in the GET HTTP request that uses a "%2E" instead of a "." FreeBSD-SA-00:60 20001006 Vulnerability in BOA web server v0.94.8.2 20001009 boa: exposes contents of local files 1770 boa-webserver-get-dir-traversal(5330) Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter. 20001007 Security Advisory: Hassan Consulting's shop.cgi Directory Traversal Vulnerability. 1777 hassan-shopping-cart-dir-traversal(5342) Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack on the newpage parameter. 20001008 Security Advisory: Bytes Interactive's Web Shopper (shopper.cgi) Directory Traversal Vulnerability 1776 web-shopper-directory-traversal(5351) authenticate.cgi CGI program in Aplio PRO allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter. 20001006 Fwd: APlio PRO web shell 1784 uclinux-apliophone-bin-execute(5333) Directory traversal vulnerability in search.cgi CGI script in Armada Master Index allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "catigory" parameter. 20001009 Master Index traverse advisory 1772 master-index-directory-traversal(5355) The default installation of SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) installs the _private directory with world readable permissions, which allows remote attackers to obtain sensitive information. 20001002 DST2K0035: Credit card (customer) details exposed within CyberOff ice Shopping Cart v2 20001002 DST2K0035: Credit card (customer) details exposed within CyberOff ice Shopping Cart v2 1734 cyberoffice-world-readable-directory(5318) SmartWin CyberOffice Shopping Cart 2 (aka CyberShop) allows remote attackers to modify price information by changing the "Price" hidden form variable. 20001002 DST2K0036: Price modification possible in CyberOffice Shopping Ca rt 20001002 DST2K0036: Price modification possible in CyberOffice Shopping Cart 1733 cyberoffice-price-modification(5319) WQuinn QuotaAdvisor 4.1 does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions. 20000928 DST2K0037: QuotaAdvisor 4.1 by WQuinn is susceptible to alternati ve datastreams to bypass quotas. 20000928 DST2K0037: QuotaAdvisor 4.1 by WQuinn is susceptible to alternati ve datastreams to bypass quotas. 1724 quotaadvisor-quota-bypass(5302) WQuinn QuotaAdvisor 4.1 allows users to list directories and files by running a report on the targeted shares. 20001006 DST2K0040: QuotaAdvisor 4.1 by WQuinn susceptible to any user bei ng able to list (not read) all files on any server running QuotaAdvisor. 1765 quotaadvisor-list-files(5327) Microsoft Windows Media Player 7 allows attackers to cause a denial of service in RTF-enabled email clients via an embedded OCX control that is not closed properly, aka the "OCX Attachment" vulnerability. 20000929 Malformed Embedded Windows Media Player 7 "OCX Attachment" 1714 MS00-068 mediaplayer-outlook-dos(5309) Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch. 20001003 Pegasus mail file reading vulnerability 20001030 Pegasus Mail file reading vulnerability 1738 pegasus-file-forwarding(5326) Buffer overflow in Pegasus Mail 3.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long email message containing binary data. 20001004 Another Pegasus Mail vulnerability 1750 MAILsweeper for SMTP 3.x does not properly handle corrupt CDA documents in a ZIP file and hangs, which allows remote attackers to cause a denial of service. 20000926 FW: DOS for Content Technologies' MAILsweeper for SMTP. mailsweeper-smtp-dos(5641) The Input Method Editor (IME) in the Simplified Chinese version of Windows 2000 does not disable access to privileged functionality that should normally be restricted, which allows local users to gain privileges, aka the "Simplified Chinese IME State Recognition" vulnerability. 1729 MS00-069 win2k-simplified-chinese-ime(5301) Glint in Red Hat Linux 5.2 allows local users to overwrite arbitrary files and cause a denial of service via a symlink attack. RHSA-2000:062 1703 glint-symlink(5271) Samba Web Administration Tool (SWAT) in Samba 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file. 20001030 Samba 2.0.7 SWAT vulnerabilities 1872 samba-swat-logging-sym-link(5443) Samba Web Administration Tool (SWAT) in Samba 2.0.7 installs the cgi.log logging file with world readable permissions, which allows local users to read sensitive information such as user names and passwords. 20001030 Samba 2.0.7 SWAT vulnerabilities 1874 samba-swat-logfile-info(5445) Samba Web Administration Tool (SWAT) in Samba 2.0.7 does not log login attempts in which the username is correct but the password is wrong, which allows remote attackers to conduct brute force password guessing attacks. 20001030 Samba 2.0.7 SWAT vulnerabilities 1873 samba-swat-brute-force(5442) Samba Web Administration Tool (SWAT) in Samba 2.0.7 supplies a different error message when a valid username is provided versus an invalid name, which allows remote attackers to identify valid users on the server. 20001030 Samba 2.0.7 SWAT vulnerabilities samba-swat-brute-force(5442) Samba Web Administration Tool (SWAT) in Samba 2.0.7 allows remote attackers to cause a denial of service by repeatedly submitting a nonstandard URL in the GET HTTP request and forcing it to restart. 20001030 Samba 2.0.7 SWAT vulnerabilities samba-swat-url-filename-dos(5444) Directory traversal vulnerability in Metertek pagelog.cgi allows remote attackers to read arbitrary files via a .. (dot dot) attack on the "name" or "display" parameter. 20001029 Minor bug in Pagelog.cgi 1864 pagelog-cgi-dir-traverse(5451) Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the "whois" parameter. 20001029 Remote command execution via KW Whois 1.0 20001029 Re: Remote command execution via KW Whois 1.0 (addition) http://www.kootenayweb.bc.ca/scripts/whois.txt 1883 kw-whois-meta(5438) The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via a CiRestriction parameter in a .htw request, aka the "Indexing Services Cross Site Scripting" vulnerability. 20001028 IIS 5.0 cross site scripting vulnerability - using .htw 1861 MS00-084 iis-htw-cross-scripting(5441) Buffer overflow in bftp daemon (bftpd) 1.0.11 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER command. 20001027 Potential Security Problem in bftpd-1.0.11 1858 bftpd-user-bo(5426) CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password. 20001027 CGI-Bug: News Update 1.1 administration password bug 1881 news-update-bypass-password(5433) The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory. 20001026 Advisory def-2000-02: Cisco Catalyst remote command execution 20001113 Re: 3500XL 1846 cisco-catalyst-remote-commands(5415) Compaq Easy Access Keyboard software 1.3 does not properly disable access to custom buttons when the screen is locked, which could allow an attacker to gain privileges or execute programs without authorization. 20001012 Security issue with Compaq Easy Access Keyboard software http://www5.compaq.com/support/files/desktops/us/revision/1723.html compaq-ea-elevate-privileges(5718) Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the CAUTH command. NetBSD-SA2000-013 20001002 Very probable remote root vulnerability in cfengine MDKSA-2000:061 1757 cfengine-cfd-format-string(5630) GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack. 20001003 Conectiva Linux Security Announcement - gnorpm 20001011 Immunix OS Security Update for gnorpm package MDKSA-2000:055 RHSA-2000:072 20001002 GnoRPM local /tmp vulnerability 1761 gnorpm-temp-symlink(5317) Heap overflow in savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option. 20000928 Very interesting traceroute flaw 20000930 Conectiva Linux Security Announcement - traceroute CSSA-2000-034.0 20001013 traceroute: local root exploit MDKSA-2000:053 RHSA-2000:078 1739 TLSA2000023-1 traceroute-heap-overflow(5311) Format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) allows local users to execute arbitrary commands via a malformed display name. 20001026 FWTK x-gw Security Advisory [GSA2000-01] tisfwtk-xgw-execute-code(5420) A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a Web Distributed Authoring and Versioning (WebDAV) search. A100400-1 Q272079 1756 iis-index-dir-traverse(5335) global.cgi CGI program in Global 3.55 and earlier on NetBSD allows remote attackers to execute arbitrary commands via shell metacharacters. NetBSD-SA2000-014 global-execute-remote-commands(5424) Shambala Server 4.5 allows remote attackers to cause a denial of service by opening then closing a connection. 20001009 Shambala 4.5 vulnerability 1778 shambala-connection-dos(5345) Shambala Server 4.5 stores passwords in plaintext, which could allow local users to obtain the passwords and compromise the server. 20001009 Shambala 4.5 vulnerability 1771 shambala-password-plaintext(5346) Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges. A102600-1 1885 cisco-vco-snmp-passwords(5425) cyrus-sasl before 1.5.24 in Red Hat Linux 7.0 does not properly verify the authorization for a local user, which could allow the users to bypass specified access restrictions. RHSA-2000:094 1875 cyrus-sasl-gain-access(5427) The pluggable authentication module for mysql (pam_mysql) before 0.4.7 does not properly cleanse user input when constructing SQL statements, which allows attackers to obtain plaintext passwords or hashes. 20001026 (SRADV00004) Remote and local vulnerabilities in pam_mysql pammysql-auth-input(5447) HotJava Browser 3.0 allows remote attackers to access the DOM of a web page by opening a javascript: URL in a named window. 20001025 HotJava Browser 3.0 JavaScript security vulnerability hotjava-browser-dom-access(5428) glibc2 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack. 20000926 ld.so bug - LD_DEBUG_OUTPUT follows symlinks 1719 glibc-unset-symlink(5299) The POP3 server in Netscape Messaging Server 4.15p1 generates different error messages for incorrect user names versus incorrect passwords, which allows remote attackers to determine valid users on the system and harvest email addresses for spam abuse. 20001011 Netscape Messaging server 4.15 poor error strings 1787 netscape-messaging-email-verify(5364) Buffer overflow in IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command. 20000928 commercial products and security [ + new bug ] 1721 netscape-messaging-list-dos(5292) The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service. 20000925 Nmap Protocol Scanning DoS against OpenBSD IPSEC 1723 openbsd-nmap-dos(5634) Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFO_DIRS. CSSA-2000-036.0 20001009 ncurses buffer overflows 1142 gnu-ncurses-term-terminfodirs-bo(44487) Buffer overflow in the web administration service for the HiNet LP5100 IP-phone allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request. 20000928 Another thingy. 1727 hinet-ipphone-get-bo(5298) The NSAPI plugins for TGA and the Java Servlet proxy in HP-UX VVOS 10.24 and 11.04 allows an attacker to cause a denial of service (high CPU utilization). HPSBUX0010-124 hp-virtualvault-nsapi-dos(5361) Buffer overflows in lpspooler in the fileset PrinterMgmt.LP-SPOOL of HP-UX 11.0 and earlier allows local users to gain privileges. HPSBUX0010-125 hp-lpspooler-bo(5379) PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs. FreeBSD-SA-00:75 20001012 Conectiva Linux Security Announcement - mod_php3 A101200-1 CSSA-2000-037.0 MDKSA-2000:062 RHSA-2000:088 RHSA-2000:095 1786 php-logging-format-string(5359) Buffer overflow in Half Life dedicated server before build 3104 allows remote attackers to execute arbitrary commands via a long rcon command. 20001016 Half-Life Dedicated Server Vulnerability 20001027 Re: Half Life dedicated server Patch 20001024 Tamandua Sekure Labs Security Advisory 2000-01 1799 halflife-server-changelevel-bo(5375) Format string vulnerability in Half Life dedicated server build 3104 and earlier allows remote attackers to execute arbitrary commands by injecting format strings into the changelevel command, via the system console or rcon. 20001016 Half-Life Dedicated Server Vulnerability 20001027 Re: Half Life dedicated server Patch 20001024 Tamandua Sekure Labs Security Advisory 2000-01 halflife-rcon-format-string(5413) IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability. http://www.acrossecurity.com/aspr/ASPR-2000-07-22-1-PUB.txt MS00-080 session-cookie-remote-retrieval(5396) Avirt Mail 4.0 and 4.2 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long "RCPT TO" or "MAIL FROM" command. 20001023 Avirt Mail 4.x DoS avirt-mail-from-dos(5397) avirt-rcpt-to-dos(5398) HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates. 20001020 [ Hackerslab bug_paper ] HP-UX crontab temporary file symbolic link vulnerability hp-crontab-read-files(5410) Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by forcing a long error message to be generated. FreeBSD-SA-00:72 RHBA-2000:092-01 1804 curl-error-bo(5374) GnuPG (gpg) 1.0.3 does not properly check all signatures of a file containing multiple documents, which allows an attacker to modify contents of all documents but the first without detection. CSSA-2000-038.0 FreeBSD-SA-00:67 20001011 GPG 1.0.3 doesn't detect modifications to files with multiple signatures 20001025 Immunix OS Security Update for gnupg package CLSA-2000:334 20001111 gnupg: incorrect signature verification RHSA-2000:089 1797 gnupg-message-modify(5386) Directory traversal vulnerability in apexec.pl in Anaconda Foundation Directory allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20001012 Anaconda Advisory anaconda-apexec-directory-traversal(5750) Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display command line parameter. 20020502-01-I 20001012 another Xlib buffer overflow xfree-xlib-bo(5751) 1805 mailfile.cgi CGI program in MailFile 1.10 allows remote attackers to read arbitrary files by specifying the target file name in the "filename" parameter in a POST request, which is then sent by email to the address specified in the "email" parameter. 20001011 Mail File POST Vulnerability 1807 mailfile-post-file-read(5358) bbd server in Big Brother System and Network Monitor before 1.5c2 allows remote attackers to execute arbitrary commands via the "&" shell metacharacter. 20001010 Big Brother Systems and Network Monitor vulnerability 1779 bb4-netmon-execute-commands(5719) File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability. 20001012 NSFOCUS SA2000-05: Microsoft Windows 9x NETBIOS password 1780 MS00-072 win9x-share-level-password(5395) oval:org.mitre.oval:def:996 NMPI (Name Management Protocol on IPX) listener in Microsoft NWLink does not properly filter packets from a broadcast address, which allows remote attackers to cause a broadcast storm and flood the network. 1781 MS00-073 win-nmpi-packet-dos(5357) MySQL Database Engine uses a weak authentication method which leaks information that could be used by a remote attacker to recover the password. 20001023 [CORE SDI ADVISORY] MySQL weak authentication http://www.mysql.com/documentation/mysql/commented/manual.php?section=Security mysql-authentication(5409) Internet Explorer before 5.5 forwards cached user credentials for a secure web site to insecure pages on the same web site, which could allow remote attackers to obtain the credentials by monitoring connections to the web server, aka the "Cached Web Credentials" vulnerability. http://www.acrossecurity.com/aspr/ASPR-2000-07-22-2-PUB.txt 1793 MS00-076 ie-cache-info(5367) Microsoft NetMeeting with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service (CPU utilization) via a sequence of null bytes to the NetMeeting port, aka the "NetMeeting Desktop Sharing" vulnerability. Q273854 20001018 Denial of Service attack against computers running Microsoft NetMeeting 1798 MS00-077 netmeeting-desktop-sharing-dos(5368) The HTTP server in Cisco IOS 12.0 through 12.1 allows local users to cause a denial of service (crash and reload) via a URL containing a "?/" string. 20001025 Cisco IOS HTTP Server Query Vulnerability 1838 cisco-ios-query-dos(5412) Buffer overflow in All-Mail 1.1 allows remote attackers to execute arbitrary commands via a long "MAIL FROM" or "RCPT TO" command. A101200-2 1789 Buffer overflow in Oracle 8.1.5 applications such as names, namesctl, onrsd, osslogin, tnslsnr, tnsping, trcasst, and trcroute possibly allow local users to gain privileges via a long ORACLE_HOME environmental variable. 20001020 [ Hackerslab bug_paper ] Linux ORACLE 8.1.5 vulnerability oracle-home-bo(5390) Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long "connect" command line parameter. 20001018 vulnerability in Oracle Internet Directory in Oracle 8.1.6 20001020 In response to posting 10/18/2000 vulnerability in Oracle Internet Directory in Oracle 8.1.6 oracle-oidldap-bo(5401) WinU 1.0 through 5.1 has a backdoor password that allows remote attackers to gain access to its administrative interface and modify configuration. 20001013 WinU Backdoor passwords!!!! http://www.bardon.com/pwdcrack.htm 1801 winu-backdoor(5376) Buffer overflow in Intel InBusiness eMail Station 1.04.87 POP service allows remote attackers to cause a denial of service and possibly execute commands via a long username. 20001020 DoS in Intel corporation 'InBusiness eMail Station' intel-email-username-bo(5414) cmd5checkpw 0.21 and earlier allows remote attackers to cause a denial of service via an "SMTP AUTH" command with an unknown username. 20001016 Authentication failure in cmd5checkpw 0.21 http://members.elysium.pl/brush/cmd5checkpw/changes.html 1809 cmd5checkpw-qmail-bypass-authentication(5382) Buffer overflow in Hilgraeve, Inc. HyperTerminal client on Windows 98, ME, and 2000 allows remote attackers to execute arbitrary commands via a long telnet URL, aka the "HyperTerminal Buffer Overflow" vulnerability. 1815 MS00-079 win-hyperterminal-telnet-bo(5387) Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack. 20000930 scp file transfer hole MDKSA-2000:057 1742 scp-overwrite-files(5312) Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd. FreeBSD-SA-00:58 NetBSD-SA2000-015 20001004 Re: OpenBSD Security Advisory 20001003 A format string vulnerability exists in the pw_error(3) function. 1744 bsd-libutil-format(5339) Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch 20001004 Re: OpenBSD Security Advisory 1746 bsd-fstat-format(5338) Format string vulnerability in OpenBSD yp_passwd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch bsd-yp-passwd-format(5635) Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch bsd-su-format(5636) Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch 1752 bsd-eeprom-format(5337) Format string vulnerability in top program allows local attackers to gain root privileges via the "kill" or "renice" function. FreeBSD-SA-00:62 ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch 1895 Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privileges. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.7/common/028_format_strings.patch Format string vulnerability in AOL Instant Messenger (AIM) 4.1.2010 allows remote attackers to cause a denial of service and possibly execute arbitrary commands by transferring a file whose name includes format characters. 20001003 AOL Instant Messenger DoS 1747 aim-file-transfer-dos(5314) add_2_basket.asp in Element InstantShop allows remote attackers to modify price information via the "price" hidden form variable. 20001024 Price modification in Element InstantShop instantshop-modify-price(5402) POP3 daemon in Stalker CommuniGate Pro 3.3.2 generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to determine valid email addresses on the server for SPAM attacks. 20001012 Re: Netscape Messaging server 4.15 poor error strings 1792 communigate-email-verify(5363) NETBIOS client in Windows 95 and Windows 98 allows a remote attacker to cause a denial of service by changing a file sharing service to return an unknown driver type, which causes the client to crash. 20001012 NSFOCUS SA2000-04: Microsoft Win9x client driver type comparing vulnerability 1794 win-netbios-driver-type-dos(5370) Format string vulnerability in OpenBSD photurisd allows local users to execute arbitrary commands via a configuration file directory name that contains formatting characters. 20001004 Re: OpenBSD Security Advisory bsd-photurisd-format(5336) Directory traversal vulnerability in html_web_store.cgi and web_store.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary files via a .. (dot dot) attack on the page parameter. 20001009 Security Advisory : eXtropia WebStore (web_store.cgi) Directory Traversal Vulnerability 1774 extropia-webstore-fileread(5347) Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause a denial of service via a charset="" command, aka the "Malformed MIME Header" vulnerability. 1869 MS00-082 ms-exchange-mime-dos(5448) I-gear 3.5.7 and earlier does not properly process log entries in which a URL is longer than 255 characters, which allows an attacker to cause reporting errors. 20001025 I-gear 3.5.x for Microsoft Proxy logging vulnerability + temporary fix. igear-invalid-log(5791) PalmOS 3.5.2 and earlier uses weak encryption to store the user password, which allows attackers with physical access to the Palm device to decrypt the password and gain access to the device. A092600-1 1715 dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program. 20001030 Redhat 6.2 dump command executes external program with suid priviledge. 1871 linux-dump-execute-code(5437) Format string vulnerability in talkd in OpenBSD and possibly other BSD-based OSes allows remote attackers to execute arbitrary commands via a user name that contains format characters. 20001006 talkd [WAS: Re: OpenBSD Security Advisory] 1764 linux-talkd-overwrite-root(5344) Buffer overflow in catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable. FreeBSD-SA-00:53 freebsd-catopen-bo(5638) The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable. FreeBSD-SA-00:53 The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable. FreeBSD-SA-00:53 Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitrary commands via format characters in the queryText parameter. 20000927 Unixware SCOhelp http server format string vulnerability 1717 unixware-scohelp-format(5291) The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, which allows remote attackers to gain Slashcode privileges and possibly execute arbitrary commands. 20000929 Default admin password with Slashcode. 1731 slashcode-default-admin-passwords(5306) The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL. 20000921 httpd.conf in Suse 6.4 1707 suse-installed-packages-exposed(5276) Webteachers Webdata allows remote attackers with valid Webdata accounts to read arbitrary files by posting a request to import the file into the WebData database. 20001002 DST2K0039: Webteachers Webdata: Importing files lower than web ro ot possible in to database 20001003 Update to DST2K0039: Webteachers Webdata: Importing files lower t han web root possible in to database 1732 shred 1.0 file wiping utility does not properly open a file for overwriting or flush its buffers, which prevents shred from properly replacing the file's data and allows local users to recover the file. 20001010 Shred 1.0 Bug Report 20001011 Shred v1.0 Fix 1788 shred-recover-files(5722) Search engine in Ultraseek 3.1 and 3.1.10 (aka Inktomi Search) allows remote attackers to cause a denial of service via a malformed URL. 20001030 Ultraseek 3.1.x Remote DoS Vulnerability 1866 ultraseek-malformed-url-dos(5439) Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL. 20000917 VIGILANTE-2000012: Mdaemon Web Services Heap Overflow DoS 1689 mdaemon-url-dos(5250) Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL. 20000917 VIGILANTE-2000012: Mdaemon Web Services Heap Overflow DoS 1689 mdaemon-url-dos(5250) The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, which allows remote attackers to execute restricted commands by sending a DATA command before sending the restricted commands. 20000919 Cisco PIX Firewall (smtp content filtering hack) 20000920 Re: Cisco PIX Firewall (smtp content filtering hack) - Version 4.2(1) not exploitable 20001005 Cisco Secure PIX Firewall Mailguard Vulnerability 1698 cisco-pix-smtp-filtering(5277) The Alabanza Control Panel does not require passwords to access administrative commands, which allows remote attackers to modify domain name information via the nsManager.cgi CGI program. 20000924 Major Vulnerability in Alabanza Control Panel 1710 alabanza-unauthorized-access(5284) eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet, which allows remote attackers to upload files and execute arbitrary commands. 20001101 Unify eWave ServletExec upload 1876 ewave-servletexec-file-upload(5450) eWave ServletExec JSP/Java servlet engine, versions 3.0C and earlier, allows remote attackers to cause a denial of service via a URL that contains the "/servlet/" string, which invokes the ServletExec servlet and causes an exception if the servlet is already running. 20001030 Unify eWave ServletExec DoS 1868 ewave-servletexec-dos(5435) Multiple buffer overflows in LBNL tcpdump allow remote attackers to execute arbitrary commands. FreeBSD-SA-00:61 SuSE-SA:2000:46 1870 tcpdump-afs-packet-overflow(5480) Cisco Secure PIX Firewall 5.2(2) allows remote attackers to determine the real IP address of a target FTP server by flooding the server with PASV requests, which includes the real IP address in the response when passive mode is established. 20001003 Cisco PIX Firewall allow external users to discover internal IPs 1877 cisco-pix-reveal-address(5646) Buffer overflow in cu program in HP-UX 11.0 may allow local users to gain privileges via a long -l command line argument. 20001102 HPUX cu -l option buffer overflow vulnerabilit 1886 hp-cu-bo(5460) Buffer overflow in host command allows a remote attacker to execute arbitrary commands via a long response to an AXFR query. 20001027 old version of host command vulnearbility 1887 isc-bind-axfr-bo(5462) CS&T CorporateTime for the Web returns different error messages for invalid usernames and invalid passwords, which allows remote attackers to determine valid usernames on the server. 20001031 Re: Samba 2.0.7 SWAT vulnerabilities 1888 corporatetime-brute-force(5529) Buffer overflow in dtterm in HP-UX 11.0 and HP Tru64 UNIX 4.0f through 5.1a allows local users to execute arbitrary code via a long -tn option. 20020919 iDEFENSE OSF1/Tru64 3.x vuln clarification HPSBUX0011-128 SSRT2275 VU#320067 20020902 Happy Labor Day from Snosoft 20000810 Re: Possible vulnerability in HPUX ( Add vulnerability List ) 1889 hp-dtterm(5461) The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to identify valid usernames on the firewall. 20001101 Re: Samba 2.0.7 SWAT vulnerabilities 1890 fw1-login-response(5816) Serv-U FTP Server allows remote attackers to bypass its anti-hammering feature by first logging on as a valid user (possibly anonymous) and then attempting to guess the passwords of other users. 20001029 Brute Forcing FTP Servers with enabled anti-hammering (anti brute-force) modus 1860 ftp-servu-brute-force(5436) Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows remote attackers to execute arbitrary commands via a long LogFileName parameter in HTML source code, aka the "ActiveX Parameter Validation" vulnerability. 20001106 System Monitor ActiveX Buffer Overflow Vulnerability 1899 MS00-085 system-monitor-activex-bo(5467) Buffer overflows in TYPSoft FTP Server 0.78 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER, PASS, or CWD command. 20000912 TYPSoft FTP Server remote DoS Problem 1690 http://www.synnergy.net/Archives/Advisories/dethy/typsoft-ftpd.txt Directory traversal vulnerability in Extent RBS ISP web server allows remote attackers to read sensitive information via a .. (dot dot) attack on the Image parameter. 20000920 Extent RBS directory Transversal. 1704 rbs-isp-directory-traversal(5275) Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack. 20000815 Firewall-1 session agent 3.0 -> 4.1, dictionnary and brute force attack 1662 The web administration interface for IBM AS/400 Firewall allows remote attackers to cause a denial of service via an empty GET request. http://as400service.rochester.ibm.com/n_dir/nas4apar.NSF/5ec6cdc6ab42894a862568f90073c74a/9ce636030a58807186256955003d128d?OpenDocument SA90544 as400-firewall-dos(5266) Various TCP/IP stacks and network applications allow remote attackers to cause a denial of service by flooding a target host with TCP connection attempts and completing the TCP/IP handshake without maintaining the connection state on the attacker host, aka the "NAPTHA" class of vulnerabilities. NOTE: this candidate may change significantly as the security community discusses the technical nature of NAPTHA and learns more about the affected applications. This candidate is at a higher level of abstraction than is typical for CVE. 20001204 NAPTHA Advisory Updated - BindView RAZOR 20001130 The NAPTHA DoS vulnerabilities CA-2000-21 2022 MS00-091 Format string vulnerability in logging function of ypbind 3.3, while running in debug mode, leaks file descriptors and allows an attacker to cause a denial of service. 20001025 Immunix OS Security Update for ypbind package 20001030 Trustix Security Advisory - ping gnupg ypbind SuSE-SA:2000:042 CSSA-2000-039.0 20001014 nis: local exploit MDKSA-2000:064 RHSA-2000:086 1820 ypbind-printf-format-string(5394) Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges. SuSE-SA:2000:042 CSSA-2000-039.0 MDKSA-2000:064 ypbind-remote-bo(5759) Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function. MDKSA-2000:064 linux-ypserv-bo(5730) Format string vulnerability in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allows an attacker to gain root privileges when ypserv is built without a vsyslog() function. MDKSA-2000:064 linux-ypserv-format-string(5731) Format string vulnerability in ypbind-mt in SuSE SuSE-6.2, and possibly other Linux operating systems, allows an attacker to gain root privileges. SuSE-SA:2000:042 1820 ypbind-printf-format-string(5394) nss_ldap earlier than 121, when run with nscd (name service caching daemon), allows remote attackers to cause a denial of service via a flood of LDAP requests. MDKSA-2000-066 RHSA-2000:024 1863 nssldap-nscd-dos(5449) Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long (1) "RCPT TO," (2) "SAML FROM," or (3) "SOML FROM" commands. 20000911 Advisory Code: VIGILANTE-2000011 Lotus Domino ESMTP Service Buffer overflow Buffer overflow in SMTP service of Lotus Domino 5.0.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long ENVID keyword in the "MAIL FROM" command. 20001103 [SAFER] Buffer overflow in Lotus Domino SMTP Server 1905 lotus-domino-smtp-envid(5488) Directory traversal vulnerability in the logfile service of Wingate 4.1 Beta A and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack via an HTTP GET request that uses encoded characters in the URL. 20001016 Wingate 4.1 Beta A vulnerability wingate-view-files(5373) Allaire JRun 3.0 http servlet server allows remote attackers to cause a denial of service via a URL that contains a long string of "." characters. 20001101 Allaire's JRUN DoS ASB00-030 allaire-jrun-servlet-dos(5452) Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request (aka the "extra leading slash"). 20001023 Allaire's JRUN Unauthenticated Access to WEB-INF directory ASB00-027 allaire-jrun-webinf-access(5407) Directory traversal vulnerability in Allaire JRun 2.3 server allows remote attackers to read arbitrary files via the SSIFilter servlet. 20001023 Allaire JRUN 2.3 Arbitrary File Retrieval ASB00-028 allaire-jrun-ssifilter-url(5405) Allaire JRun 2.3 server allows remote attackers to obtain source code for executable content by directly calling the SSIFilter servlet. 20001023 Allaire JRUN 2.3 Arbitrary File Retrieval Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet. 20001023 Allaire JRUN 2.3 Remote command execution ASB00-029 allaire-jrun-jsp-execute(5406) Buffer overflow in CSAdmin module in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large packet. 20000921 Multiple Vulnerabilities in CiscoSecure ACS for Windows NT Server 1705 ciscosecure-csadmin-bo(5272) Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet. 20000921 Multiple Vulnerabilities in CiscoSecure ACS for Windows NT Server 1706 ciscosecure-tacacs-dos(5273) CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to bypass LDAP authentication on the server if the LDAP server allows null passwords. 20000921 Multiple Vulnerabilities in CiscoSecure ACS for Windows NT Server 1708 ciscosecure-ldap-bypass-authentication(5274) Vulnerabilities in database configuration scripts in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows local users to gain privileges, possibly via insecure permissions. HPSBUX0009-120 1682 hp-openview-nnm-scripts(5229) Buffer overflow in OverView5 CGI program in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, in the SNMP service (snmp.exe), aka the "Java SNMP MIB Browser Object ID parsing problem." HPSBUX0009-121 20000926 DST2K0014: BufferOverrun in HP Openview Network Node Manager v6.1 (Round2) openview-nmm-snmp-bo(5282) The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges. MDKSA-2000:052 20000929 Mandrake 7.1 bypasses Xauthority X session security. 1735 xinitrc-bypass-xauthority(5305) The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffic and gain privileges. 20001002 Local vulnerability in XFCE 3.5.1 1736 xinitrc-bypass-xauthority(5305) Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote attacker to bypass Internet Explorer's security settings and execute arbitrary commands via a malicious web page or email, aka the "Microsoft VM ActiveX Component" vulnerability. MS00-075 java-vm-applet(5127) Buffer overflow in the FTP service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of service. 20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS 1775 hp-jetdirect-firmware-dos(5353) Buffer overflow in the Telnet service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of service. 20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS 1775 hp-jetdirect-firmware-dos(5353) Buffer overflow in the LPD service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of service. 20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS 1775 hp-jetdirect-firmware-dos(5353) Vulnerability in IP implementation of HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of service (printer crash) via a malformed packet. 20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS 1775 hp-jetdirect-ip-implementation(5354) The getnameinfo function in FreeBSD 4.1.1 and earlier, and possibly other operating systems, allows a remote attacker to cause a denial of service via a long DNS hostname. FreeBSD-SA-00:63 1894 getnameinfo-dos(5454) pollit.cgi in Poll It 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter. 20001023 Re: Poll It v2.0 cgi (again) http://www.cgi-world.com/pollit.html pollit-polloptions-execute-commands(5792) pollit.cgi in Poll It 2.01 and earlier allows remote attackers to access administrative functions without knowing the real password by specifying the same value to the entered_password and admin_password parameters. 20001023 Re: Poll It v2.0 cgi (again) pollit-admin-password-var(5419) pollit.cgi in Poll It 2.01 and earlier uses data files that are located under the web document root, which allows remote attackers to access sensitive or private information. 20001023 Re: Poll It v2.0 cgi (again) pollit-webroot-gain-access(5794) The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an "xhost +" command, which allows remote attackers to monitor X Windows events and gain privileges. A100900-1 1767 ical-xhost-gain-privileges(5752) iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse. A100900-1 1768 ical-iplncal-gain-access(5756) csstart program in iCal 2.1 Patch 2 searches for the cshttpd program in the current working directory, which allows local users to gain root privileges by creating a Trojan Horse cshttpd program in a directory and calling csstart from that directory. A100900-1 1769 ical-csstart-gain-access(5757) csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory. A100900-1 1769 ical-csstart-gain-access(5757) Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the Agent, End Entity, or Administrator services. 20001026 [CORE SDI ADVISORY] iPlanet Certificate Management System 4.2 path traversal bug http://www.iplanet.com/downloads/patches/0122.html 1839 iplanet-netscape-directory-traversal(5421) Netscape (iPlanet) Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and possibly remote attackers to gain administrative privileges on the server. 20001026 [CORE SDI ADVISORY] iPlanet Certificate Management System 4.2 path traversal bug iplanet-netscape-plaintext-password(5422) Buffer overflow in the SHTML logging functionality of iPlanet Web Server 4.x allows remote attackers to execute arbitrary commands via a long filename with a .shtml extension. 20001026 Buffer overflow in iPlanet Web Server 4 server side SHTML parsing module iplanet-web-server-shtml-bo(5446) ICQ Web Front HTTPd allows remote attackers to cause a denial of service by requesting a URL that contains a "?" character. 20001007 ICQ WebFront HTTPd DoS icq-webfront-url-dos(5332) Interactions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram. 20000829 Re: [COVERT-2000-10] Windows NetBIOS Unsolicited Cache Corruption 20000829 Windows NetBIOS Unsolicited Cache Corruption 1620 win-netbios-corrupt-cache(5168) oval:org.mitre.oval:def:1079 Quake 1 (quake1) and ProQuake 1.01 and earlier allow remote attackers to cause a denial of service via a malformed (empty) UDP packet. 20001102 dos on quake1 servers http://proquake.ai.mit.edu/ 1900 quake-empty-udp-dos(5527) The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 Microsoft SQL Server extended stored procedure vulnerability 2030 MS00-092 oval:org.mitre.oval:def:231 The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 Microsoft SQL Server extended stored procedure vulnerability 2031 MS00-092 The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 Microsoft SQL Server extended stored procedure vulnerability 2038 MS00-092 The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 Microsoft SQL Server extended stored procedure vulnerability 2039 MS00-092 The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 SQL Server 2000 Extended Stored Procedure Vulnerability 2040 MS00-092 The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 SQL Server 2000 Extended Stored Procedure Vulnerability 2041 MS00-092 The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 SQL Server 2000 Extended Stored Procedure Vulnerability 2042 MS00-092 The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability. 20001201 SQL Server 2000 Extended Stored Procedure Vulnerability 2043 MS00-092 Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the "Phone Book Service Buffer Overflow" vulnerability. 2048 A120400-1 MS00-094 phone-book-service-bo(5623) Microsoft IIS for Far East editions 4.0 and 5.0 allows remote attackers to read source code for parsed pages via a malformed URL that uses the lead-byte of a double-byte character. http://www.nsfocus.com/english/homepage/sa_08.htm 2100 microsoft-iis-file-disclosure(5729) loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a "/" in front of the target filename in the "file" parameter. 20001213 NSFOCUS SA2000-09 : AHG EZshopper Loadpage.cgi File List 2109 ezshopper-cgi-file-disclosure(5740) Buffer overflow in AOL Instant Messenger before 4.3.2229 allows remote attackers to execute arbitrary commands via a long "goim" command. A121200-1 aim-remote-bo(5732) Buffer overflow in AOL Instant Messenger (AIM) before 4.3.2229 allows remote attackers to execute arbitrary commands via a "buddyicon" command with a long "src" argument. 20001213 Administrivia & AOL IM Advisory 20001214 Re: AIM & @stake's advisory A121200-1 modprobe in the modutils 2.3.x package on Linux systems allows a local user to execute arbitrary commands via shell metacharacters. 20001112 RedHat 7.0 (and SuSE): modutils + netkit = root compromise. (fwd) SuSE-SA:2000:44 CLSA-2000:340 20001120 modutils: local exploit MDKSA-2000:071 RHSA-2000:108 1936 linux-modprobe-execute-code(5516) crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating world-writeable temporary files and modifying them while the victim is editing the file. 20001116 vixie cron... 1960 vixie-cron-execute-commands(5543) The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via a long username in the authentication page. 20001129 DoS in Sonicwall SOHO firewall 20001201 FW: SonicWALL SOHO Vulnerability (fwd) 2013 sonicwall-soho-dos(5596) The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via an empty GET or POST request. 20001201 FW: SonicWALL SOHO Vulnerability (fwd) 20001201 Re: DoS in Sonicwall SOHO firewall Java Runtime Environment in Java Development Kit (JDK) 1.2.2_05 and earlier can allow an untrusted Java class to call into a disallowed class, which could allow an attacker to escape the Java sandbox and conduct unauthorized activities. 00199 HPSBUX0011-132 jdk-untrusted-java-class(5605) The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web root, which allows remote attackers to read sensitive information such as database usernames and passwords via a direct HTTP GET request. 20001130 PostACI Webmail Vulnerability 2029 Directory traversal vulnerability in Winsock FTPd (WFTPD) 3.00 and 2.41 with the "Restrict to home directory" option enabled allows local users to escape the home directory via a "/../" string, a variation of the .. (dot dot) attack. 20001127 Vulnerability in Winsock FTPD 2.41/3.00 (Pro) wftpd-dir-traverse(5608) 2005 PTlink IRCD 3.5.3 and PTlink Services 1.8.1 allow remote attackers to cause a denial of service (server crash) via "mode +owgscfxeb" and "oper" commands. 20001126 Vulnerablity in PTlink3.5.3ircd + PTlink.Services.1.8.1... 2008 rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to gain privileges by specifying an alternate Trojan horse script on the command line. 20001127 BSDi 3.0/4.0 rcvtty gid=tty exploit... (mh package) 2009 Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site. MS00-060 The ixsso.query ActiveX Object is marked as safe for scripting, which allows malicious web site operators to embed a script that remotely determines the existence of files on visiting Windows 2000 systems that have Indexing Services enabled. 20001110 IE 5.x Win2000 Indexing service vulnerability 20001110 IE 5.x Win2000 Indexing service vulnerability 1933 Trend Micro InterScan VirusWall creates an "Intscan" share to the "InterScan" directory with permissions that grant Full Control permissions to the Everyone group, which allows attackers to gain privileges by modifying the VirusWall programs. 20001201 Responding to BugTraq ID 2014 - "Trend Micro InterScan VirusWall Shared Directory Vulnerability" 20001128 TrendMicro InterScan VirusWall shared folder problem 2014 interscan-viruswall-unauth-access(5606) in.identd ident server in SuSE Linux 6.x and 7.0 allows remote attackers to cause a denial of service via a long request, which causes the server to access a NULL pointer and crash. 20001128 SuSE Linux 6.x 7.0 Ident buffer overflow 2015 linux-ident-bo(5590) cons.saver in Midnight Commander (mc) 4.5.42 and earlier does not properly verify if an output file descriptor is a TTY, which allows local users to corrupt files by creating a symbolic link to the target file, calling mc, and specifying that link as a TTY argument. 20001113 Problems with cons.saver 20001125 mc: local DoS MDKSA-2000:078 1945 midnight-commander-conssaver-symlink(5519) Midnight Commander (mc) 4.5.51 and earlier does not properly process malformed directory names when a user opens a directory, which allows other local users to gain privileges by creating directories that contain special characters followed by the commands to be executed. 20001127 Midnight Commander DSA-036 SuSE-SA:2001:11 2016 midnight-commander-elevate-privileges(5929) document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a nonexistent command to the program. 20001128 IBM Net.Data Local Path Disclosure Vulnerability? 2017 Telnet Service for Windows 2000 Professional does not properly terminate incomplete connection attempts, which allows remote attackers to cause a denial of service by connecting to the server and not providing any input. 20001129 Windows 2000 Telnet Service DoS 2018 win2k-telnet-dos(5598) Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gain privileges via a skin that contains a malicious script, aka the ".WMS Script Execution" vulnerability. 1976 MS00-090 mediaplayer-wms-script-exe(5575) Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed Active Stream Redirector (.ASX) file, aka the ".ASX Buffer Overrun" vulnerability. A112300-1 1980 MS00-090 mediaplayer-asx-bo(5574) Unify ServletExec AS v3.0C allows remote attackers to read source code for JSP pages via an HTTP request that ends with characters such as ".", or "+", or "%20". 20001121 Disclosure of JSP source code with ServletExec AS v3.0c + web ins tance 1970 Buffer overflow in remote web administration component (webprox.dll) of 602Pro LAN SUITE before 2000.0.1.33 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request. 20001122 602Pro Lan Suite Web Admin Overflow 1979 http://www.software602.com/products/ls/support/newbuild.html software602-lan-suite-bo(5583) Buffer overflow in TransSoft Broker FTP Server before 4.3.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long command. 20001018 TransSoft's Broker FTP Server 3.x & 4.x Remote DoS attack Vulnerability broker-ftp-username-dos(5388) The Extended Control List (ECL) feature of the Java Virtual Machine (JVM) in Lotus Notes Client R5 allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method. 20001124 Security Hole in ECL Feature of Java VM Embedded in Lotus Notes Client R5 1994 24Link 1.06 web server allows remote attackers to bypass access restrictions by prepending strings such as "/+/" or "/." to the HTTP GET request. 20001127 24Link Webserver Buffer overflow in setsenv command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands via a long "x=" argument. 20001201 Fixed local AIX V43 vulnerabilities 2032 IY08812 IY10721 aix-setsenv-bo(5621) Buffer overflow in digest command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands. 20001201 Fixed local AIX V43 vulnerabilities 2033 IY08143 IY08287 aix-digest-bo(5620) Buffer overflow in enq command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long -M argument. 20001201 Fixed local AIX V43 vulnerabilities 2034 IY08143 IY08287 aix-enq-bo(5619) Buffer overflow in setclock command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long argument. 20001201 Fixed local AIX V43 vulnerabilities 2035 IY07790 IY07831 Buffer overflow in pioout command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands. 20001201 Fixed local AIX V43 vulnerabilities 2036 IY12638 aix-pioout-bo(5617) Buffer overflow in piobe command in IBM AIX 4.3.x allows local users to gain privileges via long environmental variables. 20001201 Fixed local AIX V43 vulnerabilities 2037 IY12638 aix-piobe-bo(5616) restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program. 20001104 Redhat 6.2 restore exploit 1914 Vulnerability in auto_parms and set_parms in HP-UX 11.00 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service. HPSBUX0011-130 1954 oval:org.mitre.oval:def:5655 registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating a symbolic link to the target file, to which registrar appends log information and sets the permissions to be world readable. 20001108 HP-UX 10.20 resource monitor service 1919 The default configuration of McAfee VirusScan 4.5 does not quote the ImagePath variable, which improperly sets the search path and allows local users to place a Trojan horse "common.exe" program in the C:\Program Files directory. 20001103 Elevation of Privileges Exploit with McAfee VirusScan 4.5 1920 McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field. 20001123 McAfee WebShield SMTP vulnerabilities 1999 McAfee WebShield SMTP 4.5 allows remote attackers to bypass email content filtering rules by including Extended ASCII characters in name of the attachment. 20001123 McAfee WebShield SMTP vulnerabilities 1993 Bill Kendrick web site guestbook (GBook) allows remote attackers to execute arbitrary commands via shell metacharacters in the _MAILTO form variable. 20001110 [hacksware] gbook.cgi remote command execution vulnerability 1940 gbook-cgi-remote-execution(5509) DCForum cgforum.cgi CGI script allows remote attackers to read arbitrary files, and delete the program itself, via a malformed "forum" variable. 20001114 Cgisecurity.com advisory on dcforum http://www.dcscripts.com/dcforum/dcfNews/124.html#1 1951 dcforum-cgi-view-files(5533) Authentix Authentix100 allows remote attackers to bypass authentication by inserting a . (dot) into the URL for a protected directory. 20001106 Authentix Security Advisory 20001107 Explanation Authentix Input Validation Error 1907 Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack. FreeBSD-SA-00:76 20011103-02-P 20001028 tcsh: unsafe tempfile in << redirects SSRT1-41U CLA-2000:350 CLSA-2000:354 20001130 [ADV/EXP]: RH6.x root from bash /tmp vuln + MORE CSSA-2000-042.0 CSSA-2000-043.0 20001111a VU#10277 MDKSA-2000-069 MDKSA-2000:075 RHSA-2000:117 RHSA-2000:121 20001128 /bin/sh creates insecure tmp files 1926 2006 oval:org.mitre.oval:def:4047 fshd (fsh daemon) in Debian GNU/Linux allows local users to overwrite files of other users via a symlink attack. Note: fixed in potato version 20001130 DSA-002-1 fsh: symlink attack linux-fsh-symlink(5633) elvis-tiny before 1.4-10 in Debian GNU/Linux, and possibly other Linux operating systems, allows local users to overwrite files of other users via a symlink attack. 20001122 New version of elvis-tiny released 1984 linux-tinyelvis-tmpfiles(5632) GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack. CLA-2000:359-2 20001129 DSA-001-1 ed: symlink attack MDKSA-2000:076 RHSA-2000:123 gnu-ed-symlink(5723) Lotus Notes R5 client R5.0.5 and earlier does not properly warn users when an S/MIME email message has been modified, which could allow an attacker to modify the email in transit without being detected. 20001108 Lotus Notes R5 clients - no warning for broken signature or encryption 1925 The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, aka the "Exchange User Account" vulnerability. 1958 MS00-088 ms-exchange-username-pwd(5537) Recourse ManTrap 1.6 does not properly hide processes from attackers, which could allow attackers to determine that they are in a honeypot system by comparing the results from kill commands with the process listing in the /proc filesystem. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 1908 mantrap-hidden-processes(5473) Recourse ManTrap 1.6 modifies the kernel so that ".." does not appear in the /proc listing, which allows attackers to determine that they are in a honeypot system. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs mantrap-hidden-processes(5473) Recourse ManTrap 1.6 generates an error when an attacker cd's to /proc/self/cwd and executes the pwd command, which allows attackers to determine that they are in a honeypot system. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs mantrap-pwd-reveal-information(5949) Recourse ManTrap 1.6 hides the first 4 processes that run on a Solaris system, which allows attackers to determine that they are in a honeypot system. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs mantrap-hidden-processes(5473) Recourse ManTrap 1.6 sets up a chroot environment to hide the fact that it is running, but the inode number for the resulting "/" file system is higher than normal, which allows attackers to determine that they are in a chroot environment. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs 1909 mantrap-inode-disclosure(5472) Recourse ManTrap 1.6 allows attackers who have gained root access to use utilities such as crash or fsdb to read /dev/mem and raw disk devices to identify ManTrap processes or modify arbitrary data files. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs mantrap-identify-processes(5950) Recourse ManTrap 1.6 allows attackers to cause a denial of service via a sequence of commands that navigate into and out of the /proc/self directory and executing various commands such as ls or pwd. 20001102 Mantrap By Recourse Technologies - Fate Advisory (11-01-00) 20001107 Vendor Response Re: Mantrap Advisory Vendor Followup - Fate Research Labs 20001105 Mantrap Advisory Vendor Followup - Fate Research Labs 1913 mantrap-dir-dos(5528) Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag. 20001103 IIS ASP $19.95 hack - IISHack 1.5 1911 iis-isapi-asp-bo(5510) The installation of VolanoChatPro chat server sets world-readable permissions for its configuration file and stores the server administrator passwords in plaintext, which allows local users to gain privileges on the server. 20001104 Filesystem Access + VolanoChat = VChat admin (fwd) 20001106 Re: FW: Filesystem Access + VolanoChat = VChat admin (fwd) 1906 volanochatpro-plaintext-password(5465) Buffer overflow in RegAPI.DLL used by Windows NT 4.0 Terminal Server allows remote attackers to execute arbitrary commands via a long username, aka the "Terminal Server Login Buffer Overflow" vulnerability. 20001108 [CORE SDI ADVISORY] MS NT4.0 Terminal Server Edition GINA buffer overflow 1924 MS00-087 nt-termserv-gina-bo(5489) Felix IRC client in BeOS r5 pro and earlier allows remote attackers to conduct a denial of service via a message that contains a long URL. 20001113 beos vulnerabilities Baxter IRC client in BeOS r5 pro and earlier allows remote attackers to conduct a denial of service via a message that contains a long URL. 20001113 beos vulnerabilities Browser IRC client in BeOS r5 pro and earlier allows remote attackers to conduct a denial of service via a message that contains a long URL. 20001113 beos vulnerabilities PostMaster 1.0 in BeOS r5 pro and earlier allows remote attackers to conduct a denial of service via a message that contains a long URL. 20001113 beos vulnerabilities RHConsole in RobinHood 1.1 web server in BeOS r5 pro and earlier allows remote attackers to cause a denial of service via long HTTP request. 20001113 beos vulnerabilities RHDaemon in RobinHood 1.1 web server in BeOS r5 pro and earlier allows remote attackers to cause a denial of service via long HTTP request. 20001113 beos vulnerabilities StarOffice 5.2 follows symlinks and sets world-readable permissions for the /tmp/soffice.tmp directory, which allows a local user to read files of the user who is using StarOffice. 20001108 StarOffice 5.2 Temporary Dir Vulnerability 1922 staroffice-tmp-sym-link(5487) Buffer overflow in NAI Sniffer Agent allows remote attackers to execute arbitrary commands via a long SNMP community name. 20001102 Remotely exploitable buffer overflow in NAI's Distributed Sniffer Agent 1901 NAI Sniffer Agent uses base64 encoding for authentication, which allows attackers to sniff the network and easily decrypt usernames and passwords. 20001102 Remotely exploitable buffer overflow in NAI's Distributed Sniffer Agent NAI Sniffer Agent allows remote attackers to gain privileges on the agent by sniffing the initial UDP authentication packets and spoofing commands. 20001102 Remotely exploitable buffer overflow in NAI's Distributed Sniffer Agent 1902 NAI Sniffer Agent allows remote attackers to cause a denial of service (crash) by sending a large number of login requests. 20001102 Remotely exploitable buffer overflow in NAI's Distributed Sniffer Agent 1903 The installation of AdCycle banner management system leaves the build.cgi program in a web-accessible directory, which allows remote attackers to execute the program and view passwords or delete databases. 20001120 security problem in AdCycle installation 1969 ghostscript before 5.10-16 allows local users to overwrite files of other users via a symlink attack. CLSA-2000:343 CSSA-2000-041 20001123 ghostscript: symlink attack MDKSA-2000:074 RHSA-2000:114 1990 ghostscript-sym-link(5563) ghostscript before 5.10-16 uses an empty LD_RUN_PATH environmental variable to find libraries in the current directory, which could allow local users to execute commands as other users by placing a Trojan horse library into a directory from which another user executes ghostscript. CLSA-2000:343 CSSA-2000-041 20001123 ghostscript: symlink attack MDKSA-2000:074 1991 ghostscript-env-variable(5564) WinVNC installs the WinVNC3 registry key with permissions that give Special Access (read and modify) to the Everybody group, which allows users to read and modify sensitive information such as passwords and gain access to the system. 20001118 WinVNC 3.3.x 1961 winvnc-modify-registry(5545) Balabit syslog-ng allows remote attackers to cause a denial of service (application crash) via a malformed log message that does not have a closing > in the priority specifier. FreeBSD-SA-01:02 20001122 DoS possibility in syslog-ng http://www.balabit.hu/products/syslog-ng/ 1981 balabit-syslog-ng-dos(5576) Twig webmail system does not properly set the "vhosts" variable if it is not configured on the site, which allows remote attackers to insert arbitrary PHP (PHP3) code by specifying an alternate vhosts as an argument to the index.php3 program. 20001124 Security problems with TWIG webmail system http://twig.screwdriver.net/file.php3?file=CHANGELOG 1998 twig-php3-script-execute(5581) ppp utility in FreeBSD 4.1.1 and earlier does not properly restrict access as specified by the "nat deny_incoming" command, which allows remote attackers to connect to the target system. FreeBSD-SA-00:70 1974 freebsd-ppp-bypass-gateway(5584) IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request. 20001123 IBM HTTP Server 1.3.6 Remote Overflow 1988 OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent. 20001123 OpenSSH Security Advisory (adv.fwd) 20001115 Trustix Security Advisory - bind and openssh (and modutils) CLSA-2000:345 SuSE-SA:2000:47 20001118 openssh: possible remote exploit MDKSA-2000:068 RHSA-2000:111 1949 openssh-unauthorized-access(5517) Buffer overflow in Netsnap webcam HTTP server before 1.2.9 allows remote attackers to execute arbitrary commands via a long GET request. 20001115 Netsnap Webcam Software Remote Overflow http://www.netsnap.com/new.htm 1956 netsnap-remote-bo(5534) Directory traversal vulnerability in cgiforum.pl script in CGIForum 1.0 allows remote attackers to ready arbitrary files via a .. (dot dot) attack in the "thesection" parameter. 20001120 CGIForum 1.0 Vulnerability 1963 cgiforum-view-files(5553) Buffer overflow in Gaim 0.10.3 and earlier using the OSCAR protocol allows remote attackers to conduct a denial of service and possibly execute arbitrary commands via a long HTML tag. 20001110 Advisory: Gaim remote vulnerability 1948 Microsys CyberPatrol uses weak encryption (trivial encoding) for credit card numbers and uses no encryption for the remainder of the information during registration, which could allow attackers to sniff network traffic and obtain this sensitive information. 20001122 CyberPatrol - poor credit card protection 1977 Multiple buffer overflows in AFS ACL parser for Ethereal 0.8.13 and earlier allows remote attackers to execute arbitrary commands via a packet with a long username. FreeBSD-SA-00:81 20001118 [hacksware] Ethereal 0.8.13 AFS ACL parsing buffer overflow bug CLSA-2000:342 20001121 ethereal: remote exploit RHSA-2000:116 1972 ethereal-afs-bo(5557) Buffer overflow in Koules 1.4 allows local users to execute arbitrary commands via a long command line argument. 20001120 local exploit for linux's Koules1.4 package 1967 Directory traversal vulnerability in YaBB search.pl CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "catsearch" form field. 20001107 Insecure input balidation in YaBB Search.pl 1921 bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, and bb-ack.sh in Big Brother (BB) before 1.5d3 allows remote attackers to determine the existence of files and user ID's by specifying the target file in the HISTFILE parameter. 20001121 Big Brother Advisory - Fate Research Labs http://bb4.com/incident.nov21 1971 Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of other users whose joe session crashes. 20001116 Joe's Own Editor File Link Vulnerability CLA-2000:356 20001121 Immunix OS Security update for joe 20001201 DSA-003-1 joe: symlink attack MDKSA-2000:072 RHSA-2000:110 1959 joe-symlink-corruption(5546) Netopia ISDN Router 650-ST before 4.3.5 allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters. 20001115 Netopia ISDN Router 650-ST: Viewing of all system logs without login 1952 netopia-view-system-log(5536) Buffer overflow in cmctl program in Oracle 8.1.5 Connection Manager Control allows local users to gain privileges via a long command line argument. 20001120 vulnerability in Connection Manager Control binary in Oracle 1968 oracle-cmctl-bo(5551) Real Networks RealServer 7 and earlier allows remote attackers to obtain portions of RealServer's memory contents, possibly including sensitive information, by accessing the /admin/includes/ URL. 20001116 [CORE SDI ADVISORY] RealServer memory contents disclosure http://service.real.com/help/faq/security/memory.html 1957 realserver-gain-access(5538) WatchGuard Firebox II allows remote attackers to cause a denial of service by flooding the Firebox with a large number of FTP or SMTP requests, which disables proxy handling. 20001116 Possible Watchguard Firebox II DoS 1953 watchguard-firebox-ftp-dos(5535) https://www.watchguard.com/support/patches.html Buffer overflow in socks5 server on Linux allows attackers to execute arbitrary commands via a long connection request. 20001115 socks5 remote exploit / linux x86 telnetd in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service by specifying an arbitrary large file in the TERMCAP environmental variable, which consumes resources as the server processes the file. FreeBSD-SA-00:69 telnetd-termcap-dos(5959) The telnet proxy in RideWay PN proxy server allows remote attackers to cause a denial of service via a flood of connections that contain malformed requests. 20001113 Rideway PN Telnet DoS 1938 Buffer overflow in phf CGI program allows remote attackers to execute arbitrary commands by specifying a large number of arguments and including a long MIME header. 20001115 Exploit: phf buffer overflow (CGI) phf-cgi-bo(5970) Buffer overflow in the HTML parser for Netscape 4.75 and earlier allows remote attackers to execute arbitrary commands via a long password value in a form field. FreeBSD-SA-00:66 CLSA-2000:344 SuSE-SA:2000:48 20001121 Immunix OS Security update for netscape RHSA-2000:109 netscape-client-html-bo(5542) Directory traversal vulnerability in Quikstore shopping cart program allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "page" parameter. 20001120 Cgisecurity Quickstore Shopping cart Buffer overflow in pam_localuser PAM module in Red Hat Linux 7.x and 6.x allows attackers to gain privileges. CLA-2000:358 MDKSA-2000:082-1 RHSA-2000:120 pam-localuser-bo(5747) imwheel-solo in imwheel package allows local users to modify arbitrary files via a symlink attack from the .imwheelrc file. 20000531 Re: strike#2 linux-imwheel-symlink(4941) RHSA-2000:016 htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path. http://www.securiteam.com/exploits/htDig_reveals_web_server_configuration_paths.html 4366 htdig-htsearch-path-disclosure(7367) oval:org.mitre.oval:def:10526 Buffer overflow in BTT Software SNMP Trap Watcher 1.16 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string trap. http://www.bttsoftware.co.uk/snmptrap.html http://www.securiteam.com/windowsntfocus/5ZP0C000KC.html 985 Performance Metrics Collector Daemon (PMCD) in Performance Copilot in IRIX 6.x allows remote attackers to cause a denial of service (resource exhaustion) via an extremely long string to the PMCD port. 20020407-01-I 20000412 Performance Copilot for IRIX 6.5 irix-pcp-pmcd-dos(4284) Argosoft FRP server 1.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to the (1) USER or (2) CWD commands. http://www.mdma.za.net/fk/FK9.zip 1227 telnet daemon (telnetd) from the Linux netkit package before netkit-telnet-0.16 allows remote attackers to bypass authentication when telnetd is running with the -L command line option. CSSA-2000-008.0 telnetd-login-bypass(4225) PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying the target file in the errPagePath parameter. http://docs.iplanet.com/docs/manuals/pubx/2.5.2_Relnotes.html http://packetstormsecurity.org/0004-exploits/ooo1.txt publishingxpert-pscoerrpage-url(7362) POP2 or POP3 server (pop3d) in imap-uw IMAP package on FreeBSD and other operating systems creates lock files with predictable names, which allows local users to cause a denial of service (lack of mail access) for other users by creating lock files for other mail boxes. FreeBSD-SA-00:15 20000420 pop3d/imap DOS (while we're on the subject) 1132 qpopper POP server creates lock files with predictable names, which allows local users to cause a denial of service for other users (lack of mail access) by creating lock files for other mail boxes. 20000420 pop3d/imap DOS (while we're on the subject) 20000420 pop3 1132 PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attackers with sufficient privileges to gain access to databases. 20000423 Postgresql cleartext password storage 1139 postgresql-plaintext-passwords(4364) Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users. 20000201 Windows NT and account list leak ! A new SID usage 959 nt-lsa-domain-sid(4015) Check Point FireWall-1 allows remote attackers to cause a denial of service (high CPU) via a flood of packets to port 264. 20000707 Re: CheckPoint FW1 BUG ikeyman in IBM IBMHSSSB 1.0 sets the CLASSPATH environmental variable to include the user's own CLASSPATH directories before the system's directories, which allows a malicious local user to execute arbitrary code as root via a Trojan horse Ikeyman class. 20000405 minor issue with IBM HTTPD and /usr/bin/ikeyman 1092 ibm-ikeyman(4235) Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service (CPU consumption) by forging an email message with the sender as bounce@[127.0.0.1] (localhost), which causes Domino to enter a mail loop. 20000520 Infinite loop in LOTUS NOTE 5.0.3. SMTP SERVER 20010823 Lotus Domino DoS solution 3212 20010820 Lotus Domino DoS lotus-domino-bounced-message-dos(7012) Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root. http://www.apacheweek.com/issues/00-10-13 Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant. 20021223 Re: 'printenv' XSS vulnerability 20021222 'printenv' XSS vulnerability http://httpd.apache.org/info/css-security/apache_specific.html 20070724 printenv.pl(all versions) cross site scripting Vulnerability apache-printenv-xss(10938) apache-printenv-acuparam-xss(35597) Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files. http://www.apacheweek.com/issues/00-01-07#status userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LC_ALL environment variables (CVE-2000-0844). 20000930 glibc and userhelper - local root 20001003 SuSE: userhelper/usermode MDKSA-2000:059 RHSA-2000:075 Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call. 20000925 Format strings: bug #1: BSD-lpr 20001004 Immunix OS Security Update for lpr lpr-checkremote-format-string(5286) RHSA-2000:066 1711 The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida. 20000710 MSDE / Re: Default Password Database 20000810 Tumbleweed Worldsecure (MMS) BLANK 'sa' account password 20000816 Released Patch: Tumbleweed Worldsecure (MMS) BLANK 'sa' account password 20020522 Opty-Way Enterprise includes MSDE with sa <blank> 20000815 MS-SQL 'sa' user exploit code Q313418 Q321081 mssql-no-sapassword(1459) VU#635463 http://www.microsoft.com/security/security_bulletins/ms02020_sql.asp 4797 Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. 20000322 Security bug in Apache project: Jakarta Tomcat apache-tomcat-file-contents(4205) Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities. zope-legacy-names(5824) MDKSA-2000:083 RHSA-2000:125 http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects. CLA-2000:365 MDKSA-2000:086 DSA-007 RHSA-2000:135 http://www.zope.org/Products/Zope/Hotfix_2000-12-18/security_alert zope-image-file(5778) ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J and other operating systems, does not drop privileges after acquiring a raw socket, which increases ping's exposure to bugs that otherwise would occur at lower privileges. 20001030 Trustix Security Advisory - ping gnupg ypbind 20001025 Immunix OS Security Update for ping package RHSA-2000:087 Buffer overflows in the (1) outpack or (2) buf variables of ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J and other operating systems, may allow local users to gain privileges. 20001030 Trustix Security Advisory - ping gnupg ypbind 20001020 Re: [RHSA-2000:087-02] Potential security problems in ping fixed. 20001025 Immunix OS Security Update for ping package ping-buf-bo(5431) RHSA-2000:087 1813 The default configuration of Lotus Domino server 5.0.8 includes system information (version, operating system, and build date) in the HTTP headers of replies, which allows remote attackers to obtain sensitive information. 20010919 lotus domino server 5.08 is very gabby VU#984555 http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/5552251934afaa9585256c0000737a7f?OpenDocument&Highlight=0,AWHN4A8QWM lotus-domino-information-disclosure(10685) Buffer overflow in portmir for AIX 4.3.0 allows local users to corrupt lock files and gain root privileges via the echo_error routine. VU#433499 IY07832 aix-portmir-echoerror-bo(7929) Microsoft Windows 2000 before Service Pack 2 (SP2), when running in a non-Windows 2000 domain and using NTLM authentication, and when credentials of an account are locally cached, allows local users to bypass account lockout policies and make an unlimited number of login attempts, aka the "Domain Account Lockout" vulnerability. VU#818496 1973 MS00-089 win2k-brute-force(5585) The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison the DNS cache. VU#458659 win2k-dns-resolver(4280) The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows, which may leave applications vulnerable to vulnerabilities related to overflows. [gcc-bugs] 20020506 c/6586: -ftrapv doesn't catch multiplication overflow VU#540517 The line printer daemon (lpd) in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file. 20021104-01-P 20000108 L0pht Advisory: LPD, RH 4.x,5.x,6.x 20000108 Quadruple Inverted Backflip 20000109 lpr -- access control problem and root exploit VU#39001 20000108 Quadruple Inverted Backflip RHSA-2000:002 927 redhat-lpd-print-control(3841) The line printer daemon (lpd) in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by modifying the DNS for the attacking IP. 20021104-01-P RHSA-2000:002 A010800-v 20000109 lpr -- access control problem and root exploit VU#30308 20000108 Quadruple Inverted Backflip 927 redhat-lpd-auth(3840) AIX sysback before 4.2.1.13 uses a relative path to find and execute the hostname program, which allows local users to gain privileges by modifying the path to point to a malicious hostname program. VU#17566 aix-sysback-elevate-privileges(6432) quikstore.cgi in Quikstore Shopping Cart allows remote attackers to execute arbitrary commands via shell metacharacters in the URL portion of an HTTP GET request. VU#671444 Caucho Technology Resin 1.2 and possibly earlier allows remote attackers to view JSP source via an HTTP request to a .jsp file with certain characters appended to the file name, such as (1) "..", (2) "%2e..", (3) "%81", (4) "%82", and others. 20001123 RESIN ServletExec JSP Source Disclosure Vulnerability(Apache 1.3.6 Win2k)) 20001123 Re: RESIN ServletExec JSP Source Disclosure Vulnerability(Apache 1.3.6 Win2k)) 1986 resin-jsp-source-disclosure(5568) Xitami 2.5b installs the testcgi.exe program by default in the cgi-bin directory, which allows remote attackers to gain sensitive configuration information about the web server by accessing the program. http://archives.neohapsis.com/archives/win2ksecadvice/2000-q4/0109.html Snort 1.6, when running in straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet logging selected, allows remote attackers to cause a denial of service (crash) by sending non-IP protocols that Snort does not know about, as demonstrated by an nmap protocol scan. 20000614 Snort 1.6 and nmap 2.54beta1 20000614 Re: Snort 1.6 and nmap 2.54beta1 Windows NT 4.0 and Windows 2000 hosts allow remote attackers to cause a denial of service (unavailable connections) by sending multiple SMB SMBnegprots requests but not reading the response that is sent back. 1301 Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables. 20000106 Phorum 3.0.7 exploits and IDS signatures 2271 Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3. 20000106 Phorum 3.0.7 exploits and IDS signatures Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to "boogieman". 20000106 Phorum 3.0.7 exploits and IDS signatures http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm 2274 code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string. 20000106 Phorum 3.0.7 exploits and IDS signatures upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method. 20000106 Phorum 3.0.7 exploits and IDS signatures SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter. 20000106 Phorum 3.0.7 exploits and IDS signatures violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters. 20000106 Phorum 3.0.7 exploits and IDS signatures 2272 The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow remote attackers to view privileged database information via HTTP requests for Database Access Descriptor (DAD) files. 20001219 Oracle WebDb engine brain-damagse 20001221 Re: Oracle WebDb engine brain-damagse 20001223 Potential Vulnerabilities in Oracle Internet Application Server oracle-webdb-admin-access(5818) 2150 SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the query string of the URL. 20001219 Oracle WebDb engine brain-damagse 20001221 Re: Oracle WebDb engine brain-damagse 20001223 Potential Vulnerabilities in Oracle Internet Application Server oracle-execute-plsql(5817) 2150 The POP3 server in FTGate returns an -ERR code after receiving an invalid USER request, which makes it easier for remote attackers to determine valid usernames and conduct brute force password guessing. 20000626 Problems with FTGate ftgate-invalid-user-requests(4793) BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet pages via a URL with multiple / (forward slash) characters before the restricted pages. This vulnerability is addressed in the following product releases: BEA Systems Weblogic Server 5.1 SP 7 BEA Systems WebLogic Express 5.1 SP 7 ftp://ftpna.bea.com/pub/releases/patches/SecurityBEA00-0600.zip 5089 weblogic-bypass-auth(5588) The HTTP interface of Tivoli Lightweight Client Framework (LCF) in IBM Tivoli Management Framework 3.7.1 sets http_disable to zero at install time, which allows remote authenticated users to bypass file permissions on Tivoli Endpoint Configuration data files via an unspecified manipulation of log files. 17085 tivoli-lcf-file-read(3927) Unspecified vulnerability in siteman.php3 in AnyPortal(php) before 22 APR 00 allows remote attackers to obtain sensitive information via unknown attack vectors, which reveal the absolute path. NOTE: the provenance of this information is unknown; the details are obtained from third party information. anyportalphp-siteman-information-disclosure(25441) Unspecified vulnerability in Haakon Nilsen simple, integrated publishing system (SIPS) before 0.2.4 has an unknown impact and attack vectors, related to a "grave security fault." http://sourceforge.net/forum/forum.php?forum_id=25971 The HTTP service in American Power Conversion (APC) PowerChute uses a default username and password, which allows remote attackers to gain system access. http://governmentsecurity.org/articles/DefaultLoginsandPasswordsforNetworkedDevices.php Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers. 20000411 Back Door in Commercial Shopping Cart 20000413 Re: Back Door in Commercial Shopping Cart [Stormer Hosting] 20000413 Re: Back Door in Commercial Shopping Cart 20000413 Re: Back Door in Commercial Shopping Cart [RESOLVED] 20070603 Dansie Cart Script Exploit Reported Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the "From" field, which allows remote attackers to bypass virus protection. 20001110 CA's InoculateIT Agent for Exchange Server Multiple unspecified vulnerabilities in NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allow remote attackers to bypass intended restrictions on anonymous access via unknown vectors. http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1 NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allows remote authenticated users to cause a denial of service (abend) by sending an RNTO command after a failed RNFR command. http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1 The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI. http://archive.apache.org/dist/java/java.apache.org-www.tar.gz [java-apache-users] 20000929 jserv wrapper error 8412 apache-jserv-env-information-disclosure(51946) crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms. [openssl-users] 20000529 64 bit problem in RSA_generate_key in 0.9.5a [oss-security] 20160504 broken RSA keys 90109 1035750 http://www-01.ibm.com/support/docview.wss?uid=swg21995039 https://git.openssl.org/?p=openssl.git;a=commit;h=db82b8f9bd432a59aea8e1014694e15fc457c2bb cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie. 20010213 RFP2101: RFPlutonium to fuel your PHP-Nuke php-nuke-elevate-privileges(6183) Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone, then use compiled HTML help (.chm) files to execute arbitrary programs. http://www.guninski.com/chmtempmain.html 2456 MS01-015 ie-chm-execute-files(5567) oval:org.mitre.oval:def:920 Web Extender Client (WEC) in Microsoft Office 2000, Windows 2000, and Windows Me does not properly process Internet Explorer security settings for NTLM authentication, which allows attackers to obtain NTLM credentials and possibly obtain the password, aka the "Web Client NTLM Authentication" vulnerability. 2199 MS01-001 wec-ntlm-authentication(5920) IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability. 20010108 IIS 5.0 allows viewing files using %3F+.htr 2313 MS01-004 iis-read-files(5903) Buffer overflow in the parsing mechanism of the file loader in Microsoft PowerPoint 2000 allows attackers to execute arbitrary commands. A012301-1 MS01-002 powerpoint-execute-code(5996) The Winsock2ProtocolCatalogMutex mutex in Windows NT 4.0 has inappropriate Everyone/Full Control permissions, which allows local users to modify the permissions to "No Access" and disable Winsock network connectivity to cause a denial of service, aka the "Winsock Mutex" vulnerability. 20010126 ntsecurity.nu advisory: Winsock Mutex Vulnerability in Windows NT 4.0 SP6 and below MS01-003 winnt-mutex-dos(6006) Buffer overflow in NetScreen Firewall WebUI allows remote attackers to cause a denial of service via a long URL request to the web administration interface. 20010109 NSFOCUS SA2001-01: NetScreen Firewall WebUI Buffer Overflow vulnerability 2176 netscreen-webui-bo(5908) Backdoor account in Interbase database server allows remote attackers to overwrite arbitrary files using stored procedures. CA-2001-01 2192 interbase-backdoor-account(5911) Directory traversal vulnerability in Lotus Domino 5.0.5 web server allows remote attackers to read arbitrary files via a .. attack. 20010105 Lotus Domino 5.0.5 Web Server vulnerability - reading files outside the web root 20010109 bugtraq id 2173 Lotus Domino Server 2173 lotus-domino-directory-traversal(5899) Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges. CA-2001-02 DSA-026 20010129 Vulnerabilities in BIND 4 and 8 RHSA-2001:007 2302 Buffer overflow in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges. CA-2001-02 20010129 Vulnerabilities in BIND 4 and 8 RHSA-2001:007 2307 BIND 4 and BIND 8 allow remote attackers to access sensitive information such as environment variables. CA-2001-02 DSA-026 20010129 Vulnerabilities in BIND 4 and 8 RHSA-2001:007 2321 Format string vulnerability in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges. CA-2001-02 20010129 Vulnerabilities in BIND 4 and 8 RHSA-2001:007 2309 Remote Data Protocol (RDP) in Windows 2000 Terminal Service does not properly handle certain malformed packets, which allows remote attackers to cause a denial of service, aka the "Invalid RDP Data" vulnerability. 2326 MS01-006 Network Dynamic Data Exchange (DDE) in Windows 2000 allows local users to gain SYSTEM privileges via a "WM_COPYDATA" message to an invisible window that is running with the privileges of the WINLOGON process. A020501-1 2341 MS01-007 win-dde-elevate-privileges(6062) NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access. 20010207 Local promotion vulnerability in NT4's NTLM Security Support Provider 2348 MS01-008 ntlm-ssp-elevate-privileges(6076) Memory leak in PPTP server in Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed data packet, aka the "Malformed PPTP Packet Stream" vulnerability. 2368 MS01-009 winnt-pptp-dos(6103) Windows 2000 domain controller in Windows 2000 Server, Advanced Server, or Datacenter Server allows remote attackers to cause a denial of service via a flood of malformed service requests. 20001202 UDP Ping-pong in Win2k L-049 MS01-011 win2k-domain-controller-dos(6136) Arrowpoint (aka Cisco Content Services, or CSS) allows local users to cause a denial of service via a long argument to the "show script," "clear script," "show archive," "clear archive," "show log," or "clear log" commands. A013101-1 20010131 Cisco Content Services Switch Vulnerability Directory traversal vulnerability in Arrowpoint (aka Cisco Content Services, or CSS) allows local unprivileged users to read arbitrary files via a .. (dot dot) attack. A013101-1 20010131 Cisco Content Services Switch Vulnerability 2331 cisco-ccs-file-access(6031) MailMan Webmail 3.0.25 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the alternate_template parameter. 20001206 (SRADV00005) Remote command execution vulnerabilities in MailMan Webmail http://www.endymion.com/products/mailman/history.htm 2063 mailman-alternate-templates(5649) simplestguest.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the guestbook parameter. 20001213 Re: Insecure input validation in simplestmail.cgi 2106 http-cgi-simplestguest(5743) everythingform.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter. 20001211 Insecure input validation in everythingform.cgi (remote command execution) 2101 http-cgi-everythingform(5736) simplestmail.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the MyEmail parameter. 20001211 Insecure input validation in simplestmail.cgi (remote command execution) 2102 http-cgi-simplestmail(5739) ad.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter. 20001211 Insecure input validation in ad.cgi 2103 http-cgi-ad(5741) rp-pppoe PPPoE client allows remote attackers to cause a denial of service via the Clamp MSS option and a TCP packet with a zero-length TCP option. 20001211 DoS vulnerability in rp-pppoe versions <= 2.4 CLA-2000:357 MDKSA-2000:084 RHSA-2000:130 2098 rppppoe-zero-length-dos(5727) mod_sqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of other users. 20001211 mod_sqlpw Password Caching Bug proftpd-modsqlpw-unauth-access(5737) Buffer overflow in the HTML parsing code in oops WWW proxy server 1.5.2 and earlier allows remote attackers to execute arbitrary commands via a large number of " (quotation) characters. 20001211 [pkc] remote heap buffer overflow in oops FreeBSD-SA-00:79 2099 oops-ftputils-bo(5725) Buffer overflow in oops WWW proxy server 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or domain name that is obtained from a reverse DNS lookup. 20001212 Stack too ;) Re: [pkc] remote heap buffer overflow in oops 2099 http://zipper.paco.net/~igor/oops/ChangeLog oops-dns-bo(6122) FoolProof 3.9 allows local users to bypass program execution restrictions by downloading the restricted executables from another source and renaming them. 2089 foolproof-security-bypass(5758) BroadVision One-To-One Enterprise allows remote attackers to determine the physical path of server files by requesting a .JSP file name that does not exist. 20001207 BroadVision One-To-One Enterprise Path Disclosure Vulnerability broadvision-bv1to1-reveal-path(5661) Format string vulnerability in ssldump possibly allows remote attackers to cause a denial of service and possibly gain root privileges via malicious format string specifiers in a URL. 20001208 format string in ssl dump 2096 ssldump-format-strings(5717) KTH Kerberos IV allows local users to change the configuration of a Kerberos server running at an elevated privilege by specifying an alternate directory using with the KRBCONFDIR environmental variable, which allows the user to gain additional privileges. 20001208 Vulnerabilities in KTH Kerberos IV 20001210 KTH upgrade and FIX kerberos4-user-config(5738) KTH Kerberos IV allows local users to specify an alternate proxy using the krb4_proxy variable, which allows the user to generate false proxy responses and possibly gain privileges. 20001208 Vulnerabilities in KTH Kerberos IV 20001210 KTH upgrade and FIX kerberos4-arbitrary-proxy(5733) Buffer overflow in the kdc_reply_cipher function in KTH Kerberos IV allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long authentication request. 20001208 Vulnerabilities in KTH Kerberos IV 20001210 KTH upgrade and FIX 20010130 Buffer overflow in old ssh-1.2.2x-afs-kerberosv4 patches kerberos4-auth-packet-overflow(5734) KTH Kerberos IV allows local users to overwrite arbitrary files via a symlink attack on a ticket file. 20001208 Vulnerabilities in KTH Kerberos IV 20001210 KTH upgrade and FIX RHSA-2001:025 kerberos4-tmpfile-dos(5754) Directory traversal vulnerability in HomeSeer before 1.4.29 allows remote attackers to read arbitrary files via a URL containing .. (dot dot) specifiers. 20001207 HomeSeer Directory Traversal Vulnerability http://www.keware.com/hsbetachanges.htm 2085 homeseer-directory-traversal(5663) Offline Explorer 1.4 before Service Release 2 allows remote attackers to read arbitrary files by specifying the drive letter (e.g. C:) in the requested URL. 20001207 MetaProducts Offline Explorer 2084 offline-explorer-reveal-files(5728) IPSwitch IMail 6.0.5 allows remote attackers to cause a denial of service using the SMTP AUTH command by sending a base64-encoded user password whose length is between 80 and 136 bytes. 20001206 DoS by SMTP AUTH command in IPSwitch IMail server http://www.ipswitch.com/Support/IMail/news.html 2083 imail-smtp-auth-dos(5674) APC UPS daemon, apcupsd, saves its process ID in a world-writable file, which allows local users to kill an arbitrary process by specifying the target process ID in the apcupsd.pid file. 20001206 apcupsd 3.7.2 Denial of Service MDKSA-2000:077 2070 apc-apcupsd-dos(5654) Memory leak in Cisco Catalyst 4000, 5000, and 6000 series switches allows remote attackers to cause a denial of service via a series of failed telnet authentication attempts. 20001206 Cisco Catalyst Memory Leak Vulnerability 2072 cisco-catalyst-telnet-dos(5656) PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences. 20001206 CHINANSL Security Advisory(CSA-200011) 2060 apache-php-disclose-files(5659) phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include file in the phpgw_info parameter of the phpgw.inc.php program. 20001206 (SRADV00006) Remote command execution vulnerabilities in phpGroupWare http://sourceforge.net/project/shownotes.php?release_id=17604 2069 phpgroupware-include-files(5650) Multiple buffer overflows in Lexmark MarkVision printer driver programs allows local users to gain privileges via long arguments to the cat_network, cat_paraller, and cat_serial commands. 20001206 (SRADV00007) Local root compromise through Lexmark MarkVision printer drivers 2075 markvision-printer-driver-bo(5651) The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities. 2064 MS00-095 nt-ras-reg-perms(5671) oval:org.mitre.oval:def:500 The default permissions for the SNMP Parameters registry key in Windows NT 4.0 allows remote attackers to read and possibly modify the SNMP community strings to obtain sensitive information or modify network configuration, aka one of the "Registry Permissions" vulnerabilities. 2066 MS00-095 nt-snmp-reg-perms(5672) oval:org.mitre.oval:def:139 The default permissions for the MTS Package Administration registry key in Windows NT 4.0 allows local users to install or modify arbitrary Microsoft Transaction Server (MTS) packages and gain privileges, aka one of the "Registry Permissions" vulnerabilities. 2065 MS00-095 nt-mts-reg-perms(5673) oval:org.mitre.oval:def:140 The "Configure Your Server" tool in Microsoft 2000 domain controllers installs a blank password for the Directory Service Restore Mode, which allows attackers with physical access to the controller to install malicious programs, aka the "Directory Service Restore Mode Password" vulnerability. 2133 MS00-099 WatchGuard SOHO FireWall 2.2.1 and earlier allows remote attackers to cause a denial of service via a large number of GET requests. 20001207 WatchGuard SOHO v2.2.1 DoS 2082 watchguard-soho-get-dos(5665) Buffer overflow in BitchX IRC client allows remote attackers to cause a denial of service and possibly execute arbitrary commands via an IP address that resolves to a long DNS hostname or domain name. FreeBSD-SA-00:78 20001207 BitchX DNS Overflow Patch 20001207 bitchx/ircd DNS overflow demonstration CLA-2000:364 MDKSA-2000:079 RHSA-2000:126 2087 irc-bitchx-dns-bo(5701) IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database. 20001205 IBM DB2 default account and password Vulnerability 2068 ibm-db2-gain-access(5662) IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query. 20001205 IBM DB2 SQL DOS 2067 ibm-db2-dos(5664) One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges. NetBSD-SA2000-018 20001218 Trustix Security Advisory - ed, tcsh, and ftpd-BSD 20001218 2124 bsd-ftpd-replydirname-bo(5776) Directory traversal vulnerability in FTP Serv-U before 2.5i allows remote attackers to escape the FTP root and read arbitrary files by appending a string such as "/..%20." to a CD command, a variant of a .. (dot dot) attack. 20001205 (no subject) 20001205 Serv-U FTP directory traversal vunerability (all versions) 2052 ftp-servu-homedir-travers(5639) CBOS 2.4.1 and earlier in Cisco 600 routers allows remote attackers to cause a denial of service via a slow stream of TCP SYN packets. 20001204 Multiple Vulnerabilities in CBOS cisco-cbos-syn-packets(5627) The Cisco Web Management interface in routers running CBOS 2.4.1 and earlier does not log invalid logins, which allows remote attackers to guess passwords without detection. 20001204 Multiple Vulnerabilities in CBOS cisco-cbos-invalid-login(5628) Cisco 600 routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a large ICMP echo (ping) packet. 20001204 Multiple Vulnerabilities in CBOS cisco-cbos-icmp-echo(5629) The Web interface to Cisco 600 routers running CBOS 2.4.1 and earlier allow remote attackers to cause a denial of service via a URL that does not end in a space character. 20001204 Multiple Vulnerabilities in CBOS cisco-cbos-web-access(5626) patchadd in Solaris allows local users to overwrite arbitrary files via a symlink attack. 20001218 Solaris patchadd(1) (3) symlink vulnerabilty 2127 solaris-patchadd-symlink(5789) Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username. 20001209 Trustix Security Advisory - stunnel CLA-2000:363 DSA-009 RHSA-2000:129 20001218 Stunnel format bug 2128 stunnel-format-logfile(5807) procfs in FreeBSD and possibly other operating systems does not properly restrict access to per-process mem and ctl files, which allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's address space. FreeBSD-SA-00:77 2130 procfs-elevate-privileges(6106) procfs in FreeBSD and possibly other operating systems allows local users to cause a denial of service by calling mmap on the process' own mem file, which causes the kernel to hang. FreeBSD-SA-00:77 2131 procfs-mmap-dos(6107) procfs in FreeBSD and possibly other operating systems allows local users to bypass access control restrictions for a jail environment and gain additional privileges. FreeBSD-SA-00:77 2132 procfs-access-control-bo(6108) Webconfig, IMAP, and other services in MDaemon 3.5.0 and earlier allows remote attackers to cause a denial of service via a long URL terminated by a "\r\n" string. 20001219 def-2000-03: MDaemon 3.5.0 DoS 2134 Buffer overflow in bftpd 1.0.13 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long SITE CHOWN command. 20001213 Potential Buffer Overflow vulnerability in bftpd-1.0.13 bftpd-site-chown-bo(5775) Secure Locate (slocate) allows local users to corrupt memory via a malformed database file that specifies an offset value that accesses memory outside of the intended buffer. 20001126 [MSY] S(ecure)Locate heap corruption vulnerability CLA-2001:369 DSA-005-1 MDKSA-2000:085 RHSA-2000:128 2004 TLSA2001002-1 slocate-heap-execute-code(5594) The installation of J-Pilot creates the .jpilot directory with the user's umask, which could allow local attackers to read other users' PalmOS backup information if their umasks are not securely set. MDKSA-2000:081 20001214 J-Pilot Permissions Vulnerability jpilot-perms(5762) Mac OS Runtime for Java (MRJ) 2.2.3 allows remote attackers to use malicious applets to read files outside of the CODEBASE context via the ARCHIVE applet parameter. 20001215 Security Hole of MRJ 2.2.3 (Mac OS Runtime for Java) - Inconsistent Use of CODEBASE and ARCHIVE Attributes - mrj-runtime-malicious-applets(5784) dialog before 0.9a-20000118-3bis in Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack. DSA-008-1 2151 dialog-symlink(5809) Buffer overflow in 1st Up Mail Server 4.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long MAIL FROM command. 20001226 1st Up Mail Server v4.1 Buffer Overflow Vulnerability 2152 1stup-mail-server-bo(5808) gpg (aka GnuPG) 1.0.4 and other versions does not properly verify detached signatures, which allows attackers to modify the contents of a file without detection. CLA-2000:368 DSA-010-1 MDKSA-2000-087 RHSA-2000:131 20001220 Trustix Security Advisory - gnupg, ftpd-BSD 2141 gnupg-detached-sig-modify(5802) gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust. CLA-2000:368 DSA-010-1 MDKSA-2000-087 RHSA-2000:131 20001220 Trustix Security Advisory - gnupg, ftpd-BSD 2153 gnupg-reveal-private(5803) Buffer overflow in the find_default_type function in libsecure in NSA Security-enhanced Linux, which may allow attackers to modify critical data in memory. 20001226 buffer overflow in libsecure (NSA Security-enhanced Linux) 2154 Directory traversal vulnerability in print.cgi in Technote allows remote attackers to read arbitrary files via a .. (dot dot) attack in the board parameter. 20001223 Technote 2155 Directory traversal vulnerability in main.cgi in Technote allows remote attackers to read arbitrary files via a .. (dot dot) attack in the filename parameter. 20001227 [Ksecurity Advisory] main.cgi in technote 2156 register.cgi in Ikonboard 2.1.7b and earlier allows remote attackers to execute arbitrary commands via the SEND_MAIL parameter, which overwrites an internal program variable that references a program to be executed. 20001228 Remote vulnerability in Ikonboard upto version 2.1.7b 2157 http-cgi-ikonboard(5819) The clustmon service in Sun Cluster 2.x does not require authentication, which allows remote attackers to obtain sensitive information such as system logs and cluster configurations. 20001212 Two Holes in Sun Cluster 2.x clustmon-no-authentication(6123) in.mond in Sun Cluster 2.x allows local users to read arbitrary files via a symlink attack on the status file of a host running HA-NFS. 20001212 Two Holes in Sun Cluster 2.x ha-nfs-symlink(6125) Support Tools Manager (STM) A.22.00 for HP-UX allows local users to overwrite arbitrary files via a symlink attack on the tool_stat.txt log file. 20001213 STM symlink Vulnerability Cisco Catalyst 6000, 5000, or 4000 switches allow remote attackers to cause a denial of service by connecting to the SSH service with a non-SSH client, which generates a protocol mismatch error. 20001213 Cisco Catalyst SSH Protocol Mismatch Vulnerability 2117 cisco-catalyst-ssh-mismatch(5760) swinit in nCipher does not properly disable the Operator Card Set recovery feature even when explicitly disabled by the user, which could allow attackers to gain access to application keys. http://active.ncipher.com/updates/advisory.txt 20001212 nCipher Security Advisory: Operator Cards unexpectedly recoverable ncipher-recover-operator-cards(5999) Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets. 20001218 FireWall-1 Fastmode Vulnerability Windows Media Unicast Service in Windows Media Services 4.0 and 4.1 does not properly shut down some types of connections, producing a memory leak that allows remote attackers to cause a denial of service via a series of severed connections, aka the "Severed Windows Media Server Connection" vulnerability. Q281256 MS00-097 mediaservices-dropped-connection-dos(5785) GTK+ library allows local users to specify arbitrary modules via the GTK_MODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program. 20010102 gtk+ security hole. 20010103 Claimed vulnerability in GTK_MODULES http://www.gtk.org/setuid.html 2165 Buffer overflow in Kermit communications software in HP-UX 11.0 and earlier allows local users to cause a denial of service and possibly execute arbitrary commands. HPSBUX0012-135 2170 hpux-kermit-bo(5793) CGI Script Center Subscribe Me LITE 2.0 and earlier allows remote attackers to delete arbitrary mailing list users without authentication by directly calling subscribe.pl with the target address as a parameter. 20001212 Security Advisory: Subscribe Me Lite 1.0 - 2.0 Unix or 1.0 - 2.0 NT and below. 2108 subscribemelite-gain-admin-access(5735) itetris/xitetris 1.6.2 and earlier trusts the PATH environmental variable to find and execute the gunzip program, which allows local users to gain root privileges by changing their PATH so that it points to a malicious gunzip program. 20001219 itetris[v1.6.2] local root exploit (system()+../ protection) 2139 itetris-svgalib-path(5795) common.inc.php in phpWebLog 0.4.2 does not properly initialize the $CONF array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog. 20001202 Bypassing admin authentication in phpWebLog 2047 phpweblog-bypass-authentication(5625) Internet Explorer 5.0 through 5.5 allows remote attackers to read arbitrary files from the client via the INPUT TYPE element in an HTML form, aka the "File Upload via Form" vulnerability. MS00-093 ie-form-file-upload(5615) The Print Templates feature in Internet Explorer 5.5 executes arbitrary custom print templates without prompting the user, which could allow an attacker to execute arbitrary ActiveX controls, aka the "Browser Print Template" vulnerability. 2046 MS00-093 ie-print-template(5614) The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows an attacker to read arbitrary files, aka a variant of the "Scriptlet Rendering" vulnerability. MS00-093 ie-scriptlet-rendering-read-files(6085) A function in Internet Explorer 5.0 through 5.5 does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files, aka a new variant of the "Frame Domain Verification" vulnerability. MS00-093 ie-frame-verification-read-files(6086) Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect the behavior of telnetd. NetBSD-SA2000-017 Buffer overflow in kdc_reply_cipher of libkrb (Kerberos 4 authentication library) in NetBSD 1.5 and FreeBSD 4.2 and earlier, as used in Kerberised applications such as telnetd and login, allows local users to gain root privileges. FreeBSD-SA-01:25 NetBSD-SA2000-017 kerberos4-auth-packet-overflow(5734) catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID temporary file. 20001218 Catman file clobbering vulnerability Solaris 2.x solaris-catman-symlink(5788) FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability. MS00-100 iis-web-form-submit(5823) The Web interface for Infinite Interchange 3.6.1 allows remote attackers to cause a denial of service (application crash) via a large POST request. 20001221 Infinite InterChange DoS 2140 infinite-interchange-dos(5798) Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string. 20001219 def-2000-04: Bea WebLogic Server dotdot-overflow 2138 weblogic-dot-bo(5782) bsguest.cgi guestbook script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address. 20001221 BS Scripts Vulnerabilities http://www.stanback.net/ bsguest-cgi-execute-commands(5796) bslist.cgi mailing list script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address. 20001221 BS Scripts Vulnerabilities http://www.stanback.net/ bslist-cgi-execute-commands(5797) Vulnerability in fetchmail 5.5.0-2 and earlier in the AUTHENTICATE GSSAPI command. RHBA-2000:106-04 TLSA2000024-1 fetchmail-authenticate-gssapi(7455) "Multiple Users" Control Panel in Mac OS 9 allows Normal users to gain Owner privileges by removing the Users & Groups Data File, which effectively removes the Owner password and allows the Normal user to log in as the Owner account without a password. 20001229 Mac OS 9 Multiple Users Control Panel Password Vulnerability macos-multiple-users(5830) CoffeeCup Direct and Free FTP clients uses weak encryption to store passwords in the FTPServers.ini file, which could allow attackers to easily decrypt the passwords. 2107 coffeecup-ftp-weak-encryption(5744) MDaemon Pro 3.5.1 and earlier allows local users to bypass the "lock server" security setting by pressing the Cancel button at the password prompt, then pressing the enter key. 20001214 Bypass MDaemon 3.5.1 "Lock Server" Protection 2115 mdaemon-lock-bypass-password(5763) Vulnerability in top in HP-UX 11.04 and earlier allows local users to overwrite files owned by the "sys" group. HPSBUX0012-134 hp-top-sys-files(5773) Vulnerability in inetd server in HP-UX 11.04 and earlier allows attackers to cause a denial of service when the "swait" state is used by a server. HPSBUX0101-136 hp-inetd-swait-dos(5904) Veritas Backup agent on Linux allows remote attackers to cause a denial of service by establishing a connection without sending any data, which causes the process to hang. 20010115 Veritas BackupExec (remote DoS) 2204 PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested. CLA-2001:373 20010112 PHP Security Advisory - Apache Module bugs DSA-020 MDKSA-2001:013 RHSA-2000:136 2206 php-htaccess-unauth-access(5940) rctab in SuSE 7.0 and earlier allows local users to create or overwrite arbitrary files via a symlink attack on the rctmp temporary file. 20010113 Serious security flaw in SuSE rctab 20010117 Re: Serious security flaw in SuSE rctab 2207 rctab-elevate-privileges(5945) Buffer overflow in jaZip Zip/Jaz drive manager allows local users to gain root privileges via a long DISPLAY environmental variable. 20010114 Vulnerability in jaZip. DSA-017 2209 jazip-display-bo(5942) Format string vulnerability in splitvt before 1.6.5 allows local users to execute arbitrary commands via the -rcfile command line argument. 20010114 [MSY] Multiple vulnerabilities in splitvt DSA-014-1 2210 splitvt-perserc-format-string(5948) Multiple buffer overflows in splitvt before 1.6.5 allow local users to execute arbitrary commands. 20010114 [MSY] Multiple vulnerabilities in splitvt DSA-014 2210 statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to execute arbitrary commands via the mostbrowsers parameter, whose value is used as part of a generated Perl script. 20010116 Vulnerabilities in OmniHTTPd default installation 2211 statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to overwrite arbitrary files via the cgidir parameter. 20010116 Vulnerabilities in OmniHTTPd default installation 2211 Buffer overflow in arp command in Solaris 7 and earlier allows local users to execute arbitrary commands via a long -f parameter. 20010111 Solaris Arp Vulnerability 20010112 arp exploit 00200 2193 solaris-arp-bo(5928) gpm 1.19.3 allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001:006 2188 linux-gpm-symlink(5917) sdiff 2.7 in the diffutils package allows local users to overwrite files via a symlink attack. IMNX-2000-70-028-01 20010110 Immunix OS Security update for lots of temp file problems VU#579928 MDKSA-2001:008-1 RHSA-2001:116 2191 linux-diffutils-sdiff-symlink(5914) rdist 6.1.5 allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001-005 2195 rdist-symlink(5925) getty_ps 2.0.7j allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001:004 2194 gettyps-symlink(5924) useradd program in shadow-utils program may allow local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001:007 2196 shadow-utils-useradd-symlink(5927) ImageCast Control Center 4.1.0 allows remote attackers to cause a denial of service (resource exhaustion or system crash) via a long string to port 12002. 20010108 def-2001-01: ImageCast IC3 Control Center DoS 2174 storagesoft-imagecast-dos(5901) Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error. 20010108 def-2001-02: IBM Websphere 3.52 Kernel Leak DoS 20010307 def-2001-02: IBM HTTP Server Kernel Leak DoS (re-release) 2175 http://www-4.ibm.com/software/webservers/security.html ibm-websphere-dos(5900) Directory traversal vulnerability in eXtropia bbs_forum.cgi 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the file parameter. 20010107 Cgisecurity.com Advisory #3.1 http://www.extropia.com/hacks/bbs_security.html 2177 http-cgi-bbs-forum(5906) Buffer overflow in exrecover in Solaris 2.6 and earlier possibly allows local users to gain privileges via a long command line argument. 20010109 Solaris /usr/lib/exrecover buffer overflow 2179 solaris-exrecover-bo(5913) exmh 2.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the exmhErrorMsg temporary file. FreeBSD-SA-01:17 20001231 Advisory: exmh symlink vulnerability 20010112 exmh security vulnerability http://www.beedub.com/exmh/symlink.html DSA-022 MDKSA-2001:015 exmh-error-symlink(5829) Oracle XSQL servlet 1.0.3.0 and earlier allows remote attackers to execute arbitrary Java code by redirecting the XSQL server to another source via the xml-stylesheet parameter in the xslt stylesheet. 20010109 Oracle XSQL servlet and xml-stylesheet allow executing java on the web server 20010123 Patch for Potential Vulnerability in Oracle XSQL Servlet oracle-xsql-execute-code(5905) Buffer overflow in Olivier Debon Flash plugin (not the Macromedia plugin) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long DefineSound tag. 20010115 Flash plugin write-overflow VU#451096 2214 Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges. FreeBSD-SA-01:06 CLA-2000:365 DSA-006-1 MDKSA-2000-083 RHSA-2000:127 zope-calculate-roles(5777) Buffer overflow in Tinyproxy HTTP proxy 1.3.3 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long connect request. 20010117 [pkc] remote heap overflow in tinyproxy DSA-018 2217 tinyproxy-remote-bo(5954) Buffer overflow in HTML parser of the Lotus R5 Domino Server before 5.06, and Domino Client before 5.05, allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed font size specifier. http://service1.symantec.com/sarc/sarc.nsf/info/html/Lotus.Domino.Denial.of.Service.Malformed.HTML.Email.html lotus-html-bo(6207) htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems DSA-021 2182 linux-apache-symlink(5926) Interscan VirusWall 3.6.x and earlier follows symbolic links when uninstalling the product, which allows local users to overwrite arbitrary files via a symlink attack. 20010114 Trend Micro's VirusWall: Multiple vunerabilities 2213 The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff the administrator password via the setpasswd.cgi program or other HTTP GET requests that contain base64 encoded usernames and passwords. 20010114 Trend Micro's VirusWall: Multiple vunerabilities 2212 Buffer overflow in cpqlogin.htm in web-enabled agents for various Compaq management software products such as Insight Manager and Management Agents allows remote attackers to execute arbitrary commands via a long user name. 20010116 iXsecurity.20001120.compaq-authbo.a 2200 SSRT0705 The default installation of Ultraboard 2000 2.11 creates the Skins, Database, and Backups directories with world-writeable permissions, which could allow local users to modify sensitive information or possibly insert and execute CGI programs. 20010112 UltraBoard cgi directory permission problem 2197 Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed. 20010109 Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) 20010110 Re: Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) 20010213 Trustix Security Advisory - proftpd, kernel CLA-2001:380 DSA-029 MDKSA-2001:021 20001220 ProFTPD 1.2.0 Memory leakage - denial of service proftpd-size-memory-leak(5801) Windows Media Player 7 allows remote attackers to execute malicious Java applets in Internet Explorer clients by enclosing the applet in a skin file named skin.wmz, then referencing that skin in the codebase parameter to an applet tag, aka the Windows Media Player Skins File Download" vulnerability. 20010115 Windows Media Player 7 and IE java vulnerability - executing arbitrary programs 2203 MS01-010 win-mediaplayer-arbitrary-code(5937) privatepw program in wu-ftpd before 2.6.1-6 allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems DSA-016 MDKSA-2001-001 2189 linux-wuftpd-privatepw-symlink(5915) inn 2.2.3 allows local users to overwrite arbitrary files via a symlink attack in some configurations. 20010110 Immunix OS Security update for lots of temp file problems CSSA-2001-001.0 MDKSA-2001:010 2190 linux-inn-symlink(5916) arpwatch 2.1a4 allows local users to overwrite arbitrary files via a symlink attack in some configurations. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001:002 2183 tcpdump-arpwatch-symlink(5922) mgetty 1.1.22 allows local users to overwrite arbitrary files via a symlink attack in some configurations. 20010110 Immunix OS Security update for lots of temp file problems CSSA-2001-002.0 DSA-011 MDKSA-2001:009 RHSA-2001:050 2187 linux-mgetty-symlink(5918) squid 2.3 and earlier allows local users to overwrite arbitrary files via a symlink attack in some configurations. 20010112 Trustix Security Advisory - diffutils squid 20010110 Immunix OS Security update for lots of temp file problems DSA-019 MDKSA-2001:003 2184 squid-email-symlink(5921) vpop3d program in linuxconf 1.23r and earlier allows local users to overwrite arbitrary files via a symlink attack. 20010110 Immunix OS Security update for lots of temp file problems MDKSA-2001:011 2186 linuxconf-vpop3d-symlink(5923) CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow. 20010208 [CORE SDI ADVISORY] SSH1 CRC-32 compensation attack detector 20010208 Remote vulnerability in SSH daemon crc32 compensation attack detector CA-2001-35 2347 ssh-deattack-overwrite-memory(6083) Buffer overflow in VCard handler in Outlook 2000 and 98, and Outlook Express 5.x, allows an attacker to execute arbitrary commands via a malformed vCard birthday field. A022301-1 MS01-012 IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's. VU#796584 2440 2441 MS01-014 iis-malformed-url-dos(6171) exchange-malformed-url-dos(6172) Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records. MS01-013 The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of the "Frame Domain Verification" vulnerability. 20010101 Windows Media Player 7 and IE vulnerability - executing arbitrary programs MS01-015 media-player-execute-commands(6227) Windows Scripting Host in Internet Explorer 5.5 and earlier allows remote attackers to read arbitrary files via the GetObject Javascript function and the htmlfile ActiveX object. 20000926 IE 5.5/Outlook Express security vulnerability - GetObject() expose user's files 20000926 IE 5.5/Outlook Express security vulnerability - GetObject() expose user's files 1718 MS01-015 ie-getobject-expose-files(5293) Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0, which creates session transcripts. 2463 MS01-015 ie-telnet-execute-commands(6230) IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests. MS01-016 iis-webdav-dos(6205) oval:org.mitre.oval:def:90 The password protection option for the Compressed Folders feature in Plus! for Windows 98 and Windows Me writes password information to a file, which allows local users to recover the passwords and read the compressed folders. MS01-019 Buffer overflow in VB-TSQL debugger object (vbsdicli.exe) in Visual Studio 6.0 Enterprise Edition allows remote attackers to execute arbitrary commands. 20010327 Remote buffer overflow in DCOM VB T-SQL debugger MS01-018 HTML e-mail feature in Internet Explorer 5.5 and earlier allows attackers to execute attachments by setting an unusual MIME type for the attachment, which Internet Explorer does not process correctly. 20010330 Incorrect MIME Header Can Cause IE to Execute E-mail Attachment 1001197 CA-2001-06 L-066 2524 MS01-020 ie-mime-execute-code(6306) oval:org.mitre.oval:def:141 Format string vulnerability in VShell SSH gateway 1.0.1 and earlier allows remote attackers to execute arbitrary commands via a user name that contains format string specifiers. A021601-1 http://www.vandyke.com/products/vshell/security102.html VShell SSH gateway 1.0.1 and earlier has a default port forwarding rule of 0.0.0.0/0.0.0.0, which could allow local users to conduct arbitrary port forwarding to other systems. A021601-1 2402 http://www.vandyke.com/products/vshell/security102.html vshell-port-forwarding-rule(6148) Debugging utility in the backdoor mode of Palm OS 3.5.2 and earlier allows attackers with physical access to a Palm device to bypass access restrictions and obtain passwords, even if the system lockout mechanism is enabled. A030101-1 palm-debug-bypass-password(6196) Lucent/ORiNOCO WaveLAN cards generate predictable Initialization Vector (IV) values for the Wireless Encryption Protocol (WEP) which allows remote attackers to quickly compile information that will let them decrypt messages. http://www.cs.jhu.edu/~seny/pubs/wince802.pdf Cisco 340-series Aironet access point using firmware 11.01 does not use 6 of the 24 available IV bits for WEP encryption, which makes it easier for remote attackers to mount brute force attacks. http://www.cs.jhu.edu/~seny/pubs/wince802.pdf WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. http://www.cs.jhu.edu/~seny/pubs/wince802.pdf Cisco AP340 base station produces predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. http://www.cs.jhu.edu/~seny/pubs/wince802.pdf Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed recipient field. A030701-1 netscape-directory-server-bo(6233) Buffer overflow in ximp40 shared library in Solaris 7 and Solaris 8 allows local users to gain privileges via a long "arg0" (process name) argument. 20010131 [SPSadvisory#40]Solaris7/8 ximp40 shared library buffer overflow 2322 solaris-ximp40-bo(6039) Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file. 20001229 Shockwave Flash buffer overflow shockwave-flash-swf-bo(5826) Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string. 20010129 [CORE SDI ADVISORY] WinVNC client buffer overflow 2305 winvnc-client-bo(6025) Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long HTTP GET request when the DebugLevel registry key is greater than 0. 20010129 [CORE SDI ADVISORY] WinVNC server buffer overflow VU#598581 2306 winvnc-server-bo(6026) When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib. TLSA2000021-2 CSSA-2001-007 DSA-039 MDKSA-2001:012 SuSE-SA:2001:01 RHSA-2001:002 20010121 Trustix Security Advisory - glibc 2223 linux-glibc-preload-overwrite(5971) glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files. 20010110 Glibc Local Root Exploit 20010110 [slackware-security] glibc 2.2 local vulnerability on setuid binaries RHSA-2001:001 2181 linux-glibc-read-files(5907) Buffer overflow in SlimServe HTTPd 1.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long GET request. 20010130 DOS Vulnerability in SlimServe HTTPd 2318 slimserve-httpd-dos(6028) Buffer overflow in ReiserFS 3.5.28 in SuSE Linux allows local users to cause a denial of service and possibly execute arbitrary commands by via a long directory name. 20010109 major security bug in reiserfs (may affect SuSE Linux) 2180 suse-reiserfs-long-filenames(5910) Buffer overflow in qDecoder library 5.08 and earlier, as used in CrazyWWWBoard, CrazySearch, and other CGI programs, allows remote attackers to execute arbitrary commands via a long MIME Content-Type header. 20010130 Nobreak Tecnologies CrazyWWWBoard Remote Buffer Overflow 2329 crazywwwboard-qdecoder-bo(6033) Buffer overflow in Trend Micro Virus Buster 2001 8.00 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a large "To" address. 20010130 Security hole in Virus Buster 2001 virusbuster-mua-bo(6034) The caching module in Netscape Fasttrack Server 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by requesting a large number of non-existent URLs. 20010122 def-2001-05: Netscape Fasttrack Server Caching DoS 20010124 iPlanet FastTrack/Enterprise 4.1 DoS clarifications 2273 netscape-fasttrack-cache-dos(5985) The setuid doroot program in Voyant Sonata 3.x executes arbitrary command line arguments, which allows local users to gain root privileges. 20001218 More Sonata Conferencing software vulnerabilities. 2125 sonata-command-execute(5787) WebMaster ConferenceRoom 1.8.1 allows remote attackers to cause a denial of service via a buddy relationship between the IRC server and a server clone. 20010110 Vulnerable: Conference Room Professional-Developer Edititon. 2178 conferenceroom-developer-dos(5909) kdesu program in KDE2 (KDE before 2.2.0-6) does not properly verify the owner of a UNIX socket that is used to send a password, which allows local users to steal passwords and gain privileges. CSSA-2001-005.0 MDKSA-2001:018 SuSE-SA:2001:02 kde2-kdesu-retrieve-passwords(5995) Allaire JRun 3.0 allows remote attackers to list contents of the WEB-INF directory, and the web.xml file in the WEB-INF directory, via a malformed URL that contains a "." ASB01-02 jrun-webinf-file-retrieval(6008) Lars Ellingsen guestserver.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the "email" parameter. 20010129 Remote Command Execution in guestserver.cgi + exploit guestserver-cgi-execute-commands(6027) Format string vulnerability in the error logging code of DHCP server and client in Caldera Linux allows remote attackers to execute arbitrary commands. CSSA-2001-003.0 2215 dhcp-format-string(5953) FireWall-1 4.1 with a limited-IP license allows remote attackers to cause a denial of service by sending a large number of spoofed IP packets with various source addresses to the inside interface, which floods the console with warning messages and consumes CPU resources. 20010117 Licensing Firewall-1 DoS Attack 2238 fw1-limited-license-dos(5966) ipfw and ip6fw in FreeBSD 4.2 and earlier allows remote attackers to bypass access restrictions by setting the ECE flag in a TCP packet, which makes the packet appear to be part of an established connection. FreeBSD-SA-01:08 L-029 20010125 ecepass - proof of concept code for FreeBSD ipfw bypass 2293 ipfw-bypass-firewall(5998) eEye Iris 1.01 beta allows remote attackers to cause a denial of service via a malformed packet, which causes Iris to crash when a user views the packet. 20010121 eEye Iris the Network traffic analyser DoS 20010121 eEye Iris the Network traffic analyser DoS 2278 eeye-iris-dos(5981) Netopia R9100 router version 4.6 allows authenticated users to cause a denial of service by using the router's telnet program to connect to the router's IP address, which causes a crash. 20010123 Make The Netopia R9100 Router To Crash 2287 netopia-telnet-dos(6001) Directory traversal vulnerability in Free Java Web Server 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20010204 Vulnerability in Free Java Web Server Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands via a malformed argument that is recorded in a PASV port assignment. ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_current/missing_format_strings.patch CLA-2001:443 DSA-016 2296 wuftp-debug-format-string(6020) GoodTech FTP server 3.0.1.2.1.0 and earlier allows remote attackers to cause a denial of service via a flood of connections to the server, which causes it to crash. 20010122 def-2001-03: GoodTech Systems FTP Connection DoS 2270 goodtech-ftp-dos(5984) Directory traversal vulnerability in LocalWEB2000 HTTP server allows remote attackers to read arbitrary commands via a .. (dot dot) attack in an HTTP GET request. 20010119 LocalWEB2000 Directory Traversal Vulnerability 2268 localweb2k-directory-traversal(5982) Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier, and possibly other operating systems, allows local users to gain privileges by executing cu with a long program name (arg0). 20010117 Solaris /usr/bin/cu Vulnerability 20010123 Solaris /usr/bin/cu Vulnerability cu-argv-bo(6224) gnuserv before 3.12, as shipped with XEmacs, does not properly check the specified length of an X Windows MIT-MAGIC-COOKIE cookie, which allows remote attackers to execute arbitrary commands via a buffer overflow, or brute force authentication by using a short cookie length. 20010202 Remote vulnerability in gnuserv/XEmacs MDKSA-2001:019 RHSA-2001:010 RHSA-2001:011 gnuserv-tcp-cookie-overflow(6056) Buffer overflows in CTRLServer in XMail allows attackers to execute arbitrary commands via the cfgfileget or domaindel functions. 20010201 XMail CTRLServer remote buffer overflow vulnerability http://xmailserver.org/XMail-Readme.txt Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter. 20010131 SuSe / Debian man package format string vulnerability DSA-028 2327 man-i-format-string(6059) Buffer overflow in httpGets function in CUPS 1.1.5 allows remote attackers to execute arbitrary commands via a long input line. MDKSA-2001:020-1 cups-httpgets-dos(6043) sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to gain privileges via password cracking. DSA-015 linux-sash-shadow-readable(5994) inetd ident server in FreeBSD 4.x and earlier does not properly set group permissions, which allows remote attackers to read the first 16 bytes of files that are accessible by the wheel group. FreeBSD-SA-01:11 2324 inetd-ident-read-files(6052) Format string vulnerability in print_client in icecast 1.3.8beta2 and earlier allows remote attackers to execute arbitrary commands. 20010121 [pkc] format bugs in icecast 1.3.8b2 and prior CLA-2001:374 RHSA-2001:004 2264 icecast-format-string(5978) Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a long HREF parameter in an EMBED tag. 20010131 [SPSadvisory#41]Apple Quick Time Plug-in Buffer Overflow 20605 2328 quicktime-embedded-tag-bo(6040) Directory traversal vulnerability in SEDUM HTTP Server 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the HTTP GET request. 20010204 Vulnerability in SEDUM HTTP Server VU#651994 2335 sedum-directory-traversal(6063) HSWeb 2.0 HTTP server allows remote attackers to obtain the physical path of the server via a request to the /cgi/ directory, which will list the path if directory browsing is enabled. 20010204 Web root exposure in HSWeb Webserver 2336 The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program. 20010117 Postaci allows arbitrary SQL query execution 2230 postaci-sql-command-injection(5972) Picserver web server allows remote attackers to read arbitrary files via a .. (dot dot) attack in an HTTP GET request. 20010205 Vulnerability in Picserver 2339 Watchguard Firebox II firewall allows users with read-only access to gain read-write access, and administrative privileges, by accessing a file that contains hashed passphrases, and using the hashes during authentication. 20010120 Watchguard Firewall Elevated Privilege Vulnerability 2284 watchguard-firebox-obtain-passphrase(5979) Watchguard Firebox II allows remote attackers to cause a denial of service by establishing multiple connections and sending malformed PPTP packets. 20010214 def-2001-07: Watchguard Firebox II PPTP DoS 2369 firebox-pptp-dos(6109) Directory traversal vulnerability in AOLserver 3.2 and earlier allows remote attackers to read arbitrary files by inserting "..." into the requested pathname, a modified .. (dot dot) attack. 20010206 Vulnerability in AOLserver 20010208 Vulnerability in AOLserver 2343 Directory traversal vulnerability in Soft Lite ServerWorx 3.00 allows remote attackers to read arbitrary files by inserting a .. (dot dot) or ... into the requested pathname of an HTTP GET request. 20010207 Vulnerability in Soft Lite ServerWorx 2346 Buffer overflow in bing allows remote attackers to execute arbitrary commands via a long hostname, which is copied to a small buffer after a reverse DNS lookup using the gethostbyaddr function. 20010119 Buffer overflow in bing 2279 linux-bing-bo(6036) MicroFocus Cobol 4.1, with the AppTrack feature enabled, installs the mfaslmf directory and the nolicense file with insecure permissions, which allows local users to gain privileges by modifying files. 20010211 Security Hole in Microfocus Cobol 2359 Buffer overflow in Shoutcast Distributed Network Audio Server (DNAS) 1.7.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long description. 20010118 Shoutcast Server Buffer Crashes Server shoutcast-description-bo(5965) Directory traversal vulnerability in commerce.cgi CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack in the page parameter. 20010212 Commerce.cgi Directory Traversal 2361 Directory traversal vulnerability in WebSPIRS 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) attack on the sp.nextform parameter. 20010212 WebSPIRS CGI script "show files" Vulnerability. 2362 Directory traversal vulnerability in HIS Auktion 1.62 allows remote attackers to read arbitrary files via a .. (dot dot) in the menue parameter, and possibly execute commands via shell metacharacters. 20010212 HIS Auktion 1.62: "show files" vulnerability and remote command execute. 2367 Buffer overflow in pi program in PlanetIntra 2.5 allows remote attackers to execute arbitrary commands. 200101125 [SAFER] Security Bulletin 010125.EXP.1.12 planetintra-pi-bo(6002) Way-board CGI program allows remote attackers to read arbitrary files by specifying the filename in the db parameter and terminating the filename with a null byte. 20010212 Way board: "show files" Vulnerability with null bite bug 2370 ROADS search.pl program allows remote attackers to read arbitrary files by specifying the file name in the form parameter and terminating the filename with a null byte. 20010212 ROADS search system "show files" Vulnerability with "null bite" bug http://www.roads.lut.ac.uk/lists/open-roads/2001/02/0001.html 2371 roads-search-view-files(6097) PALS Library System pals-cgi program allows remote attackers to execute arbitrary commands via shell metacharacters in the documentName parameter. 20010212 PALS Library System "show files" Vulnerability and remote command execution 2372 webpals-library-cgi-url(6102) Directory traversal vulnerability in PALS Library System pals-cgi program allows remote attackers to read arbitrary files via a .. (dot dot) in the documentName parameter. 20010212 PALS Library System "show files" Vulnerability and remote command execution 2372 webpals-library-cgi-url(6102) Format string vulnerability in mars_nwe 0.99.pl19 allows remote attackers to execute arbitrary commands. 20010126 format string vulnerability in mars_nwe 0.99pl19 FreeBSD-SA-01:20 mars-nwe-format-string(6019) Vulnerability in Support Tools Manager (xstm,cstm,stm) in HP-UX 11.11 and earlier allows local users to cause a denial of service. HPSBUX0101-137 2239 hp-stm-dos(5957) Buffer overflow in ja-elvis and ko-helvis ports of elvis allow local users to gain root privileges. FreeBSD-SA-01:21 Buffer overflow in ja-xklock 2.7.1 and earlier allows local users to gain root privileges. FreeBSD-SA-01:19 ja-xklock-bo(6073) webmin 0.84 and earlier allows local users to overwrite and create arbitrary files via a symlink attack. CSSA-2001-004.0 MDKSA-2001-016 linux-webmin-tmpfiles(6011) Buffer overflow in wwwwais allows remote attackers to execute arbitrary commands via a long QUERY_STRING (HTTP GET request). 20010117 numerous holes wwwwais-cgi-dos(5980) Muscat Empower CGI program allows remote attackers to obtain the absolute pathname of the server via an invalid request in the DB parameter. 20010212 Vulnerability in Muscat Empower wich can print path to DB-dir. 2374 muskat-empower-url-dir(6093) fortran math component in Infobot 0.44.5.3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters. 20010207 Infobot 0.44.5.3/below remotely vulnerable (also in FreeBSD ports tree) 2349 Directory traversal vulnerability in BiblioWeb web server 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) or ... attack in an HTTP GET request. 20010205 Vulnerabilities in BiblioWeb Server Buffer overflow in BiblioWeb web server 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP GET request. 20010205 Vulnerabilities in BiblioWeb Server Directory traversal vulnerability in GoAhead web server 2.1 and earlier allows remote attackers to read arbitrary files via a .. attack in an HTTP GET request. 20010202 GoAhead Web Server Directory Traversal Vulnerability http://freecode.com/projects/embedthis-goahead-webserver/releases/343539 81099 Chili!Soft ASP for Linux before 3.6 does not properly set group privileges when running in inherited mode, which could allow attackers to gain privileges via malicious scripts. 20010206 Security hole in ChiliSoft ASP on Linux. Buffer overflow in dc20ctrl before 0.4_1 in FreeBSD, and possibly other operating systems, allows local users to gain privileges. FreeBSD-SA-01:22 dc20ctrl-port-bo(6077) Directory traversal vulnerability in newsdesk.cgi in News Desk 1.2 allows remote attackers to read arbitrary files via a .. in the "t" parameter. 20010103 News Desk 1.2 CGI Vulnerbility VU#496064 2172 newsdesk-cgi-read-files(5898) newsdesk.cgi in News Desk 1.2 allows remote attackers to read arbitrary files via shell metacharacters. 20010103 News Desk 1.2 CGI Vulnerbility Buffer overflow in micq client 0.4.6 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long Description field. FreeBSD-SA-01:14 20010118 [PkC] Advisory #003: micq-0.4.6 remote buffer overflow 20010124 patch Re: [PkC] Advisory #003: micq-0.4.6 remote buffer overflow DSA-012 RHSA-2001:005 micq-sprintf-remote-bo(5962) NewsDaemon before 0.21b allows remote attackers to execute arbitrary SQL queries and gain privileges via a malformed user_username parameter. 20010126 NewsDaemon remote administrator access http://sourceforge.net/forum/forum.php?forum_id=60570 newsdaemon-gain-admin-access(6010) Vulnerability in crontab allows local users to read crontab files of other users by replacing the temporary file that is being edited while crontab is running. FreeBSD-SA-01:09 DSA-024 2332 crontab-read-files(6225) Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long "indication" event. 20010314 Solaris /usr/lib/dmi/snmpXdmid vulnerability 00207 CA-2001-05 L-065 2417 solaris-snmpxdmid-bo(6245) Memory leak in Microsoft 2000 domain controller allows remote attackers to cause a denial of service by repeatedly connecting to the Kerberos service and then disconnecting without sending any data. L-079 20010509 def-2001-24: Windows 2000 Kerberos DoS 2707 MS01-024 win2k-kerberos-dos(6506) Microsoft Data Access Component Internet Publishing Provider 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests. L-074 MS01-022 ms-dacipp-webdav-access(6405) Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request with a specific type. L-073 20010416 [SX-20010320-2] - Microsoft ISA Server Denial of Service 20010417 [SX-20010320-2b] - Followup re. Microsoft ISA Server Denial of Service 20010427 Microsoft ISA Server Vulnerability 2600 MS01-021 isa-web-proxy-dos(6383) Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format (RTF) document that links to a template with the embedded macro. 2753 MS01-028 word-rtf-macro-execution(6571) Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0. 20010501 Windows 2000 IIS 5.0 Remote buffer overflow vulnerability (Remote SYSTEM Level Access) CA-2001-10 2674 MS01-023 iis-isapi-printer-bo(6485) oval:org.mitre.oval:def:1068 Buffer overflows in Microsoft Windows Media Player 7 and earlier allow remote attackers to execute arbitrary commands via (1) a long version tag in an .ASX file, or (2) a long banner tag, a variant of the ".ASX Buffer Overrun" vulnerability as discussed in MS:MS00-090. VU#187528 20010502 Microsoft Media Player ASX Parser buffer overflow vulnerability 20010506 Re: Microsoft Media Player ASX Parser buffer overflow vulnerability 2677 2686 MS01-029 mediaplayer-asx-bo(5574) Windows Media Player 7 and earlier stores Internet shortcuts in a user's Temporary Files folder with a fixed filename instead of in the Internet Explorer cache, which causes the HTML in those shortcuts to run in the Local Computer Zone instead of the Internet Zone, which allows remote attackers to read certain files. 2765 MS01-029 mediaplayer-html-shortcut(6584) Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter. 2709 MS01-025 winnt-indexserver-search-bo(6517) Microsoft Index Server 2.0 in Windows NT 4.0, and Indexing Service in Windows 2000, allows remote attackers to read server-side include files via a malformed search request, aka a new variant of the "Malformed Hit-Highlighting" vulnerability. MS01-025 win-indexserver-view-files(6518) Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain, aka a variant of the "Frame Domain Verification" vulnerability. MS01-027 Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3. NetBSD-SA2000-018 20010802-01-P FreeBSD-SA-01:33 CA-2001-07 20010409 Globbing Vulnerabilities in Multiple FTP Daemons 2548 ftp-glob-expansion(6332) Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings. CA-2001-07 20010409 Globbing Vulnerabilities in Multiple FTP Daemons 2552 ftp-glob-expansion(6332) Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings. CA-2001-07 20010409 Globbing Vulnerabilities in Multiple FTP Daemons 2550 ftp-glob-expansion(6332) The Web Publishing feature in Netscape Enterprise Server 4.x and earlier allows remote attackers to list arbitrary directories under the web server root via the INDEX command. 20010124 [SAFER] Security Bulletin 010124.EXP.1.11 2285 netscape-enterprise-list-directories(5997) The Web Publishing feature in Netscape Enterprise Server 3.x allows remote attackers to cause a denial of service via the REVLOG command. 20010125 [SAFER] Security Bulletin 010125.DOS.1.5 2294 netscape-enterprise-revlog-dos(6003) iPlanet (formerly Netscape) Enterprise Server 4.1 allows remote attackers to cause a denial of service via a long HTTP GET request that contains many "/../" (dot dot) sequences. 20010124 iPlanet FastTrack/Enterprise 4.1 DoS clarifications 20010122 def-2001-04: Netscape Enterprise Server Dot-DoS 2282 netscape-enterprise-dot-dos(5983) Directory traversal vulnerability in hsx.cgi program in iWeb Hyperseek 2000 allows remote attackers to read arbitrary files and directories via a .. (dot dot) attack in the show parameter. 20010128 Hyperseek 2000 Search Engine - "show directory & files" bug VU#146704 2314 hyperseek-cgi-reveal-info(6012) FaSTream FTP++ Server 2.0 allows remote attackers to obtain the real pathname of the server via the "pwd" command. 20010119 Multiple Vulnerabilities In FaSTream FTP++ (+ ICS Tftpserver DoS) FaSTream FTP++ Server 2.0 allows remote attackers to list arbitrary directories by using the "ls" command and including the drive letter name (e.g. C:) in the requested pathname. 20010119 Multiple Vulnerabilities In FaSTream FTP++ (+ ICS Tftpserver DoS) 2267 fastream-ftp-path-disclosure(5977) FaSTream FTP++ Server 2.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long username. 20010119 Multiple Vulnerabilities In FaSTream FTP++ (+ ICS Tftpserver DoS) 2261 fastream-ftp-server-dos(5976) Buffer overflow in Easycom/Safecom Print Server Web service, version 404.590 and earlier, allows remote attackers to execute arbitrary commands via (1) a long URL or (2) a long HTTP header field such as "Host:". 20010123 def-2001-06: Easycom/Safecom 10/100 Multiple DoS 2291 easycom-safecom-url-bo(5988) The Easycom/Safecom Print Server (firmware 404.590) PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters. 20010123 def-2001-06: Easycom/Safecom 10/100 Multiple DoS easycom-safecom-printguide-dos(5989) ssh-keygen in ssh 1.2.27 - 1.2.30 with Secure-RPC can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private key file. 20010116 Bug in SSH1 secure-RPC support can expose users' private keys 2222 http://www.ssh.com/products/ssh/patches/secureRPCvulnerability.html ssh-rpc-private-key(5963) Buffer overflow in Lotus Domino Mail Server 5.0.5 and earlier allows a remote attacker to crash the server or execute arbitrary code via a long "RCPT TO" command. 20010123 [SAFER] Security Bulletin 010123.EXP.1.10 2283 lotus-domino-smtp-bo(5993) Microsoft Windows 2000 Encrypted File System does not properly destroy backups of files that are encrypted, which allows a local attacker to recover the text of encrypted files. 20010119 BugTraq: EFS Win 2000 flaw 20010123 Reply to EFS note on Bugtraq 2243 win2k-efs-recover-data(5973) Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL. A041301-1 Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows attackers to read file attributes outside of the web root via the (1) SIZE and (2) MDTM commands when the "show relative paths" option is not enabled. A040301-1 2537 bpftp-obtain-credentials(6330) Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection. A040301-1 2534 ASCII Armor parser in Windows PGP 7.0.3 and earlier allows attackers to create files in arbitrary locations via a malformed ASCII armored file. A040901-1 2556 pgp-armor-code-execution(6643) Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges. HPSBUX0102-143 NM debug in HP MPE/iX 6.5 and earlier does not properly handle breakpoints, which allows local users to gain privileges. HPSBMP0102-008 hp-nmdebug-gain-privileges(6226) The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address. 20010219 Re: your mail CSSA-2001-SCO.35 NetBSD-SA:2001-002 VU#358960 20010302 The USER_LDT kernel option allows an attacker to gain access to privileged areas of kernel memory. 2739 user-ldt-validation(6222) pam_ldap authentication module in Solaris 8 allows remote attackers to bypass authentication via a NULL password. 20010217 Solaris 8 pam_ldap.so.1 module broken solaris-pamldap-bypass-authentication(6440) Marconi ASX-1000 ASX switches allow remote attackers to cause a denial of service in the telnet and web management interfaces via a malformed packet with the SYN-FIN and More Fragments attributes set. 20010219 Denial of Service Condition exists in Fore/Marconi ASX Switches 2400 mailnews.cgi 1.3 and earlier allows remote attackers to execute arbitrary commands via a user name that contains shell metacharacters. 20010218 mailnews.cgi 2391 Directory traversal vulnerability in sendtemp.pl in W3.org Anaya Web development server allows remote attackers to read arbitrary files via a .. (dot dot) attack in the templ parameter. 20010212 W3.ORG sendtemp.pl pgp4pine Pine/PGP interface version 1.75-6 does not properly check to see if a public key has expired when obtaining the keys via Gnu Privacy Guard (GnuPG), which causes the message to be sent in cleartext. 20010220 [CryptNET Advisory] pgp4pine-1.75-6 - expired public keys VU#566640 2405 pgp4pine-expired-keys(6135) kicq IRC client 1.0.0, and possibly later versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. 20010214 Security hole in kicq 20010303 Re: Security hole in kicq kicq-execute-commands(6112) Moby Netsuite Web Server 1.02 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request. 20010219 NetSuite 1.02 web server vulnerabilty ext.dll in BadBlue 1.02.07 Personal Edition web server allows remote attackers to determine the physical path of the server by directly calling ext.dll without any arguments, which produces an error message that contains the path. 20010217 BadBlue Web Server Ext.dll Vulnerabilities http://www.badblue.com/p010219.htm 2390 badblue-ext-reveal-path(6130) Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP GET request. 20010217 BadBlue Web Server Ext.dll Vulnerabilities 2392 Vulnerability in linkeditor in HP MPE/iX 6.5 and earlier allows local users to gain privileges. HPSBMP0102-009 hp-linkeditor-gain-privileges(6223) Buffer overflow in sudo earlier than 1.6.3p6 allows local users to gain root privileges. 20010222 Sudo version 1.6.3p6 now available (fwd) 20010226 Trustix Security Advisory - sudo 20010225 [slackware-security] buffer overflow in sudo fixed CLA-2001:381 DSA-031 MDKSA-2001:024 RHSA-2001:018 RHSA-2001:019 Buffer overflow in MERCUR SMTP server 3.30 allows remote attackers to execute arbitrary commands via a long EXPN command. 20010223 Mercur Mailserver 3.3 buffer overflow with EXPN mercur-expn-bo(6149) Format string vulnerability in DbgPrint function, used in debug messages for some Windows NT drivers (possibly when called through DebugMessage), may allow local users to gain privileges. 20010221 NT drivers are potentially vulnerable to format string bug SEDUM 2.1 HTTP server allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request. 20010223 SEDUM v2.1 HTTPd - Denial of Service Directory traversal vulnerability in SunFTP build 9 allows remote attackers to read arbitrary files via .. (dot dot) characters in various commands, including (1) GET, (2) MKDIR, (3) RMDIR, (4) RENAME, or (5) PUT. 20010302 Sunftp build9(1) - ftp server Vulnerability Buffer overflow in IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header (AH) IPv4 option. 20010302 Insufficient checks in the IPSEC AH IPv4 option handling code can lead to a buffer overrun in the kernel. Buffer overflow in A1 HTTP server 1.0a allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request. 20010226 A1 Server v1.0a HTTPd (DoS & Dir Traversal) Directory traversal vulnerability in A1 HTTP server 1.0a allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request. 20010226 A1 Server v1.0a HTTPd (DoS & Dir Traversal) VERITAS Cluster Server (VCS) 1.3.0 on Solaris allows local users to cause a denial of service (system panic) via the -L option to the lltstat command. 20010302 Option to VERITAS Cluster Server (VCS) lltstat command will panic system. http://seer.support.veritas.com/docs/234326.htm Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. 20010228 Cisco IOS Software TCP Initial Sequence Number Randomization Improvements Joe text editor 2.8 searches the current working directory (CWD) for the .joerc configuration file, which could allow local users to gain privileges of other users by placing a Trojan Horse .joerc file into a directory, then waiting for users to execute joe from that directory. 20010228 Joe's Own Editor File Handling Error DSA-041 MDKSA-2001:026 RHSA-2001:024 Vulnerability in Mailman 2.0.1 and earlier allows list administrators to obtain user passwords. 20010306 [Mailman-Announce] ANNOUNCE Mailman 2.0.2 (important privacy patch) Buffer overflow in post-query sample CGI program allows remote attackers to execute arbitrary commands via an HTTP POST request that contains at least 10001 parameters. 20010305 Remote buffer overflow condition in post-query (CGI). PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator. 20010302 PHPNUKE4.4.1a Advisory Directory traversal vulnerability in FtpXQ FTP server 2.0.93 allows remote attackers to read arbitrary files via a .. (dot dot) in the GET command. 20010228 Vulnerability in FtpXQ Server 2426 Directory traversal vulnerability in TYPSoft FTP Server 0.85 allows remote attackers to read arbitrary files via (1) a .. (dot dot) in a GET command, or (2) a ... in a CWD command. 20010228 Vulnerability in TYPSoft FTP Server Directory traversal vulnerability in War FTP 1.67.04 allows remote attackers to list directory contents and possibly read files via a "dir *./../.." command. 20010306 Warftp 1.67b04 Directory Traversal http://support.jgaa.com/?cmd=ShowArticle&ID=31 2444 Buffer overflow in WFTPD Pro 3.00 allows remote attackers to execute arbitrary commands via a long CWD command. 20010303 WFTPD Pro 3.00 R1 Buffer Overflow Directory traversal vulnerability in Simple Server HTTPd 1.0 (originally Free Java Server) allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. 20010224 The Simple Server HTTPd Directory Traversal 2415 Buffer overflow in WebReflex 1.55 HTTPd allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP GET request. 20010227 WebReflex 1.55 HTTPd DoS 2425 Buffer overflow in Voyager web administration server for Nokia IP440 allows local users to cause a denial of service, and possibly execute arbitrary commands, via a long URL. 20001127 Nokia firewalls 20001205 Nokia firewalls - Response from Nokia 2054 nokia-ip440-bo(5640) oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory (ldaplog) that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack. 20001222 vulnerability #2 in Oracle Internet Directory 2.1.1.1 in Oracle 8.1.7 VU#610904 oracle-oidldap-write-permission(5804) Buffer overflow in Analog before 4.16 allows remote attackers to execute arbitrary commands by using the ALIAS command to construct large strings. 20010213 Security advisory for analog RHSA-2001:017 http://www.analog.cx/security2.html DSA-033 2377 analog-alias-bo(6105) Buffer overflow in tstisapi.dll in Pi3Web 1.0.1 web server allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long URL. 20010215 Vulnerabilities in Pi3Web Server 2381 tstisapi.dll in Pi3Web 1.0.1 web server allows remote attackers to determine the physical path of the server via a URL that requests a non-existent file. 20010215 Vulnerabilities in Pi3Web Server 2381 Directory traversal vulnerability in Caucho Resin 1.2.2 allows remote attackers to read arbitrary files via a "\.." (dot dot) in a URL request. 20010216 Vulnerability in Resin Webserver 2384 Directory traversal vulnerability in store.cgi in Thinking Arts ES.One package allows remote attackers to read arbitrary files via a .. (dot dot) in the StartID parameter. 20010216 Thinking Arts Store.cgi Directory Traversal 2385 Directory traversal vulnerability in ITAfrica WEBactive HTTP Server 1.00 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL. 20010216 WEBactive HTTP Server 1.0 Directory Traversal 2386 Bajie HTTP JServer 0.78, and other versions before 0.80, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP request for a CGI program that does not exist. 20010216 Vulnerabilities in Bajie Http JServer http://www.geocities.com/gzhangx/websrv/docs/security.html UploadServlet in Bajie HTTP JServer 0.78, and possibly other versions before 0.80, allows remote attackers to execute arbitrary commands by calling the servlet to upload a program, then using a ... (modified ..) to access the file that was created for the program. 20010216 Vulnerabilities in Bajie Http JServer http://www.geocities.com/gzhangx/websrv/docs/security.html 2388 inetd in Red Hat 6.2 does not properly close sockets for internal services such as chargen, daytime, echo, etc., which allows remote attackers to cause a denial of service via a series of connections to the internal services. RHSA-2001:006 inetd-internal-socket-dos(6380) sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts. FreeBSD-SA-01:13 3960 sort-temp-file-abort(6038) Vulnerability in OmniBackII A.03.50 in HP 11.x and earlier allows attackers to gain unauthorized access to an OmniBack client. PHSS_22914 PHSS_22915 HPSBUX0102-142 omniback-unauthorized-access(6434) IBM WebSphere plugin for Netscape Enterprise server allows remote attackers to read source code for JSP files via an HTTP request that contains a host header that references a host that is not in WebSphere's host aliases list, which will bypass WebSphere processing. 20010125 Yet Another IBM WebSphere Showcode Vulerability Borderware Firewall Server 6.1.2 allows remote attackers to cause a denial of service via a ping to the broadcast address of the public network on which the server is placed, which causes the server to continuously send pings (echo requests) to the network. 20010126 Borderware v6.1.2 ping DoS vulnerability borderware-ping-dos(6004) Buffer overflow in www.tol module in America Online (AOL) 5.0 may allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long URL in a link. 20010125 America Online 5.0 contains a buffer overflow aol-malformed-url-dos(6009) The locking feature in mIRC 5.7 allows local users to bypass the password mechanism by modifying the LockOptions registry key. 20010125 mIRC allows password protection to be bypassed mirc-bypass-password(6013) Linux kernel 2.4 and 2.2 allows local users to read kernel memory and possibly gain privileges via a negative argument to the sysctl call. 20010213 Trustix Security Advisory - proftpd, kernel CSSA-2001-009 RHSA-2001:013 2364 linux-sysctl-read-memory(6079) Race condition in ptrace in Linux kernel 2.4 and 2.2 allows local users to gain privileges by using ptrace to track and modify a running setuid process. 20010213 Trustix Security Advisory - proftpd, kernel CSSA-2001-009 RHSA-2001:013 linux-ptrace-modify-process(6080) Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd). 20010206 Response to ProFTPD issues CLA-2001:380 20010110 proftpd 1.2.0rc2 -- example of bad coding DSA-029 MDKSA-2001:021 proftpd-format-string(6433) orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the report capability. 20010205 IBM NetCommerce Security 2350 http://www-4.ibm.com/software/webservers/commerce/netcomletter.html ibm-netcommerce-reveal-information(6067) bb_smilies.php and bbcode_ref.php in PHP-Nuke 4.4 allows remote attackers to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. (dot dot) sequences into a malformed username argument. 20010223 Yet another hole in PHP-Nuke opendir.php script in PHP-Nuke allows remote attackers to read arbitrary files by specifying the filename as an argument to the requesturl parameter. 20010212 Fwd: Re: phpnuke, security problem... phpnuke-opendir-read-files(6512) MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script that creates and deletes an object that is associated with the browser window object. 20010115 Stack Overflow in MSHTML.DLL 2202 ie-mshtml-dos(5938) The ICMP path MTU (PMTU) discovery feature in various UNIX systems allows remote attackers to cause a denial of service by spoofing "ICMP Fragmentation needed but Don't Fragment (DF) set" packets between two target hosts, which could cause one host to lower its MTU when transmitting to the other host. 20010115 ICMP fragmentation required but DF set problems. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html icmp-pmtu-dos(5975) Windows 98 and Windows 2000 Java clients allow remote attackers to cause a denial of service via a Java applet that opens a large number of UDP sockets, which prevents the host from establishing any additional UDP connections, and possibly causes a crash. 20010206 Windows client UDP exhaustion denial of service 2340 Buffer overflow in QNX RTP 5.60 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large number of arguments to the stat command. 20010202 QNX RTP ftpd stack overflow 2342 Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission. 20010212 Solution for Potential Vunerability in Granting FilePermission to Oracle Java Virtual Machine oracle-jvm-file-permissions(6438) iPlanet Web Server Enterprise Edition 4.1 and earlier allows remote attackers to retrieve sensitive data from memory allocation pools, or cause a denial of service, via a URL-encoded Host: header in the HTTP request, which reveals memory in the Location: header that is returned by the server. A041601-1 http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html VU#276767 TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one of which may match the expected ISN. 20030201-01-P 57 CA-2001-09 2682 1033181 oval:org.mitre.oval:def:4922 Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi. A043001-1 http://www.mozilla.org/projects/bugzilla/security2_12.html 1199 Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the globals.pl file, which is normally returned by the web server without being executed. A043001-1 2671 bugzilla-gobalpl-gain-information(6489) Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary commands. 20010501-01-P VU#258632 2714 20010509 Remote Buffer Overflow Vulnerability in IRIX Embedded Support Partner Infrastructure irix-espd-bo(6502) Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain using MSScriptControl.ScriptControl and GetObject, aka a variant of the "Frame Domain Verification" vulnerability. 20010330 Security bug in Internet Explorer - MSScriptControl.ScriptControl MS01-027 Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. 20010515 NSFOCUS SA2001-02 : Microsoft IIS CGI Filename Decode Error Vulnerability CA-2001-12 2708 MS01-026 iis-url-decoding(6534) oval:org.mitre.oval:def:1018 oval:org.mitre.oval:def:1051 oval:org.mitre.oval:def:37 oval:org.mitre.oval:def:78 FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded. MS01-026 iis-ftp-wildcard-dos(6535) FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a special sequence of characters. 2719 MS01-026 iis-ftp-domain-authentication(6545) The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request. MS01-026 iis-crosssitescripting-patch-dos(6858) The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests. MS01-026 Internet Explorer 5.5 and earlier does not properly validate digital certificates when Certificate Revocation List (CRL) checking is enabled, which could allow remote attackers to spoof trusted web sites, aka the "Server certificate validation vulnerability." L-087 2735 MS01-027 ie-crl-certificate-spoofing(6555) Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability." L-087 2737 MS01-027 ie-html-url-spoofing(6556) oval:org.mitre.oval:def:1096 An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically. L-091 MS01-030 exchange-owa-script-execution(6652) Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll. 20010625 NSFOCUS SA2001-03 : Microsoft FrontPage 2000 Server Extensions Buffer Overflow Vulnerability 2906 MS01-035 frontpage-ext-rad-bo(6730) An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account. L-095 MS01-032 mssql-cached-connection-access(6684) oval:org.mitre.oval:def:71 Microsoft Windows 2000 telnet service allows attackers to prevent idle Telnet sessions from timing out, causing a denial of service by creating a large number of idle sessions. 2843 MS01-031 win2k-telnet-idle-sessions-dos(6667) Handle leak in Microsoft Windows 2000 telnet service allows attackers to cause a denial of service by starting a large number of sessions and terminating them. MS01-031 win2k-telnet-handle-leak-dos(6668) Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid. L-092 2847 MS01-031 win2k-telnet-domain-authentication(6665) Microsoft Windows 2000 telnet service allows attackers to cause a denial of service (crash) via a long logon command that contains a backspace. 20010608 Range checking fault condition in Microsoft Windows 2000 Telnet server L-092 2838 MS01-031 win2k-telnet-username-dos(6666) Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the first of two variants of this vulnerability. VU#587587 2849 MS01-031 win2k-telnet-pipe-privileges(6664) Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the second of two variants of this vulnerability. MS01-031 win2k-telnet-pipe-privileges(6664) Microsoft Windows 2000 telnet service allows a local user to make a certain system call that allows the user to terminate a Telnet session and cause a denial of service. L-092 2846 MS01-031 win2k-telnet-system-call-dos(6669) SNMP agents in 3Com AirConnect AP-4111 and Symbol 41X1 Access Point allow remote attackers to obtain the WEP encryption key by reading it from a MIB when the value should be write-only, via (1) dot11WEPDefaultKeyValue in the dot11WEPDefaultKeysTable of the IEEE 802.11b MIB, or (2) ap128bWepKeyValue in the ap128bWEPKeyTable in the Symbol MIB. Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a "transfer job" routine. 00206 CA-2001-15 2894 20010619 Remote Buffer Overflow Vulnerability in Solaris Print Protocol Daemon solaris-lpd-bo(6718) TheNet CheckBO 1.56 allows remote attackers to cause a denial of service via a flood of characters to the TCP ports which it is listening on. 20010420 CheckBO Win9x memo overflow 2634 Novell Groupwise 5.5 (sp1 and sp2) allows a remote user to access arbitrary files via an implementation error in Groupwise system policies. 20010210 Novell Groupwise Client Vulnerability FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters. 20010310 CORRECTION to CODE: FormMail.pl can be used to send anonymous email formmail-anonymous-flooding(6242) Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via (1) a long map command, (2) a long exec command, or (3) long input in a configuration file. 20010309 Advisory: Half-life server buffer overflows and formatting vulnerabilities halflife-map-bo(6218) halflife-config-file-bo(6221) Format string vulnerability in Sierra Half-Life build 1573 and earlier allows a remote attacker to execute arbitrary code via the map command. 20010309 Advisory: Half-life server buffer overflows and formatting vulnerabilities halflife-map-format-string(6220) Directory traversal vulnerability in help.cgi in Ikonboard 2.1.7b and earlier allows a remote attacker to read arbitrary files via a .. (dot dot) attack in the helpon parameter. 20010311 Ikonboard v2.1.7b "show files" vulnerability 2471 ikonboard-cgi-read-files(6216) Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5. FreeBSD-SA-01:24 20010207 [CORE SDI ADVISORY] SSH1 session key recovery vulnerability L-047 DSA-023 DSA-027 DSA-086 SuSE-SA:2001:04 2344 ssh-session-key-recovery(6082) SSH Communications Security sshd 2.4 for Windows allows remote attackers to create a denial of service via a large number of simultaneous connections. 20010315 Remote DoS attack against SSH Secure Shell for Windows Servers 2477 ssh-ssheloop-dos(6241) Eudora before 5.1 allows a remote attacker to execute arbitrary code, when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags. 20010318 feeble.you!dora.exploit 2490 eudora-html-execute-code(6262) saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program. ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol 20010429 SAP R/3 Web Application Server Demo for Linux: root exploit 2662 linux-sap-execute-code(6487) Mirabilis ICQ WebFront Plug-in ICQ2000b Build 3278 allows a remote attacker to create a denial of service via HTTP URL requests containing a large number of % characters. 20010428 Mirabilis ICQ WebFront Plug-in Denial of Service 2664 Directory traversal vulnerability in BearShare 2.2.2 and earlier allows a remote attacker to read certain files via a URL containing a series of . characters, a variation of the .. (dot dot) attack. 20010430 A Serious Security Vulnerability Found in BearShare (Directory Traversal) 2672 bearshare-dot-download-files(6481) Buffer overflow in lpsched on DGUX version R4.20MU06 and MU02 allows a local attacker to obtain root access via a long command line argument (non-existent printer name). 20010319 DGUX lpsched buffer overflow dgux-lpsched-bo(6258) fcheck prior to 2.57.59 calls the file signature checking program insecurely, which can allow a local user to run arbitrary commands via a file name that contains shell metacharacters. 20010320 fcheck prior to 2.07.59 - vulnerability - improper use of perl 'magic open' fcheck-open-execute-commands(6256) Race condition in the UFS and EXT2FS file systems in FreeBSD 4.2 and earlier, and possibly other operating systems, makes deleted data available to user processes before it is zeroed out, which allows a local user to access otherwise restricted information. FreeBSD-SA-01:30 ufs-ext2fs-data-disclosure(6268) Akopia Interchange 4.5.3 through 4.6.3 installs demo stores with a default group account :backup with no password, which allows a remote attacker to gain administrative access via the demo stores (1) barry, (2) basic, or (3) construct. 20010323 FW: Akopia Interchange E-commerce Package Demo Files Vulnerability http://lists.akopia.com/pipermail/interchange-announce/2001/000009.html 2499 akopia-interchange-gain-access(6273) The default configuration of the Dr. Watson program in Windows NT and Windows 2000 generates user.dmp crash dump files with world-readable permissions, which could allow a local user to gain access to sensitive information. 20010323 NT crash dump files insecure by default 2501 win-userdmp-insecure-permission(6275) The HTTP server in Compaq web-enabled management software for (1) Foundation Agents, (2) Survey, (3) Power Manager, (4) Availability Agents, (5) Intelligent Cluster Administrator, and (6) Insight Manager can be used as a generic proxy server, which allows remote attackers to bypass access restrictions via the management port, 2301. 20010322 Compaq Insight Manager Proxy Vuln SSRT0715 compaq-wbm-bypass-proxy(6264) Cisco PIX Firewall 515 and 520 with 5.1.4 OS running aaa authentication to a TACACS+ server allows remote attackers to cause a denial of service via a large number of authentication requests. 20010406 PIX Firewall 5.1 DoS Vulnerability 20011003 Cisco PIX Firewall Authentication Denial of Service Vulnerability 2551 cisco-pix-tacacs-dos(6353) SonicWALL Tele2 and SOHO firewalls with 6.0.0.0 firmware using IPSEC with IKE pre-shared keys do not allow for the use of full 128 byte IKE pre-shared keys, which is the intended design of the IKE pre-shared key, and only support 48 byte keys. This allows a remote attacker to brute force attack the pre-shared keys with significantly less resources than if the full 128 byte IKE pre-shared keys were used. 20010327 SonicWall IKE pre-shared key length bug and security concern sonicwall-ike-shared-keys(6304) Infradig Inframail prior to 3.98a allows a remote attacker to create a denial of service via a malformed POST request which includes a space followed by a large string. 20010328 Inframail Denial of Service Vulnerability inframail-post-dos(6297) readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/024_readline.patch bsd-readline-permissions(6586) Vulnerability in the newgrp program included with HP9000 servers running HP-UX 11.11 allows a local attacker to obtain higher access rights. HPSBUX0103-147 VU#249224 hp-newgrp-additional-privileges(6282) Crosscom/Olicom XLT-F running XL 80 IM Version 5.5 Build Level 2 allows a remote attacker SNMP read and write access via a default, undocumented community string 'ILMI'. 200103 ILMI community in olicom/crosscomm routers oval:org.mitre.oval:def:5718 The OpenPGP PGP standard allows an attacker to determine the private signature key via a cryptanalytic attack in which the attacker alters the encrypted private key file and captures a single message signed with the signature key. CSSA-2001-017.0 20010319 Have they found a serious PGP vulnerability?! 20010320 Yes, they have found a serious PGP vulnerability...sort of 20010322 Re: Yes, they have found a serious PGP vulnerability...sort of RHSA-2001:063 2673 openpgp-private-key-disclosure(6558) Computer Associates CCC\Harvest 5.0 for Windows NT/2000 uses weak encryption for passwords, which allows a remote attacker to gain privileges on the application. 20010327 CA CCC\Harvest exploit banners.php in PHP-Nuke 4.4 and earlier allows remote attackers to modify banner ad URLs by directly calling the Change operation, which does not require authentication. 20010401 Php-nuke exploit... http://phpnuke.org/download.php?dcategory=Fixes 2544 php-nuke-url-redirect(6342) ppd in Reliant Sinix allows local users to corrupt arbitrary files via a symlink attack in the /tmp/ppd.trace file. 20010414 Re: Reliant Unix 5.43 / 5.44 ICMP port unreachable problem 2606 GoAhead webserver 2.1 allows remote attackers to cause a denial of service via an HTTP request to the /aux directory. 20010417 Advisory for GoAhead Webserver v2.1 http://freecode.com/projects/embedthis-goahead-webserver/releases/343539 81099 2607 goahead-aux-dos(6400) AnalogX SimpleServer:WWW 1.08 allows remote attackers to cause a denial of service via an HTTP request to the /aux directory. 20010417 Advisory for SimpleServer:WWW (analogX) 2608 analogx-simpleserver-aux-dos(6395) Format string vulnerability in hfaxd in HylaFAX before 4.1.b2_2 allows local users to gain privileges via the -q command line argument. 20010415 **SECURITY ADVISORY** - HylaFAX format string vulnerability FreeBSD-SA-01:34 SuSE-SA:2001:15 MDKSA-2001:041 20010412 HylaFAX vulnerability 2574 hylafax-hfaxd-format-string(6377) time server daemon timed allows remote attackers to cause a denial of service via malformed packets. FreeBSD-SA-01:28 MDKSA-2001:034 SuSE-SA:2001:07 timed-remote-dos(6228) IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by directly calling the macro.d2w macro with a NOEXISTINGHTMLBLOCK argument. 20010413 [LoWNOISE] IBM Websphere/NetCommerce3 DoS and one more. 2587 IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters. 20010413 [LoWNOISE] IBM Websphere/NetCommerce3 DoS and one more. 2588 Xitami 2.5d4 and earlier allows remote attackers to crash the server via an HTTP request to the /aux directory. 20010417 Advisory for Xitami 2.4d7, 2.5d4 Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port (2407), which causes the server to crash. 20010403 def-2001-17: Navision Financials Server DoS 2539 Navision Financials Server 2.0 allows remote attackers to cause a denial of service via a series of connections to the server without providing a username/password combination, which consumes the license limits. 20010404 Re: def-2001-17: Navision Financials Server DoS Remote manager service in Website Pro 3.0.37 allows remote attackers to cause a denial of service via a series of malformed HTTP requests to the /dyn directory. 20010328 def-2001-15: Website Pro Remote Manager DoS website-pro-remote-dos(6295) Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing. 20010410 Console 3200 telnetd problem. 2578 The pre-login mode in the System Administrator interface of Lightwave ConsoleServer 3200 allows remote attackers to obtain sensitive information such as system status, configuration, and users. 20010410 Console 3200 telnetd problem. 2578 Buffer overflow in Silent Runner Collector (SRC) 1.6.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long SMTP HELO command. 20010329 Silent Runner Collector - HELO buffer overflow vulnerability The BAT! mail client allows remote attackers to bypass user warnings of an executable attachment and execute arbitrary commands via an attachment whose file name contains many spaces, which also causes the BAT! to misrepresent the attachment's type with a different icon. 20010402 ~..~!guano 2530 Caucho Resin 1.3b1 and earlier allows remote attackers to read source code for Javabean files by inserting a .jsp before the WEB-INF specifier in an HTTP request. 20010403 CHINANSL Security Advisory(CSA-200111) 2533 nph-maillist.pl allows remote attackers to execute arbitrary commands via shell metacharacters ("`") in the email address. 20010410 CGI - nph-maillist.pl vulnerability... 2563 Buffer overflow in tip in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable. 20010327 Solaris /usr/bin/tip Vulnerability 2475 solaris-tip-bo(6284) IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port. FreeBSD-SA-01:32 20010408 A fragmentation attack against IP Filter ipfilter-access-ports(6331) /opt/JSparm/bin/perfmon program in Solaris allows local users to create arbitrary files as root via the Logging File option in the GUI. 20010323 [ Hackerslab bug_paper ] SunOS application perfmon vulnerability solaris-perfmon-create-files(6267) Directory traversal vulnerability in JavaServer Web Dev Kit (JSWDK) 1.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request to the WEB-INF directory. 20010328 CHINANSL Security Advisory(CSA-200106) ip_conntrack_ftp in the IPTables firewall for Linux 2.4 allows remote attackers to bypass access restrictions for an FTP server via a PORT command that lists an arbitrary IP address and port number, which is added to the RELATED table and allowed by the firewall. 20010416 Tempest Security Techonologies -- Adivsory #01/2001 -- Linux IPTables MDKSA-2001:071 RHSA-2001:052 RHSA-2001:084 2602 linux-netfilter-iptables(6390) Samba before 2.2.0 allows local attackers to overwrite arbitrary files via a symlink attack using (1) a printer queue query, (2) the more command in smbclient, or (3) the mput command in smbclient. 20010417 Samba 2.0.8 security fix 20010418 TSLSA-#2001-0005 - samba 20010418 PROGENY-SA-2001-05: Samba /tmp vulnerabilities FreeBSD-SA-01:36 CLA-2001:395 CSSA-2001-015.0 DSA-048 VU#670568 MDKSA-2001:040 2617 Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot). 20010318 potential vulnerability of mysqld running with root privileges (can be used as good DoS or r00t expoloit) 20010327 MySQL 3.23.36 is relased (fwd) 2522 mysql-dot-directory-traversal(6617) vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute arbitrary commands when another user opens a file containing malicious VIM control codes. 20010329 Immunix OS Security update for vim CSSA-2001-014.0 MDKSA-2001:035 SuSE-SA:2001:12 RHSA-2001:008 2510 vim-elevate-privileges(6259) vim (aka gvim) allows local users to modify files being edited by other users via a symlink attack on the backup and swap files, when the victim is editing the file in a world writable directory. CSSA-2001-014.0 SuSE-SA:2001:12 vim-tmp-symlink(6628) Buffer overflow in Trend Micro Virus Buster 2001 8.02 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long "From" header. 20010330 Virus Buster 2001(ver8.02) Buffer Overflow Reliant Unix 5.44 and earlier allows remote attackers to cause a denial of service via an ICMP port unreachable packet, which causes Reliant to drop all connections to the source address of the packet. 20010406 Reliant Unix 5.43 / 5.44 ICMP port unreachable problem Cisco Content Services (CSS) switch products 11800 and earlier, aka Arrowpoint, allows local users to gain privileges by entering debug mode. 20010404 Cisco Content Services Switch User Account Vulnerability 2559 cisco-css-elevate-privileges(6322) BinTec X4000 Access router, and possibly other versions, allows remote attackers to cause a denial of service via a SYN port scan, which causes the router to hang. 20010410 BinTec Router DoS: Workaround and Details 20010404 BinTec X4000 Access Router DoS Vulnerability 20010406 X4000 DoS: Details and workaround 20010409 BINTEC X1200 bintec-x4000-nmap-dos(6323) Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument. FreeBSD-SA-01:31 NetBSD-SA2001-004 SSE073 SSE074 20010409 [ESA-20010409-01] xntp buffer overflow 20010413 PROGENY-SA-2001-02A: [UPDATE] ntpd remote buffer overflow 20010418 IBM MSS Outside Advisory Redistribution: IBM AIX: Buffer Overflow Vulnerability in (x)ntp CLA-2001:392 SuSE-SA:2001:10 20010404 ntpd =< 4.0.99k remote buffer overflow 20010405 Re: ntpd =< 4.0.99k remote buffer overflow] 20010406 Immunix OS Security update for ntp and xntp3 20010408 [slackware-security] buffer overflow fix for NTP 20010409 ntp-4.99k23.tar.gz is available 20010409 PROGENY-SA-2001-02: ntpd remote buffer overflow 20010409 ntpd - new Debian 2.2 (potato) version is also vulnerable CSSA-2001-013 MDKSA-2001:036 RHSA-2001:045 2540 ntpd-remote-bo(6321) oval:org.mitre.oval:def:3831 DSA-045 REDIPlus program, REDI.exe, stores passwords and user names in cleartext in the StartLog.txt log file, which allows local users to gain access to other accounts. 20010320 Password stored in clear text vulnerability in real time stock trading program 2495 rediplus-weak-security(6276) sgml-tools (aka sgmltools) before 1.0.9-15 creates temporary files with insecure permissions, which allows other users to read files that are being processed by sgml-tools. CLA-2001:390 20010316 Immunix OS Security update for sgml-tools DSA-038 MDKSA-2001:030 SuSE-SA:2001:16 RHSA-2001:027 2506 2683 sgmltools-symlink(6201) Kerberos 4 (aka krb4) allows local users to overwrite arbitrary files via a symlink attack on new ticket files. 20010307 Security advisory: Unsafe temporary file handling in krb4 RHSA-2001:025 content.pl script in NCM Content Management System allows remote attackers to read arbitrary contents of the content database by inserting SQL characters into the id parameter. 20010413 Exploitable NCM.at - Content Management System 2584 Buffer overflow in shared library ndwfn4.so for iPlanet Web Server (iWS) 4.1, when used as a web listener for Oracle application server 4.0.8.2, allows remote attackers to execute arbitrary commands via a long HTTP request that is passed to the application server, such as /jsp/. 20010410 Oracle Application Server shared library buffer overflow 2569 Directory traversal vulnerability in talkback.cgi program allows remote attackers to read arbitrary files via a .. (dot dot) in the article parameter. 20010409 talkback.cgi vulnerability may allow users to read any file 2547 FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permissions, by providing a valid username with an invalid password followed by a CWD ~ command, which could release sensitive information such as shadowed passwords, or fill the disk partition. 20010417 Re: SUN SOLARIS 5.6/5.7 FTP Globbing Exploit ! 2601 Buffer overflow in Xsun in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable. 20010410 Solaris Xsun buffer overflow vulnerability 2561 solaris-xsun-home-bo(6343) oval:org.mitre.oval:def:555 Buffer overflow in ipcs in Solaris 7 x86 allows local users to execute arbitrary code via a long TZ (timezone) environmental variable, a different vulnerability than CAN-2002-0093. 20010412 Solaris ipcs vulnerability 2581 solaris-ipcs-bo(6369) BubbleMon 1.31 does not properly drop group privileges before executing programs, which allows local users to execute arbitrary commands with the kmem group id. 20010415 BubbleMon 1.31 2609 AdLibrary.pm in AdCycle 0.78b allows remote attackers to gain privileges to AdCycle via a malformed Agent: header in the HTTP request, which is inserted into a resulting SQL query that is used to verify login information. 20010219 Adcycle 0.78b Authentication 2393 Buffer overflow in dtsession on Solaris, and possibly other operating systems, allows local users to gain privileges via a long LANG environmental variable. 20010411 [LSD] Solaris kcsSUNWIOsolf.so and dtsession vulnerabilities Cisco VPN 3000 series concentrators before 2.5.2(F) allow remote attackers to cause a denial of service via a flood of invalid login requests to (1) the SSL service, or (2) the telnet service, which do not properly disconnect the user after several failed login attempts. 20010328 VPN3000 Concentrator TELNET Vulnerability cisco-vpn-telnet-dos(6298) Cisco VPN 3000 series concentrators before 2.5.2(F) allow remote attackers to cause a denial of service via an IP packet with an invalid IP option. 20010412 VPN 3000 Concentrator IP Options Vulnerability 2573 cisco-vpn-ip-dos(6360) Cisco Catalyst 5000 series switches 6.1(2) and earlier will forward an 802.1x frame on a Spanning Tree Protocol (STP) blocked port, which causes a network storm and a denial of service. L-072 20010416 Catalyst 5000 Series 802.1x Vulnerability 2604 cisco-catalyst-8021x-dos(6379) Vulnerability in exuberant-ctags before 3.2.4-0.1 insecurely creates temporary files. exuberant-ctags-symlink(6388) DSA-046 Vulnerability in iPlanet Web Server Enterprise Edition 4.x. http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html Buffer overflows in various CGI programs in the remote administration service for Trend Micro Interscan VirusWall 3.01 allow remote attackers to execute arbitrary commands. 20010413 Trend Micro Interscan VirusWall 3.01 vulnerability 2579 Buffer overflow in Savant 3.0 web server allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long Host HTTP header. 20010405 Savant 3.0 Denial Of Service The LogDataListToFile ActiveX function used in (1) Knowledge Center and (2) Back web components of Compaq Presario computers allows remote attackers to modify arbitrary files and cause a denial of service. SSRT0716 compaq-activex-dos(6355) The split key mechanism used by PGP 7.0 allows a key share holder to obtain access to the entire key by setting the "Cache passphrase while logged on" option and capturing the passphrases of other share holders as they authenticate. 20010410 [wsir-01/02-03] PGP 7.0 Split Key/Cached Passphrase Vulnerability dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program. 20010416 qDefense Advisory: DCForum allows remote read/write/execute http://www.dcscripts.com/FAQ/sec_2001_03_31.html 2611 dcforum-az-expr(6392) upload_file.pl in DCForum 2000 1.0 allows remote attackers to upload arbitrary files without authentication by setting the az parameter to upload_file. 20010416 qDefense Advisory: DCForum allows remote read/write/execute http://www.dcscripts.com/FAQ/sec_2001_03_31.html 2611 dcforum-az-file-upload(6393) Preview version of Timbuktu for Mac OS X allows local users to modify System Preferences without logging in via the About Timbuktu menu. 20010418 Hole in Netopia's Mac OS X Timbuktu licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. FreeBSD-SA-01:35 CLA-2001:389 MDKSA-2001:032 RHSA-2001:022 RHSA-2001:023 licq-url-execute-commands(6261) Buffer overflow in logging functions of licq before 1.0.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands. FreeBSD-SA-01:35 CLA-2001:389 MDKSA-2001:032 RHSA-2001:022 RHSA-2001:023 licq-logging-bo(6645) Buffer overflow in (1) wrapping and (2) unwrapping functions of slrn news reader before 0.9.7.0 allows remote attackers to execute arbitrary commands via a long message header. FreeBSD-SA-01:37 CLA-2001:383 20010316 Immunix OS Security update for slrn DSA-040 MDKSA-2001:028 RHSA-2001:028 2493 slrn-wrapping-bo(6213) Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long APOP command. 20010421 Mercury for NetWare POP3 server vulnerable to remote buffer overflow 20010424 Re: Mercury for NetWare POP3 server vulnerable to remote buffer overflow mercury-mta-bo(6444) 2641 Buffer overflow in QPC QVT/Net Popd 4.20 in QVT/Net 5.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via (1) a long username, or (2) a long password. 20010413 QPC POPd Buffer Overflow Vulnerability Cisco CBOS 2.3.0.053 sends output of the "sh nat" (aka "show nat") command to the terminal of the next user who attempts to connect to the router via telnet, which could allow that user to obtain sensitive information. 20010420 Bug in Cisco CBOS v2.3.0.053 2635 cisco-cbos-gain-information(6453) IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2 allows remote attackers to read source code for .jsp files by appending a / to the requested URL. 20010328 CHINANSL Security Advisory(CSA-200107) Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request containing "%2e" (dot dot) characters. 20010326 602Pro Lansuite Denial Of Service 1.0.34 2514 Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service via an HTTP GET HTTP request to the aux directory, and possibly other directories with legacy DOS device names. 20010326 602Pro Lansuite Denial Of Service 1.0.34 Buffer overflow in WinZip 8.0 allows attackers to execute arbitrary commands via a long file name that is processed by the /zipandemail command line option. 20010302 def-2001-09: Winzip32 zipandemail Buffer Overflow winzip-zipandemail-bo(6191) Directory traversal vulnerability in Transsoft FTP Broker before 5.5 allows attackers to (1) delete arbitrary files via DELETE, or (2) list arbitrary directories via LIST, via a .. (dot dot) in the file name. 20010303 Broker Ftp Server 5.0 Vulnerability http://www.ftp-broker.com/cgibin/Pageexe.exe?H=4143&P=0&C=0 broker-ftp-list-directories(6189) broker-ftp-delete-files(6190) INDEXU 2.0 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the cookie_admin_authenticated cookie value to 1. indexu-gain-access(6202) BRS WebWeaver FTP server before 0.64 Beta allows remote attackers to obtain the real pathname of the server via a "CD *" command followed by an ls command. http://members.nbci.com/_XMCM/BSoutham/WebWeaver/WebWeaverHistory.html 20010428 Vulnerabilities in BRS WebWeaver 2676 Directory traversal vulnerability in BRS WebWeaver HTTP server allows remote attackers to read arbitrary files via a .. (dot dot) attack in the (1) syshelp, (2) sysimages, or (3) scripts directories. 20010428 Vulnerabilities in BRS WebWeaver http://members.nbci.com/_XMCM/BSoutham/WebWeaver/WebWeaverHistory.html 2675 Directory traversal vulnerability in SlimServe HTTPd 1.1a allows remote attackers to read arbitrary files via a ... (modified dot dot) in the HTTP request. 20010303 SlimServe HTTPd ver. 1.1a Directory Traversal slimserve-httpd-directory-traversal(6186) Cisco Aironet 340 Series wireless bridge before 8.55 does not properly disable access to the web interface, which allows remote attackers to modify its configuration. 20010307 Access to the Cisco Aironet 340 Series Wireless Bridge via Web Interface cisco-aironet-web-access(6200) postinst installation script for Proftpd in Debian 2.2 does not properly change the "run as uid/gid root" configuration when the user enables anonymous access, which causes the server to run at a higher privilege than intended. DSA-032 proftpd-postinst-root(6208) man2html before 1.5-22 allows remote attackers to cause a denial of service (memory exhaustion). DSA-035 man2html-remote-dos(6211) Multiple buffer overflows in ePerl before 2.2.14-0.7 allow local and remote attackers to execute arbitrary commands. DSA-034 MDKSA-2001:027 SuSE-SA:2001:08 2464 linux-eperl-bo(6198) Buffer overflows in ascdc Afterstep while running setuid allows local users to gain root privileges via a long (1) -d option, (2) -m option, or (3) -f option. 20010308 ascdc Buffer Overflow Vulnerability ascdc-afterstep-bo(6204) Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service (memory exhaustion) via an extremely large HTTP Referrer: header. 20010308 def-2001-10: Websweeper Infinite HTTP Request DoS websweeper-http-dos(6214) template.cgi in Free On-Line Dictionary of Computing (FOLDOC) allows remote attackers to read files and execute commands via shell metacharacters in the argument to template.cgi. 20010309 Cgisecurity.com advisory #4 The Free On-line Dictionary of Computing http://wombat.doc.ic.ac.uk/foldoc/index.html foldoc-cgi-execute-commands(6217) Directory traversal vulnerability in Perl web server 0.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. 20010424 Advisory for perl webserver 2648 perl-webserver-directory-traversal(6451) Directory traversal vulnerability in cal_make.pl in PerlCal allows remote attackers to read arbitrary files via a .. (dot dot) in the p0 parameter. 20010427 PerlCal (CGI) show files vulnerability http://www.perlcal.com/calendar/docs/bugs.txt 2663 perlcal-calmake-directory-traversal(6480) Buffer overflow in websync.exe in Cyberscheduler allows remote attackers to execute arbitrary commands via a long tzs (timezone) parameter. 20010417 Cyberscheduler remote root compromise 2628 TurboTax saves passwords in a temporary file when a user imports investment tax information from a financial institution, which could allow local users to obtain sensitive information. 20010405 http://www.turbotax.com/atr/update/ turbotax-save-passwords(6622) Directory traversal vulnerability in ustorekeeper 1.61 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. 20010403 new advisory Directory traversal vulnerability in RobTex Viking Web server before 1.07-381 allows remote attackers to read arbitrary files via a \... (modified dot dot) in an HTTP URL request. http://www.robtex.com/files/viking/beta/chglog.txt 20010423 Vulnerability in Viking Web Server 2643 viking-dot-directory-traversal(6450) Buffer overflow in FTPFS allows local users to gain root privileges via a long user name. 20010313 Buffer oveflow in FTPFS (linux kernel module) ftpfs-bo(6234) rwho daemon rwhod in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service via malformed packets with a short length. FreeBSD-SA-01:29 2473 rwhod-remote-dos(6229) Buffer overflow in SNMP proxy agent snmpd in Solaris 8 may allow local users to gain root privileges by calling snmpd with a long program name. 20010313 Solaris 5.8 snmpd Vulnerability 20010315 Re: Solaris 5.8 snmpd Vulnerability snmpd-argv-bo(6239) SSH daemon version 1 (aka SSHD-1 or SSH-1) 1.2.30 and earlier does not log repeated login attempts, which could allow remote attackers to compromise accounts without detection via a brute force attack. 20010205 SSHD-1 Logging Vulnerability 2345 Hursley Software Laboratories Consumer Transaction Framework (HSLCTF) HTTP object allows remote attackers to cause a denial of service (crash) via an extremely long HTTP request. 20010320 def-2001-12: Hursley Software Laboratories Consumer Transaction Framework DoS hslctf-http-dos(6250) Format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary commands. 20010320 Trustix Security Advisory - mutt CLA-2001:385 20010315 Immunix OS Security update for mutt MDKSA-2001-031 RHSA-2001:029 mutt-imap-format-string(6235) Utah-glx in Mesa before 3.3-14 on Mandrake Linux 7.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/glxmemory file. MDKSA-2001:029 mesa-utahglx-symlink(6231) index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute arbitrary PHP code via special characters in the templatecache parameter. 20010315 vBulletin allows arbitrary code execution 2474 http://www.vbulletin.com/forum/showthread.php?s=b20af207b5b908ecf7a4ecf56fbe3cd3&threadid=10839 vbulletin-php-elevate-privileges(6237) Multiple buffer overflows in s.cgi program in Aspseek search engine 1.03 and earlier allow remote attackers to execute arbitrary commands via (1) a long HTTP query string, or (2) a long tmpl parameter. 20010318 Aspseek Buffer Overflow http://www.aspseek.org/changes.html 2492 aspseek-scgi-bo(6248) Vulnerability in WebCalendar 0.9.26 allows remote command execution. 20010423 (SRPRE00004) WebCalendar 0.9.26 2639 Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script. 20010423 (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1 2642 Directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script. 20010423 (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1 http://www.greatbridge.org/project/phppgadmin/cvs/checkout.php/phpPgAdmin/ChangeLog?r=1.13 2640 Directory traversal vulnerability in Alex's FTP Server 0.7 allows remote attackers to read arbitrary files via a ... (modified dot dot) in the (1) GET or (2) CD commands. 20010428 Vulnerabilities in Alex's FTP Server 2668 Vulnerability in rpmdrake in Mandrake Linux 8.0 related to insecure temporary file handling. MDKSA-2001:043 linux-rpmdrake-temp-file(6494) Configuration error in Argus PitBull LX allows root users to bypass specified access control restrictions and cause a denial of service or execute arbitrary commands by modifying kernel variables such as MaxFiles, MaxInodes, and ModProbePath in /proc/sys via calls to sysctl. 20010330 Serious Pitbull LX Vulnerability pitbull-lx-modify-kernel(6623) Configuration error in Axent Raptor Firewall 6.5 allows remote attackers to use the firewall as a proxy to access internal web resources when the http.noproxy Rule is not set. 20010324 Raptor 6.5 http vulnerability 20010327 RE: Raptor 6.5 http vulnerability 2517 Tektronix PhaserLink 850 does not require authentication for access to configuration pages such as _ncl_subjects.shtml and _ncl_items.shtml, which allows remote attackers to modify configuration information and cause a denial of service by accessing the pages. 20010425 Tektronix (Xerox) PhaserLink 850 Webserver Vulnerability (NEW) tektronix-phaserlink-webserver-backdoor(6482) Unknown vulnerability in netprint in IRIX 6.2, and possibly other versions, allows local users with lp privileges attacker to execute arbitrary commands via the -n option. 20010701-01-P 20010426 IRIX /usr/lib/print/netprint local root symbols exploit. 20010427 Re: IRIX /usr/lib/print/netprint local root symbols exploit. 2656 irix-netprint-shared-library(6473) Remote attackers can cause a denial of service in Novell BorderManager 3.6 and earlier by sending TCP SYN flood to port 353. 20010501 Re: Proof of concept DoS against novell border manager enterprise edition 3.5 20010402 (no subject) 20010420 Novell BorderManager 3.5 VPN Denial of Service 20010429 Proof of concept DoS against novell border manager enterprise http://support.novell.com/cgi-bin/search/searchtid.cgi?/2959062.htm 2623 bordermanager-vpn-syn-dos(6429) AIX SNMP server snmpd allows remote attackers to cause a denial of service via a RST during the TCP connection. aix-snmpd-rst-dos(6996) IY17630 pcltotiff in HP-UX 10.x has unnecessary set group id permissions, which allows local users to cause a denial of service. 2646 HPSBUX0104-149 hp-pcltotiff-insecure-permissions(6447) Format string vulnerability in gftp prior to 2.0.8 allows remote malicious FTP servers to execute arbitrary commands. RHSA-2001:053 20010417 gftp exploitable? DSA-057 2657 gftp-format-string(6478) Buffer overflow in WINAMP 2.6x and 2.7x allows attackers to execute arbitrary code via a long string in an AIP file. 20010429 Winamp 2.6x / 2.7x buffer overflow Directory traversal vulnerability in RaidenFTPD Server 2.1 before build 952 allows attackers to access files outside the ftp root via dot dot attacks, such as (1) .... in CWD, (2) .. in NLST, or (3) ... in NLST. 20010425 Vulnerabilities in RaidenFTPD Server raidenftpd-dot-directory-traversal(6455) Netcruiser Web server version 0.1.2.8 and earlier allows remote attackers to determine the physical path of the server via a URL containing (1) con, (2) com2, or (3) com3. 20010424 Advisory for Netcruiser 2650 netcruiser-server-path-disclosure(6468) Small HTTP server 2.03 allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name such as aux. 20010424 Advisory for Small HTTP Server http://home.lanck.net/mf/srv/index.htm 2649 small-http-aux-dos(6446) Buffer overflow in IPSwitch IMail SMTP server 6.06 and possibly prior versions allows remote attackers to execute arbitrary code via a long From: header. 20010424 IPSwitch IMail 6.06 SMTP Remote System Access Vulnerability http://ipswitch.com/Support/IMail/news.html ipswitch-imail-smtp-bo(6445) Directory traversal in DataWizard WebXQ server 1.204 allows remote attackers to view files outside of the web root via a .. (dot dot) attack. 20010426 Vulnerability in WebXQ Server 2660 webxq-dot-directory-traversal(6466) kdesu in kdelibs package creates world readable temporary files containing authentication info, which can allow local users to gain privileges. MDKSA-2001:046 RHSA-2001:059 kdelibs-kdesu-insecure-tmpfile(6856) dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG), which allows attackers to obtain the keys and perform dynamic DNS updates. 20010611 BIND Inadvertent Local Exposure of HMAC-MD5 (TSIG) Keys bind-local-key-exposure(6694) Transparent Network Substrate (TNS) over Net8 (SQLNet) in Oracle 8i 8.1.7 and earlier allows remote attackers to cause a denial of service via a malformed SQLNet connection request with a large offset in the header extension. 20010627 Oracle 8i SQLNet Header Vulnerability Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4) TRC_FILE, (5) SAVE_CONFIG, or (6) RELOAD. CA-2001-16 VU#620495 20010627 Vulnerability in Oracle 8i TNS Listener 2941 oracle-tns-listener-bo(6758) Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red. CA-2001-13 L-098 iis-isapi-idq-bo(6705) 20010618 All versions of Microsoft Internet Information Services, Remote buffer overflow (SYSTEM Level Access) 2880 MS01-033 oval:org.mitre.oval:def:197 Microsoft Word 2002 and earlier allows attackers to automatically execute macros without warning the user by embedding the macros in a manner that escapes detection by the security scanner. 20010622 Fwd: Microsoft Word macro vulnerability advisory MS01-034 2876 MS01-034 msword-macro-bypass-security(6732) Running Windows 2000 LDAP Server over SSL, a function does not properly check the permissions of a user request when the directory principal is a domain user and the data attribute is the domain password, which allows local users to modify the login password of other users. L-101 2929 MS01-036 win2k-ldap-change-passwords(6745) Microsoft NetMeeting 3.01 with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service via a malformed string to the NetMeeting service port, aka a variant of the "NetMeeting Desktop Sharing" vulnerability. netmeeting-desktop-sharing-dos(5368) MS00-077 Vulnerability in authentication process for SMTP service in Microsoft Windows 2000 allows remote attackers to use incorrect credentials to gain privileges and conduct activities such as mail relaying. L-107 VU#435963 2988 MS01-037 win2k-smtp-mail-relay(6803) Multiple memory leaks in Microsoft Services for Unix 2.0 allow remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed requests to (1) the Telnet service, or (2) the NFS service. VU#581603 VU#994851 3089 MS01-039 sfu-nfs-dos(6882) sfu-telnet-dos(6883) Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability. 20010817 NSFOCUS SA2001-06 : Microsoft IIS ssinc.dll Buffer Overflow Vulnerability 20011127 IIS Server Side Include Buffer overflow exploit code L-132 3190 MS01-044 iis-ssi-directive-bo(6984) IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability. 20010816 ENTERCEPT SECURITY ALERT: Privilege Escalation Vulnerability in Microsoft IIS L-132 MS01-044 iis-relative-path-privilege-elevation(6985) oval:org.mitre.oval:def:909 oval:org.mitre.oval:def:912 Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request. 20010506 IIS 5.0 PROPFIND DOS #2 iis-webdav-long-request-dos(6982) 2690 MS01-044 Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs. MS01-041 oval:org.mitre.oval:def:82 Oracle listener process on Windows NT redirects connection requests to another port and creates a separate thread to process the request, which allows remote attackers to cause a denial of service by repeatedly connecting to the Oracle listener but not connecting to the redirected port. VU#105259 20010619 Oracle Redirect Denial of Service oracle-listener-redirect-dos(6717) SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network. 2896 20010620 Multiple Vendor 802.11b Access Point SNMP authentication flaw atmel-vnetb-ap-snmp-security(6576) Oracle Listener in Oracle 7.3 and 8i allows remote attackers to cause a denial of service via a malformed connection packet with a large offset_to_data value. http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf 20010515 Multiple Oracle Listener Denial of Service Vulnerabilities Oracle listener between Oracle 9i and Oracle 8.0 allows remote attackers to cause a denial of service via a malformed connection packet that contains an incorrect requester_version value that does not match an expected offset to the data. http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf 20010515 Multiple Oracle Listener Denial of Service Vulnerabilities Oracle listener in Oracle 8i on Solaris allows remote attackers to cause a denial of service via a malformed connection packet with a maximum transport data size that is set to 0. http://otn.oracle.com/deploy/security/pdf/net8_dos_alert.pdf 20010515 Multiple Oracle Listener Denial of Service Vulnerabilities oracle-listener-data-transport-dos(6715) Oracle listener before Oracle 9i allows attackers to cause a denial of service by repeatedly sending the first portion of a fragmented Oracle command without sending the remainder of the command, which causes the listener to hang. http://otn.oracle.com/deploy/security/alerts.htm 20010515 Multiple Oracle Listener Denial of Service Vulnerabilities oracle-listener-fragmentation-dos(6716) Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags. 20010529 Aladdin eSafe Gateway Filter Bypass - Updated Advisory esafe-gateway-bypass-filtering(6580) Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onload in the BODY tag, (2) href in the A tag, (3) the BUTTON tag, (4) the INPUT tag, or (5) any other tag in which scripts can be defined. 20010529 Aladdin eSafe Gateway Script-filtering Bypass through HTML tags esafe-gateway-bypass-filtering(6580) Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document. 20010529 Aladdin eSafe Gateway Script-filtering Bypass through Unicode Vulnerability esafe-gateway-bypass-filtering(6580) Format string vulnerability in Gnu Privacy Guard (aka GnuPG or gpg) 1.05 and earlier can allow an attacker to gain privileges via format strings in the original filename that is stored in an encrypted file. CLA-2001:399 IMNX-2001-70-023-01 20010601 The GnuPG format string bug (was: TSLSA-2001-0009 - GnuPG) CSSA-2001-020.0 DSA-061 http://www.gnupg.org/whatsnew.html#rn20010529 VU#403051 MDKSA-2001:053 SuSE-SA:2001:020 RHSA-2001:073 2797 TLSA2001028 gnupg-tty-format-string(6642) eEye SecureIIS versions 1.0.3 and earlier allows a remote attacker to bypass filtering of requests made to SecureIIS by escaping HTML characters within the request, which could allow a remote attacker to use restricted variables and perform directory traversal attacks on vulnerable programs that would otherwise be protected. 20010518 ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS 20010519 RE: ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS eeye-secureiis-bypass-detection(6563) eeye-secureiis-directory-traversal(6564) eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, which allows a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS versions 1.0.3 and earlier. 20010518 ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS 20010519 RE: ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS eeye-secureiis-http-header-bo(6574) Buffer overflow in dsh in dqs 3.2.7 in SuSE Linux 7.0 and earlier, and possibly other operating systems, allows local users to gain privileges via a long first command line argument. 20010519 dqs 3.2.7 local root exploit. 20010519 Re: dqs 3.2.7 local root exploit. 2749 dqs-dsh-bo(6577) Buffer overflow in the Xview library as used by mailtool in Solaris 8 and earlier allows a local attacker to gain privileges via the OPENWINHOME environment variable. 20010528 [synnergy] - Solaris mailtool(1) buffer overflow vulnerability solaris-mailtool-openwinhome-bo(6626) DCScripts DCForum versions 2000 and earlier allow a remote attacker to gain additional privileges by inserting pipe symbols (|) and newlines into the last name in the registration form, which will create an extra entry in the registration database. 20010515 DCForum Password File Manipukation Vulnerability (qDefense Advisory Number QDAV-5-2000-2) http://www.dcscripts.com/dcforum/dcfNews/167.html 2728 dcforum-cgi-admin-access(6538) Oracle E-Business Suite Release 11i Applications Desktop Integrator (ADI) version 7.x includes a debug version of FNDPUB11I.DLL, which logs the APPS schema password in cleartext in a debug file, which allows local users to obtain the password and gain privileges. 20010507 Oracle's ADI 7.1.1.10.1 Major security hole 20010522 Vulnerability in Oracle E-Business Suite Release 11i Applications Desktop Integrator 2694 oracle-adi-plaintext-passwords(6501) OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack. NetBSD-SA2001-010 20010604 SSH allows deletion of other users files... 20010604 Re: SSH allows deletion of other users files... CLA-2001:431 IMNX-2001-70-034-01 20010605 OpenSSH_2.5.2p2 RH7.0 <- version info CSSA-2001-023.0 VU#655259 20010612 2825 openssh-symlink-file-deletion(6676) Spearhead NetGAP 200 and 300 before build 78 allow a remote attacker to bypass file blocking and content inspection via specially encoded URLs which include '%' characters. 20010528 Vulnerability discovered in SpearHead NetGap 20010607 SpearHead Security NetGAP 2798 netgap-unicode-bypass-filter(6625) Buffer overflow in libi18n library in IBM AIX 5.1 and 4.3.x allows local users to gain root privileges via a long LANG environmental variable. L-123 MSS-OAR-E01-2001:271.1 aix-libi18n-lang-bo(6863) Multiple buffer overflows in RADIUS daemon radiusd in (1) Merit 3.6b and (2) Lucent 2.1-2 RADIUS allow remote attackers to cause a denial of service or execute arbitrary commands. VU#898931 2989 20010705 Remote Buffer Overflow in Multiple RADIUS Implementations Example applications (Exampleapps) in ColdFusion Server 4.x do not properly restrict prevent access from outside the local host's domain, which allows remote attackers to conduct upload, read, or execute files by spoofing the "HTTP Host" (CGI.Host) variable in (1) the "Web Publish" example script, and (2) the "Email" example script. MPSB01-08 20010807 Remote Vulnerabilities in Macromedia ColdFusion Example Applications HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. CA-2001-14 L-106 20010627 IOS HTTP authorization vulnerability 20010702 Cisco IOS HTTP Configuration Exploit 20010702 ios-http-auth.sh 20010629 Re: Cisco Security Advisory: IOS HTTP authorization vulnerability 20010702 Cisco device HTTP exploit... 2936 cisco-ios-admin-access(6749) Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page. 20010712 MS Office XP - the more money I give to Microsoft, the more vulnerable my Windows computers are L-113 VU#131569 20010712 Vulnerability in IE/Outlook ActiveX control 3025 MS01-038 outlook-activex-view-control(6831) Memory leak in Terminal servers in Windows NT and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed Remote Desktop Protocol (RDP) requests to port 3389. 3099 MS01-040 win-terminal-rdp-dos(6912) Buffer overflow in Microsoft Windows Media Player 7.1 and earlier allows remote attackers to execute arbitrary commands via a malformed Windows Media Station (.NSC) file. 20010527 Microsoft Windows Media Player Buffer Overflow Vulnerability 3105 MS01-042 mediaplayer-nsc-bo(6907) Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879. 20011221 @stake advisory: Multiple overflow and format string vulnerabilities in in Microsoft SQL Server A122001-1 VU#700575 3733 MS01-060 mssql-text-message-bo(7724) oval:org.mitre.oval:def:83 Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts. 3183 MS01-043 win-nntp-dos(6977) oval:org.mitre.oval:def:334 IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type table. L-132 3195 MS01-044 iis-invalid-mime-header-dos(6983) IIS 4.0 with URL redirection enabled allows remote attackers to cause a denial of service (crash) via a malformed request that specifies a length that is different than the actual length. L-132 MS01-044 iis-url-redirection-dos(6981) Memory leak in H.323 Gatekeeper Service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (resource exhaustion) via a large amount of malformed H.323 data. 3196 MS01-045 isa-h323-gatekeeper-dos(6989) Memory leak in the proxy service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows local attackers to cause a denial of service (resource exhaustion). 3197 MS01-045 isa-proxy-memory-leak-dos(6990) Buffer overflow in dtmail in Solaris 2.6 and 7 allows local users to gain privileges via the MAIL environment variable. 20010724 NSFOCUS SA2001-04 : Solaris dtmail Buffer Overflow Vulnerability 3081 solaris-dtmail-bo(6879) Symantec LiveUpdate 1.5 stores proxy passwords in cleartext in a registry key, which could allow local users to obtain the passwords. VU#814187 http://www.sarc.com/avcenter/security/Content/2001_07_20.html liveupdate-obtain-proxy-password(7013) wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob). CLA-2001:442 IMNX-2001-70-036-01 20011128 CORE-20011001: Wu-FTP glob heap corruption vulnerability CSSA-2001-041.0 CA-2001-33 DSA-087 VU#886083 MDKSA-2001:090 SuSE-SA:2001:043 RHSA-2001:157 20010430 some ftpd implementations mishandle CWD ~{ 3581 HPSBUX0107-162 wuftp-glob-heap-corruption(7611) Buffer overflow in CDE Print Viewer (dtprintinfo) allows local users to execute arbitrary code by copying text from the clipboard into the Help window. HPSBUX0105-151 VU#860296 oval:org.mitre.oval:def:5958 ovactiond in HP OpenView Network Node Manager (NNM) 6.1 and Tivoli Netview 5.x and 6.x allows remote attackers to execute arbitrary commands via shell metacharacters in a certain SNMP trap message. 20010608 HP Openview NNM6.1 ovactiond bin exploit CA-2001-24 VU#952171 2845 SSH Secure Shell 3.0.0 on Unix systems does not properly perform password authentication to the sshd2 daemon, which allows local users to gain access to accounts with short password fields, such as locked accounts that use "NP" in the password field. 20010720 URGENT SECURITY ADVISORY FOR SSH SECURE SHELL 3.0.0 L-121 VU#737451 3078 http://www.ssh.com/products/ssh/exploit.cfm ssh-password-length-unauth-access(6868) Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. FreeBSD-SA-01:49 NetBSD-SA2001-012 20010801-01-P CSSA-2001-SCO.10 HPSBUX0110-172 CLA-2001:413 SSRT0745U MSS-OAR-E01-2001:298 20010725 Telnetd AYT overflow scanner 20010725 SCO - Telnetd AYT overflow ? 20010810 ADV/EXP: netkit <=0.17 in.telnetd remote buffer overflow CSSA-2001-030.0 CA-2001-21 L-131 20020129 Cisco CatOS Telnet Buffer Vulnerability DSA-070 DSA-075 MDKSA-2001:068 SuSE-SA:2001:029 RHSA-2001:099 RHSA-2001:100 20010718 multiple vendor telnet daemon vulnerability 3064 telnetd-option-telrcv-bo(6875) ScreamingMedia SITEWare versions 2.5 through 3.1 allows a remote attacker to read world-readable files via a .. (dot dot) attack through (1) the SITEWare Editor's Desktop or (2) the template parameter in SWEditServlet. 20010613 ScreamingMedia SITEWare arbitrary file retrieval vulnerability 20010613 ScreamingMedia SITEWare source code disclosure vulnerability VU#795707 2869 http://www01.screamingmedia.com/en/security/sms1001.php siteware-dot-file-retrieval(6689) The Nirvana Editor (NEdit) 5.1.1 and earlier allows a local attacker to overwrite other users' files via a symlink attack on (1) backup files or (2) temporary files used when nedit prints a file or portions of a file. DSA-053 MDKSA-2001:042 http://www.nedit.org/archives/develop/2001-Feb/0391.html SuSE-SA:2001:14 RHSA-2001:061 20010428 More nedit problems ? (was Re: PROGENY-SA-2001-10...) 2667 T. Hauck Jana Webserver 1.46 and earlier allows a remote attacker to view arbitrary files via a '..' (dot dot) attack which is URL encoded (%2e%2e). 20010507 Advisory for Jana server VU#132099 2703 jana-server-directory-traversal(6513) T. Hauck Jana Webserver 2.01 beta 1 and earlier allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name (i.e. GET /aux HTTP/1.0). 20010507 Advisory for Jana server 2704 jana-server-device-dos(6521) crontab in Vixie cron 3.0.1 and earlier does not properly drop privileges after the failed parsing of a modification operation, which could allow a local attacker to gain additional privileges when an editor is called to correct the error. DSA-054 MDKSA-2001:050 SuSE-SA:2001:17 20010507 Vixie cron vulnerability 2687 vixie-cron-gain-privileges(6508) Buffer overflow in Vixie cron 3.0.1-56 and earlier could allow a local attacker to gain additional privileges via a long username (> 20 characters). 20010210 vixie cron possible local root compromise 20010220 Immunix OS Security update for vixie-cron MDKSA-2001:022 RHSA-2001:014 IY17048 IY17261 vixie-crontab-bo(6098) Directory traversal vulnerability in Drummond Miles A1Stats prior to 1.6 allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in (1) a1disp2.cgi, (2) a1disp3.cgi, or (3) a1disp4.cgi. 20010507 Advisory for A1Stats VU#471691 2705 a1stats-dot-directory-traversal(6503) a1disp.cgi program in Drummond Miles A1Stats prior to 1.6 allows a remote attacker to execute commands via a specially crafted URL which includes shell metacharacters. 20010507 Advisory for A1Stats 2705 a1stats-a1admin-dos(6505) ElectroSystems Engineering Inc. ElectroComm 2.0 and earlier allows a remote attacker to create a denial of service via large (> 160000 character) strings sent to port 23. 20010507 Advisory for Electrocomm 2.0 2706 electrocomm-telnet-dos(6514) APC Web/SNMP Management Card prior to Firmware 310 only supports one telnet connection, which allows a remote attacker to create a denial of service via repeated failed logon attempts which temporarily locks the card. ftp://ftp.apcftp.com/hardware/webcard/firmware/sy/v310/install.txt 20010225 APC web/snmp/telnet management card dos 2430 apc-telnet-dos(6199) Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option. 20010502 Solaris mailx Vulnerability 20010511 Solaris /usr/bin/mailx exploit (SPARC) VU#446864 2610 solaris-mailx-f-bo(8246) Cisco Catalyst 2900XL switch allows a remote attacker to create a denial of service via an empty UDP packet sent to port 161 (SNMP) when SNMP is disabled. 20010503 Cisco Catalyst 2900XL crashes with empty UDP packet when SNMP is disabled. cisco-catalyst-udp-dos(6515) Digital Creations Zope 2.3.2 and earlier allows a local attacker to gain additional privileges via the changing of ZClass permission mappings for objects and methods in the ZClass. CLA-2001:407 DSA-055 MDKSA-2001:049 RHSA-2001:065 http://www.zope.org/Products/Zope/Hotfix_2001-05-01/security_alert zope-zclass-gain-privileges(6958) Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker (Zope user) with through-the-web scripting capabilities to alter ZClasses class attributes. CLA-2001:382 DSA-043 MDKSA-2001:025 RHSA-2001:021 http://www.zope.org/Products/Zope/Products/Zope/Products/Zope/Hotfix_2001-02-23 Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values related to the classes (1) ObjectManager, (2) PropertyManager, and (3) PropertySheet. CLA-2001:382 DSA-043 MDKSA-2001:025 RHSA-2001:021 http://www.zope.org/Products/Zope/Products/Zope/Products/Zope/Hotfix_2001-02-23 minicom 1.83.1 and earlier allows a local attacker to gain additional privileges via numerous format string attacks. 20010517 Immunix OS Security update for minicom CSSA-2001-016.0 RHSA-2001:067 20010503 minicom exploit minicom-xmodem-format-string(6498) Directory traversal vulnerability in the web server for (1) Elron Internet Manager (IM) Message Inspector and (2) Anti-Virus before 3.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the requested URL. 20010406 http://archives.neohapsis.com/archives/bugtraq/2001-03/0345.html 20010323 Elron IM Products Vulnerability 20010326 http://archives.neohapsis.com/archives/bugtraq/2001-03/0345.html 2519 2520 The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands. 20010318 Passive Analysis of SSH (Secure Shell) Traffic CLA-2001:391 VU#596827 MDKSA-2001:033 RHSA-2001:033 lsfs in AIX 4.x allows a local user to gain additional privileges by creating Trojan horse programs named (1) grep or (2) lslv in a certain directory that is under the user's control, which cause lsfs to access the programs in that directory. IY16909 VU#123651 aix-lsfs-path(7007) Directory traversal vulnerability in MP3Mystic prior to 1.04b3 allows a remote attacker to download arbitrary files via a '..' (dot dot) in the URL. 20010507 Advisory for MP3Mystic http://mp3mystic.com/mp3mystic/news.phtml 2699 mp3mystic-dot-directory-traversal(6504) Buffer overflow in lpshut in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a long first argument to lpshut. 20010327 SCO 5.0.6 issues (lpshut) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes sco-openserver-lpshut-bo(6290) lpusers as included with SCO OpenServer 5.0 through 5.0.6 allows a local attacker to gain additional privileges via a buffer overflow attack in the '-u' command line parameter. 20010327 SCO 5.0.6 issues (lpusers) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes sco-openserver-lpusers-bo(6292) recon in SCO OpenServer 5.0 through 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first command line argument. 20010327 SCO 5.0.6 issues (recon) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes sco-openserver-recon-bo(6289) Buffer overflow in lpforms in SCO OpenServer 5.0-5.0.6 can allow a local attacker to gain additional privileges via a long first argument to the lpforms command. 20010327 SCO 5.0.6 issues (lpforms) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes sco-openserver-lpforms-bo(6293) lpadmin in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first argument to the command. 20010327 SCO 5.0.6 issues (lpadmin) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes sco-openserver-lpadmin-bo(6291) Hughes Technologies Virtual DNS (VDNS) Server 1.0 allows a remote attacker to create a denial of service by connecting to port 6070, sending some data, and closing the connection. 200105007 Advisory for Vdns Spytech Spynet Chat Server 6.5 allows a remote attacker to create a denial of service (crash) via a large number of connections to port 6387. 20010507 Advisory for Spynet Chat 2701 spynet-connection-dos(6509) Ben Spink CrushFTP FTP Server 2.1.6 and earlier allows a local attacker to access arbitrary files via a '..' (dot dot) attack, or variations, in (1) GET, (2) CD, (3) NLST, (4) SIZE, (5) RETR. 20010503 Vulnerabilities in CrushFTP Server VU#110803 crushftp-directory-traversal(6495) Alt-N Technologies MDaemon 3.5.4 allows a remote attacker to create a denial of service via the URL request of a MS-DOS device (such as GET /aux) to (1) the Worldclient service at port 3000, or (2) the Webconfig service at port 3001. 20010315 def-2001-11: MDaemon 3.5.4 Dos-Device DoS http://ftp1.deerfield.com/pub/mdaemon/Archive/3.5.6/ mdaemon-webservices-dos(6240) IMAP server in Alt-N Technologies MDaemon 3.5.6 allows a local user to cause a denial of service (hang) via long (1) SELECT or (2) EXAMINE commands. 20010325 MDaemon IMAP Denial Of Service 2508 mdaemon-imap-command-dos(6279) Gordano NTMail 6.0.3c allows a remote attacker to create a denial of service via a long (>= 255 characters) URL request to port 8000 or port 9000. 20010320 def-2001-13: NTMail Web Services DoS 2494 ntmail-long-url-dos(6249) TrendMicro ScanMail for Exchange 3.5 Evaluation allows a local attacker to recover the administrative credentials for ScanMail via a combination of unprotected registry keys and weakly encrypted passwords. 20010330 STAT Security Advisory: Trend Micro's ScanMail for Exchange store s passwords in registry unprotected scanmail-reveals-credentials(6311) deliver program in MMDF 2.43.3b in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to the command. 20010327 SCO 5.0.6 MMDF issues (deliver) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes 2583 sco-openserver-deliver-bo(6302) sendmail 8.9.3, as included with the MMDF 2.43.3b package in SCO OpenServer 5.0.6, can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to the command. 20010327 SCO 5.0.6 MMDF issues (sendmail 8.9.3) 20010412 SSE072B: SCO OpenServer revision of buffer overflow fixes NetScreen ScreenOS prior to 2.5r6 on the NetScreen-10 and Netscreen-100 can allow a local attacker to bypass the DMZ 'denial' policy via specific traffic patterns. 20010326 Netscreen: DMZ Network Receives Some "Denied" Traffic 2523 netscreen-screenos-bypass-firewall(6317) Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). 20010403 Re: Tomcat may reveal script source code by URL trickery HPSBTL0112-004 jakarta-tomcat-jsp-source(6971) Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a '..' (dot dot) attack. 20010212 Patch for Potential Vulnerability in the execution of JSPs outside doc_root 2286 oracle-handlers-directory-traversal(5986) Watchguard Firebox II prior to 4.6 allows a remote attacker to create a denial of service in the kernel via a large stream (>10,000) of malformed ICMP or TCP packets. 20010405 def-2001-18: Watchguard Firebox II Kernel DoS firebox-kernel-dos(6327) Anaconda Partners Clipper 3.3 and earlier allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the template parameter. http://anacondapartners.com/cgi-local/apexec.pl?template=ap_releasenotestemplate.html&f1=ap_af_updates_menu&f2=ap_af_releasenotes_clip 20010327 advisory 2512 anaconda-clipper-directory-traversal(6286) kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument. 20010409 Solaris kcms_configure vulnerability 2558 solaris-kcms-command-bo(6359) oval:org.mitre.oval:def:65 oval:org.mitre.oval:def:7 Buffer overflow in the kcsSUNWIOsolf.so library in Solaris 7 and 8 allows local attackers to execute arbitrary commands via the KCMS_PROFILES environment variable, e.g. as demonstrated using the kcms_configure program. 20010411 [LSD] Solaris kcsSUNWIOsolf.so and dtsession vulnerabilities 2605 solaris-kcssunwiosolf-bo(6365) Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript. CLA-2001:393 IMNX-2001-70-014-01 20010409 Netscape 4.76 gif comment flaw DSA-051 RHSA-2001:046 2637 netscape-javascript-access-data(6344) Zetetic Secure Tool for Recalling Important Passwords (STRIP) 0.5 and earlier for the PalmOS allows a local attacker to recover passwords via a brute force attack. This attack is made feasible by STRIP's use of SysRandom, which is seeded by TimeGetTicks, and an implementation flaw which vastly reduces the password 'search space'. 20010410 Catastrophic failure of Strip password generation. 2567 strip-weak-passwords(6362) Symantec Ghost 6.5 and earlier allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to the Ghost Configuration Server on port 1347, which triggers an error that is not properly handled. 20010411 def-2001-21: Ghost Multiple DoS 2570 ghost-configuration-server-dos(6357) Sybase Adaptive Server Anywhere Database Engine 6.0.3.2747 and earlier as included with Symantec Ghost 6.5 allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to port 2638. 20010411 def-2001-21: Ghost Multiple DoS 2572 ghost-database-engine-dos(6356) Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeated URL requests with the same HTTP headers, such as (1) Accept, (2) Accept-Charset, (3) Accept-Encoding, (4) Accept-Language, and (5) Content-Type. 20010411 def-2001-20: Lotus Domino Multiple DoS lotus-domino-header-dos(6347) Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters. 20010411 def-2001-20: Lotus Domino Multiple DoS lotus-domino-unicode-dos(6349) Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeated (>400) URL requests for DOS devices. 20010411 def-2001-20: Lotus Domino Multiple DoS lotus-domino-device-dos(6348) Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeatedly sending large (> 10Kb) amounts of data to the DIIOP - CORBA service on TCP port 63148. 20010411 def-2001-20: Lotus Domino Multiple DoS lotus-domino-corba-dos(6350) Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via URL requests (>8Kb) containing a large number of '/' characters. 20010411 def-2001-20: Lotus Domino Multiple DoS lotus-domino-url-dos(6351) Headlight Software MyGetright prior to 1.0b allows a remote attacker to upload and/or overwrite arbitrary files via a malicious .dld (skins-data) file which contains long strings of random data. 20010226 My Getright Unsupervised File Download Vulnerability Vulnerability in iPlanet Web Server 4.X in HP-UX 11.04 (VVOS) with VirtualVault A.04.00 allows a remote attacker to create a denial of service via the HTTPS service. HPSBUX0102-139 hp-virtualvault-iws-dos(6110) asecure as included with HP-UX 10.01 through 11.00 can allow a local attacker to create a denial of service and gain additional privileges via unsafe permissions on the asecure program, a different vulnerability than CVE-2000-0083. HPSBUX0103-145 oval:org.mitre.oval:def:5621 HP architected interface facility (AIF) as includes with MPE/iX 5.5 through 6.5 running on a HP3000 allows an attacker to gain additional privileges and gain access to databases via the AIF - AIFCHANGELOGON program. HPSBMP0103-011 VU#895496 hp-aif-gain-privileges(6951) Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog function. 20010411 CFINGERD remote vulnerability 2576 cfingerd-remote-format-string(6364) kfm as included with KDE 1.x can allow a local attacker to gain additional privileges via a symlink attack in the kfm cache directory in /tmp. 20010418 Insecure directory handling in KFM file manager kfm-tmpfile-symlink(6428) Becky! 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters. 20010514 Becky! 2.00.05 Buffer Overflow 2723 becky-mail-message-bo(6531) McAfee Remote Desktop 3.0 and earlier allows remote attackers to cause a denial of service (crash) via a large number of packets to port 5045. 20010516 Remote Desktop DoS 2726 remote-desktop-dos(6547) Omnicron Technologies OmniHTTPD Professional 2.08 and earlier allows a remote attacker to create a denial of service via a long POST URL request. 20010515 OmniHTTPd Pro Denial of Service Vulnerability 2730 omnihttpd-post-dos(6540) Carello E-Commerce 1.2.1 and earlier allows a remote attacker to gain additional privileges and execute arbitrary commands via a specially constructed URL. 20010514 def-2001-25: Carello E-Commerce Arbitrary Command Execution carello-url-code-execution(6532) Directory traversal vulnerability in Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to read arbitrary files via a specially crafted URL which includes variations of a '..' (dot dot) attack such as '...' or '....'. 20010525 Advisory for Freestyle Chat server 2776 freestyle-chat-directory-traversal(6601) Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name (e.g., GET /aux HTTP/1.0). 20010525 Advisory for Freestyle Chat server 2777 freestyle-chat-device-dos(6602) Allied Telesyn AT-AR220e cable/DSL router firmware 1.08a RC14 with the portmapper and the 'Virtual Server' enabled can allow a remote attacker to gain access to mapped services even though the single portmappings may be disabled. 20010514 Cable-Router AR220e Portmapper Security-Flaw telesyn-portmapper-access-services(6560) Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' or SSID as the default Wired Equivalent Privacy (WEP) encryption key. Since the SSID occurs in the clear during communications, a remote attacker could determine the WEP key and decrypt RG-1000 traffic. 20010402 RG-1000 802.11 Residential Gateway default WEP key disclosure flaw orinoco-rg1000-wep-key(6328) The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to. The 'Network Name' or SSID, which is used as a shared secret to join the network, is transmitted in the clear. 20010402 Design Flaw in Lucent/Orinoco 802.11 proprietary access control- closed network iPlanet Calendar Server 5.0p2 and earlier allows a local attacker to gain access to the Netscape Admin Server (NAS) LDAP database and read arbitrary files by obtaining the cleartext administrator username and password from the configuration file, which has insecure permissions. 20010418 iplanet calendar server 5.0p2 exposes Netscape Admin Server master password iplanet-calendar-plaintext-password(6402) The FTP server on Cisco Content Service 11000 series switches (CSS) before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands. L-085 20010517 Cisco Content Service Switch 11000 Series FTP Vulnerability 2745 cisco-css-ftp-commands(6557) The web management service on Cisco Content Service series 11000 switches (CSS) before WebNS 4.01B29s or WebNS 4.10B17s allows a remote attacker to gain additional privileges by directly requesting the web management URL instead of navigating through the interface. 20010531 Cisco Content Service Switch 11000 Series Web Management Vulnerability 2806 cisco-css-web-management(6631) sendfiled, as included with Simple Asynchronous File Transfer (SAFT), on various Linux systems does not properly drop privileges when sending notification emails, which allows local attackers to gain privileges. DSA-050 DSA-052 saft-sendfiled-execute-code(6430) QNX 2.4 allows a local user to read arbitrary files by directly accessing the mount point for the FAT disk partition, e.g. /fs-dos. 20010421 QNX FIle Read Vulnerability qnx-fat-file-read(6437) ftpdownload in Computer Associates InoculateIT 6.0 allows a local attacker to overwrite arbitrary files via a symlink attack on /tmp/ftpdownload.log . 20010525 Security Bug in InoculateIT for Linux (fwd) 2778 inoculateit-ftpdownload-symlink(6607) O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":" character. 20010316 WebServer Pro All Version Vulnerability 2488 website-pro-dir-path(3839) vi as included with SCO OpenServer 5.0 - 5.0.6 allows a local attacker to overwrite arbitrary files via a symlink attack. CSSA-2001-SCO.17 20010522 [SRT2001-09] - vi and crontab -e /tmp issues VU#747736 2752 sco-openserver-vi-symlink(6588) Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, which allows a local attacker to execute arbitrary macros with the user ID of the Word user. Q274228 2760 word-asd-macro-execution(6614) HP Event Correlation Service (ecsd) as included with OpenView Network Node Manager 6.1 allows a remote attacker to gain addition privileges via a buffer overflow attack in the '-restore_config' command line parameter. 20010523 HP OpenView NNM v6.1 buffer overflow 2761 HPSBUX0107-158 openview-nnm-ecsd-bo(6582) Directory traversal vulnerability in MIMAnet viewsrc.cgi 2.0 allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the 'loc' variable. 20010523 Vulnerability in viewsrc.cgi 2762 viewsrc-cgi-view-files(6583) Centrinity First Class Internet Services 5.50 allows for the circumventing of the default 'spam' filters via the presence of '<@>' in the 'From:' field, which allows remote attackers to send spoofed email with the identity of local users. 20010221 FirstClass Internetgateway "stupidity" 20010226 Re: [Fwd: FirstClass Internetgateway "stupidity"] 2423 centrinity-firstclass-email-spoofing(6192) Sun Chili!Soft 3.5.2 on Linux and 3.6 on AIX creates a default admin username and password in the default installation, which can allow a remote attacker to gain additional privileges. 20010220 Advisory: Chili!Soft ASP Multiple Vulnerabilities 20010224 Re: Advisory: Chili!Soft ASP Multiple Vulnerabilities Directory traversal vulnerability in Sun Chili!Soft ASP on multiple Unixes allows a remote attacker to read arbitrary files above the web root via a '..' (dot dot) attack in the sample script 'codebrws.asp'. 20010220 Advisory: Chili!Soft ASP Multiple Vulnerabilities 20010224 Re: Advisory: Chili!Soft ASP Multiple Vulnerabilities Sun Chili!Soft ASP has weak permissions on various configuration files, which allows a local attacker to gain additional privileges and create a denial of service. 20010220 Advisory: Chili!Soft ASP Multiple Vulnerabilities 20010226 Re: Advisory: Chili!Soft ASP Multiple Vulnerabilities 2409 chilisoft-asp-license-dos(6176) Red Hat Linux 7.1 sets insecure permissions on swap files created during installation, which can allow a local attacker to gain additional privileges by reading sensitive information from the swap file, such as passwords. RHSA-2001:058 mount-swap-world-readable(6493) Buffer overflows in Raytheon SilentRunner allow remote attackers to (1) cause a denial of service in the collector (cle.exe) component of SilentRunner 2.0 via traffic containing long passwords, or (2) execute arbitrary commands via long HTTP queries in the Knowledge Browser component in SilentRunner 2.0 and 2.0.1. NOTE: It is highly likely that this candidate will be split into multiple candidates. 20010806 Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner Buffer overflow in man program in various distributions of Linux allows local user to execute arbitrary code as group man via a long -S option. 20010513 RH 7.0:/usr/bin/man exploit: gid man + more SuSE-SA:2001:019 RHSA-2001:069 20010612 man 1.5h10 + man 1.5i-4 exploits 2711 man-s-bo(6530) Directory traversal vulnerability in IncrediMail version 1400185 and earlier allows local users to overwrite files on the local hard drive by appending .. (dot dot) sequences to filenames listed in the content.ini file. 20010511 [eyeonsecurity.net] Incredimail allows automatic over writing offiles on your hard disk incredimail-dot-overwrite-files(6529) Internet Explorer 5.5 does not display the Class ID (CLSID) when it is at the end of the file name, which could allow attackers to trick the user into executing dangerous programs by making it appear that the document is of a safe file type. http://vil.nai.com/vil/virusSummary.asp?virus_k=99048 http://www.guninski.com/clsidext.html http://www.sarc.com/avcenter/venc/data/vbs.postcard@mm.html 20010416 Double clicking on innocent looking files may be dangerous 2612 ie-clsid-execute-files(6426) Maxum Rumpus FTP Server 1.3.3 and 2.0.3 dev 3 stores passwords in plaintext in the "Rumpus User Database" file in the prefs folder, which could allow attackers to gain privileges on the server. 20010515 Rumpus FTP DoS 2718 rumpus-plaintext-passwords(6543) Symantec/AXENT NetProwler 3.5.x contains several default passwords, which could allow remote attackers to (1) access to the management tier via the "admin" password, or (2) connect to a MySQL ODBC from the management tier using a blank password. 20010510 Corsaire Limited Security Advisory - Symantec/Axent NetProwler 3. 5.x password restrictions 20010510 Corsaire Limited Security Advisory - Symantec/Axent NetProwler 3. 5.x database configuration VU#508387 netprowler-default-management-password(6537) netprowler-default-odbc-password(6539) Maxum Rumpus FTP Server 1.3.3 and 2.0.3 dev 3 allows a remote attacker to perform a denial of service (hang) by creating a directory name of a specific length. 20010515 Rumpus FTP DoS 2716 rumpus-long-directory-dos(6542) Orange Web Server 2.1, based on GoAhead, allows a remote attacker to perform a denial of service via an HTTP GET request that does not include the HTTP version. 20010227 Orange Web Server v2.1 DoS 2432 Directory traversal vulnerability in PHProjekt 2.1 and earlier allows a remote attacker to conduct unauthorized activities via a dot dot (..) attack on the file module. 20010508 security hole in os groupware suite PHProjekt 2702 phprojekt-dot-directory-traversal(6522) Personal Web Sharing 1.5.5 allows a remote attacker to cause a denial of service via a long HTTP request. 20010510 Personal Web Sharing remote stop macos-web-sharing-dos(6536) Cisco devices IOS 12.0 and earlier allow a remote attacker to cause a crash, or bad route updates, via malformed BGP updates with unrecognized transitive attribute. L-082 20010510 Cisco IOS BGP Attribute Corruption Vulnerability VU#106392 2733 cisco-ios-bgp-dos(6566) Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable. 20010810 NSFOCUS SA2001-05 : Solaris Xlock Heap Overflow Vulnerability 3160 solaris-xlock-bo(6967) oval:org.mitre.oval:def:10 oval:org.mitre.oval:def:131 Sendmail 8.10.0 through 8.11.5, and 8.12.0 beta, allows local users to modify process memory and possibly gain privileges via a large value in the 'category' part of debugger (-d) command line arguments, which is interpreted as a negative number. NetBSD-SA2001-017 CLA-2001:412 IMNX-2001-70-032-01 20010821 *ALERT* UPDATED BID 3163 (URGENCY 6.58): Sendmail Debugger Arbitrary Code Execution Vulnerability (fwd) RHSA-2001:106 CSSA-2001-032.0 L-133 MDKSA-2001:075 SuSE-SA:2001:028 3163 http://www.sendmail.org/8.11.html HPSBTL0112-007 sendmail-debug-signed-int-overflow(7016) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. Cross-site scripting (CSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause other clients to execute certain script or read cookies via malicious script in an invalid URL that is not properly quoted in an error message. 3198 MS01-045 isa-cross-site-scripting(6991) Buffer overflow in IrDA driver providing infrared data exchange on Windows 2000 allows attackers who are physically close to the machine to cause a denial of service (reboot) via a malformed IrDA packet. 20010821 IrDA semiremote vulnerability 3215 MS01-046 win2k-irda-dos(7008) Outlook Web Access (OWA) in Microsoft Exchange 5.5, SP4 and earlier, allows remote attackers to identify valid user email addresses by directly accessing a back-end function that processes the global address list (GAL). Q307195 3301 MS01-047 exchange-owa-obtain-addresses(7089) RPC endpoint mapper in Windows NT 4.0 allows remote attackers to cause a denial of service (loss of RPC services) via a malformed request. L-142 3313 MS01-048 winnt-rpc-endpoint-dos(7105) Terminal Server in Windows NT and Windows 2000 allows remote attackers to cause a denial of service via a sequence of invalid Remote Desktop Protocol (RDP) packets. 3445 MS01-052 win-rdp-packet-dos(7302) Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing vulnerability." 20011011 Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing http://morph3us.org/blog/?p=31 3420 MS01-051 ie-incorrect-security-zone(7258) Internet Explorer 6 and earlier allows remote attackers to cause certain HTTP requests to be automatically executed and appear to come from the user, which could allow attackers to gain privileges or execute operations within web-based services, aka the "HTTP Request Encoding vulnerability." 3421 MS01-051 ie-url-http-requests(7259) Outlook Web Access (OWA) in Microsoft Exchange 2000 allows an authenticated user to cause a denial of service (CPU consumption) via a malformed OWA request for a deeply nested folder within the user's mailbox. 3368 MS01-049 exchange-owa-folder-request-dos(7168) Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an executable file which is later executed, aka a new variant of the Telnet Invocation vulnerability as described in CVE-2001-0150. M-024 VU#952611 MS01-051 ie-telnet-command-execution-variant(7260) Buffer overflow in line printer daemon (rlpdaemon) in HP-UX 10.01 through 11.11 allows remote attackers to execute arbitrary commands. HPSBUX0108-163 CA-2001-30 L-134 VU#966075 3240 20010827 Remote Buffer Overflow Vulnerability in HP-UX Line Printer Daemon hpux-rlpd-bo(6811) Various Intrusion Detection Systems (IDS) including (1) Cisco Secure Intrusion Detection System, (2) Cisco Catalyst 6000 Intrusion Detection System Module, (3) Dragon Sensor 4.x, (4) Snort before 1.8.1, (5) ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and (6) ISS RealSecure Server Sensor 5.5 and 6.0 for Windows, allow remote attackers to evade detection of HTTP attacks via non-standard "%u" Unicode encoding of ASCII characters in the requested URL. 20010905 %u encoding IDS bypass vulnerability 20010905 Cisco Secure Intrusion Detection System Signature Obfuscation Vulnerability VU#548515 3292 20010905 Multiple Vendor IDS Unicode Bypass Vulnerability Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue. NetBSD-SA2001-018 CSSA-2001-SCO.20 CA-2001-30 VU#274043 20010829 RHSA-2001:147 3252 20010829 Remote Buffer Overflow Vulnerability in BSD Line Printer Daemon bsd-lpd-bo(7046) Buffer overflows in (1) send_status, (2) kill_print, and (3) chk_fhost in lpd in AIX 4.3 and 5.1 allow remote attackers to gain root privileges. CA-2001-30 VU#388183 VU#466239 VU#722143 Directory traversal vulnerability in RobTex Viking Web server before 1.07-381 allows remote attackers to read arbitrary files via a hexadecimal encoded dot-dot attack (eg. http://www.server.com/%2e%2e/%2e%2e) in an HTTP URL request. http://www.robtex.com/viking/bugs.htm 20010417 Advisory for Viking viking-hex-directory-traversal(6394) Rit Research Labs The Bat! 1.51 for Windows allows a remote attacker to cause a denial of service by sending an email to a user's account containing a carriage return <CR> that is not followed by a line feed <LF>. 20010418 SECURITY.NNOV: The Bat! <cr> bug 20010421 Re: SECURITY.NNOV: The Bat! <cr> bug 20010423 Re: SECURITY.NNOV: The Bat! <cr> bug 2636 thebat-pop3-dos(6423) Directory traversal vulnerability in Rit Research Labs The Bat! 1.48f and earlier allows a remote attacker to create arbitrary files via a "dot dot" attack in the filename for an attachment. 20010104 SECURITY.NNOV advisory - The Bat! directory traversal (public release) thebat-attachment-directory-traversal(5871) Eudora 5.0.2 allows a remote attacker to read arbitrary files via an email with the path of the target file in the "Attachment Converted" MIME header, which sends the file when the email is forwarded to the attacker by the user. 20010418 Eudora file leakage problem (still) 2616 eudora-plain-text-attachment(6431) A buffer overflow in reggo.dll file used by Trend Micro InterScan VirusWall prior to 3.51 build 1349 for Windows NT 3.5 and InterScan WebManager 1.2 allows a local attacker to execute arbitrary code. 20010519 TrendMicro Interscan VirusWall RegGo.dll BOf interscan-reggo-bo(6575) A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server. 19991108 Patch for VirusWall 3.23. 19991108 Patch for VirusWall 3.23. 19991109 InterScan VirusWall 3.23/3.3 Buffer Overflow 19991108 Interscan VirusWall NT 3.23/3.3 buffer overflow. viruswall-helo-bo(3465) Directory traversal vulnerability in ftpd in QPC QVT/Net 4.0 and AVT/Term 5.0 allows a remote attacker to traverse directories on the web server via a "dot dot" attack in a LIST (ls) command. 20010925 Vulnerabilities in QVT/Term 20010413 QPC FTPd Directory Traversal and BoF Vulnerabilities 2618 qpc-ftpd-directory-traversal(6375) Buffer overflow in ftpd in QPC QVT/Net 5.0 and QVT/Term 5.0 allows a remote attacker to cause a denial of service via a long (1) username or (2) password. 20010413 QPC FTPd Directory Traversal and BoF Vulnerabilities qpc-ftpd-bo(6376) ZoneAlarm and ZoneAlarm Pro allows a local attacker to cause a denial of service by running a trojan to initialize a ZoneAlarm mutex object which prevents ZoneAlarm from starting. 20001230 [DiamondCS Advisory] ZoneAlarm and ZoneAlarm Pro can be blocked from loading by setting a Mutex in memory zonealarm-mutex-dos(5821) Memory leak in Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service (memory exhaustion) by repeatedly sending approximately 5K of data to TCP port 5238. 20010226 def-2001-08: Netscape Collabra DoS netscape-collabra-kernel-dos(6158) Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service by sending seven or more characters to TCP port 5239. 20010226 def-2001-08: Netscape Collabra DoS netscape-collabra-cpu-dos(6159) Thibault Godouet FCron prior to 1.1.1 allows a local user to corrupt another user's crontab file via a symlink attack on the fcrontab temporary file. http://fcron.free.fr/CHANGES.html 20010228 fcron 0.9.5 is vulnerable to a symlink attack 2835 fcron-tmpfile-symlink(7127) Buffer overflow in mail included with SunOS 5.8 for x86 allows a local user to gain privileges via a long HOME environment variable. 20010604 $HOME buffer overflow in SunOS 5.8 x86 2819 solaris-mail-home-bo(6638) Broker FTP server 5.9.5 for Windows NT and 9x allows a remote attacker to retrieve privileged web server system information by (1) issuing a CD command (CD C:) followed by the LS command, (2) specifying arbitrary paths in the UNC format (\\computername\sharename). 20010610 Broker FTP Server 5.9.5.0 Buffer Overflow / DoS / Directory Traversal 2853 broker-ftp-cd-directory-traversal(6674) Broker FTP Server 5.9.5.0 allows a remote attacker to cause a denial of service by repeatedly issuing an invalid CD or CWD ("CD . .") command. 20010610 Broker FTP Server 5.9.5.0 Buffer Overflow / DoS / Directory Traversal 2851 Vulnerability in TrendMicro Virus Control System 1.8 allows a remote attacker to view configuration files and change the configuration via a certain CGI program. 20010607 [SNS Advisory No.29] Trend Micro Virus Control System(VCS) Format string vulnerability in exim (3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva) in batched SMTP mode allows a remote attacker to execute arbitrary code via format strings in SMTP mail headers. 20010606 lil' exim format bug CLA-2001:402 DSA-058 RHSA-2001:078 2828 exim-syntax-format-string(6671) Buffer overflows in Washington University imapd 2000a through 2000c could allow local users without shell access to execute code as themselves in certain configurations. imap-ipop2d-ipop3d-bo(6269) RHSA-2001:094 MDKSA-2001:054 2856 SMTP proxy in WatchGuard Firebox (2500 and 4500) 4.5 and 4.6 allows a remote attacker to bypass firewall filtering via a base64 MIME encoded email attachment whose boundary name ends in two dashes. 20010628 RE: WatchGuard SMTP Proxy issue 20010608 WatchGuard SMTP Proxy issue 2855 firebox-smtp-bypass-filter(6682) WebTrends HTTP Server 3.1c and 3.5 allows a remote attacker to view script source code via a filename followed by an encoded space (%20). 20010603 Webtrends HTTP Server %20 bug 2812 webtrends-unicode-reveal-source(6639) Directory traversal vulnerability in WFTPD 3.00 R5 allows a remote attacker to view arbitrary files via a dot dot attack in the CD command. 20010525 WFTPD 32-bit (X86) 3.00 R5 Directory Traversal / Buffer Overflow / DoS WFTPD 3.00 R5 allows a remote attacker to cause a denial of service by making repeated requests to cd to the floppy drive (A:\). 20010503 Potential DOS Vulnerability in WFTPD wftpd-cd-dos(6496) NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to cause a denial of service (crash) via a CD command to a directory with an MS-DOS device name such as con. http://netwinsite.com/surgeftp/manual/updates.htm 20010619 SurgeFTP vulnerabilities 2891 surgeftp-concon-dos(6712) NetWin SurgeFTP prior to 1.1h allows a remote attacker to cause a denial of service (crash) via an 'ls ..' command. http://netwinsite.com/surgeftp/manual/updates.htm 20010301 SurgeFTP 1.0b Denial of Service 20010228 SurgeFTP Denial of Service 2442 surgeftp-listing-dos(6168) Directory traversal vulnerability in NetWin SurgeFTP 2.0a and 1.0b allows a remote attacker to list arbitrary files and directories via the 'nlist ...' command. http://www.netwinsite.com/surgeftp/manual/updates.htm 20010619 SurgeFTP vulnerabilities 2892 surgeftp-nlist-directory-traversal(6711) Buffer overflow in cb_reset in the System Service Processor (SSP) package of SunOS 5.8 allows a local user to execute arbitrary code via a long argument. 20010620 Solaris /opt/SUNWssp/bin/cb_reset Vulnerability 2893 sun-cbreset-bo(6726) Buffer overflow in w3m 0.2.1 and earlier allows a remote attacker to execute arbitrary code via a long base64 encoded MIME header. CLA-2001:434 http://mi.med.tohoku.ac.jp/~satodai/w3m-dev-en/200106.month/537.html DSA-064 DSA-081 20010621 [SNS Advisory No.32] w3m malformed MIME header Buffer Overflow Vulnerability 2895 w3m-mime-header-bo(6725) Buffer overflow in ptexec in the Sun Validation Test Suite 4.3 and earlier allows a local user to gain privileges via a long -o argument. 20010621 Solaris /opt/SUNWvts/bin/ptexec Vulnerability 2898 sunvts-ptexec-bo(6736) Cerberus FTP 1.5 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long (1) username, (2) password, or (3) PASV command. 20010704 CesarFTPd, Cerberus FTPd 20010621 Cerberus FTP Server 1.x Remote DoS attack Vulnerability 2901 cerberus-ftp-bo(6728) tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter. 20010621 NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities. 2905 arcadia-tradecli-dos(6739) tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to discover the full path to the working directory via a URL with a template argument for a file that does not exist. 20010621 NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities. 2904 arcadia-tradecli-reveal-path(6738) Directory traversal vulnerability in tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to read arbitrary files on the web server via a URL with "dot dot" sequences in the template argument. 20010621 NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities. 2902 arcadia-tradecli-directory-traversal(6737) Maximum Rumpus FTP Server 2.0.3 dev and before allows an attacker to cause a denial of service (crash) via a mkdir command that specifies a large number of sub-folders. 20010612 Rumpus FTP DoS vol. 2 2864 rumpus-ftp-directory-dos(6699) Denicomp RSHD 2.18 and earlier allows a remote attacker to cause a denial of service (crash) via a long string to port 514. 20010503 Denicomp REXECD/RSHD Denial of Service Vulnerability denicomp-rshd-dos(6523) Denicomp REXECD 1.05 and earlier allows a remote attacker to cause a denial of service (crash) via a long string. 20010503 Denicomp REXECD/RSHD Denial of Service Vulnerability denicomp-rexecd-dos(6524) Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode. 20010622 [VIGILANTE-2001001] ASP source code retrieved with Unicode extens ion 2909 iis-unicode-asp-disclosure(6742) NetBSD 1.5 and earlier and FreeBSD 4.3 and earlier allows a remote attacker to cause a denial of service by sending a large number of IP fragments to the machine, exhausting the mbuf pool. FreeBSD-SA-01:52 NetBSD-SA2001-006 2799 bsd-ip-fragments-dos(6636) Cisco IOS 11.x and 12.0 with ATM support allows attackers to cause a denial of service via the undocumented Interim Local Management Interface (ILMI) SNMP community string. 20010207 Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability cisco-ios-modify-snmp(6169) The rendering engine in Internet Explorer determines the MIME type independently of the type that is specified by the server, which allows remote servers to automatically execute script which is placed in a file whose MIME type does not normally support scripting, such as text (.txt), JPEG (.jpg), etc. 20010727 TXT or HTML? -- IE NEW BUG 20010729 Re: TXT or HTML? -- IE NEW BUG 3116 Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed arguments in the configuration file whose names contain characters with the high bit set, such as (1) macro names that are one character long, (2) a variable setting which is processed by the setoption function, or (3) a Modifiers setting which is processed by the getmodifiers function. 20011001 Multiple Local Sendmail Vulnerabilities sendmail-setregid-gain-privileges(7192) 3377 Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to cause a denial of service (data loss) by (1) setting a high initial message hop count option (-h), which causes Sendmail to drop queue entries, (2) via the -qR option, or (3) via the -qS option. 20011101-01-I 20011001 Multiple Local Sendmail Vulnerabilities Sendmail before 8.12.1, without the RestrictQueueRun option enabled, allows local users to obtain potentially sensitive information about the mail queue by setting debugging flags to enable debug mode. 20011101-01-I 20011001 Multiple Local Sendmail Vulnerabilities Citrix MetaFrame 1.8 Server with Service Pack 3, and XP Server Service Pack 1 and earlier, allows remote attackers to cause a denial of service (crash) via a large number of incomplete connections to the server. 3440 20011016 Citrix MetaFrame Remote Denial of Service Vulnerability metaframe-multiple-sessions-dos(7068) Format string vulnerability in ToolTalk database server rpc.ttdbserverd allows remote attackers to execute arbitrary commands via format string specifiers that are passed to the syslog function. CSSA-2001-SCO.28 SSRT0767U HPSBUX0110-168 1002479 00212 CA-2001-27 M-002 3382 20011002 Multi-Vendor Format String Vulnerability in ToolTalk Service tooltalk-ttdbserverd-format-string(7069) Vulnerability in (1) Microsoft Excel 2002 and earlier and (2) Microsoft PowerPoint 2002 and earlier allows attackers to bypass macro restrictions and execute arbitrary commands by modifying the data stream in the document. 20011005 Symantec Security Response SecBul-10042001, Revision1, Malformed Microsoft Excel or PowerPoint documents bypass Microsoft macro security features CA-2001-28 VU#287067 3402 MS01-050 ms-malformed-document-macro(7223) Buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via a malformed Advanced Streaming Format (ASF) file. 20010807 MS Windows Media Player ASF Marker Buffer Overflow mediaplayer-asf-marker-bo(6962) 3156 MS01-056 oval:org.mitre.oval:def:287 Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary commands by causing a BinHex or MacBinary file type to be downloaded, which causes the files to be executed if automatic decoding is enabled. M-013 3471 MS01-053 ie-mac-downloaded-file-execution(7336) Universal Plug and Play (UPnP) in Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service (memory consumption or crash) via a malformed UPnP request. 20011101 Three Windows XP UPNP DOS attacks 20011109 Important Information Regarding MS01-054 and WindowsME MS01-054 Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript in an about: URL, aka the "First Cookie Handling Vulnerability." 20011108 Microsoft IE cookies readable via about: URLS M-016 20011019 Minor IE vulnerability: about: URLs 3513 MS01-055 ie-about-cookie-information(7486) Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript, aka the "Second Cookie Handling Vulnerability." 3546 MS01-055 Internet Explorer 5.5 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing Vulnerability variant" of CVE-2001-0664. MS01-055 ie-incorrect-security-zone-variant(8471) Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server, when used with Internet Explorer, does not properly detect certain inline script, which can allow remote attackers to perform arbitrary actions on a user's Exchange mailbox via an HTML e-mail message. 3650 MS01-057 exchange-owa-embedded-script-execution(7663) Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability." 20011214 MSIE may download and run progams automatically 20011216 Re: MSIE may download and run progams automatically - NOT SO FAST CA-2001-36 M-027 VU#443699 3578 MS01-058 ie-file-download-execution(7703) oval:org.mitre.oval:def:921 Buffer overflow in Compaq Management Agents before 5.2, included in Compaq Web-enabled Management Software, allows local users to gain privileges. SSRT0758 VU#275979 3376 compaq-wbm-bo(7189) Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters. 1017522 http://www.apacheweek.com/issues/01-09-28#security http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html 22083 split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header. CLA-2001:430 MDKSA-2001:077 http://www.apacheweek.com/issues/01-09-28#security ESA-20011019-01 RHSA-2001:126 RHSA-2001:164 apache-log-file-overwrite(7419) Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string. 20020301-01-P MDKSA-2001:077 http://www.apacheweek.com/issues/01-10-05#security RHSA-2001:126 RHSA-2001:164 20010709 How Google indexed a file with no external link 3009 apache-multiviews-directory-listing(8275) The #sinclude directive in Embedded Perl (ePerl) 2.2.14 and earlier allows a remote attacker to execute arbitrary code by modifying the 'sinclude' file to point to another file that contains a #include directive that references a file that contains the code. 20010621 bugtraq submission 2912 eperl-embedded-code-execution(6743) Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handled by (1) the sigreturn system call or (2) the process_write_regs kernel routine. NetBSD-SA2001-008 2810 bsd-sh3-sigreturn-privileges(6637) Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file. DSA-066 20010711 Another exploit for cfingerd <= 1.4.3-8 20010621 cfingerd local vulnerability (possibly root) 2914 cfingerd-util-bo(6744) Vulnerability in (1) pine before 4.33 and (2) the pico editor, included with pine, allows local users local users to overwrite arbitrary files via a symlink attack. 20010416 Immunix OS Security update for pine 20010527 [ESA-20010509-01] pine temporary file handling vulnerabilities MDKSA-2001:047 RHSA-2001:042 pine-tmp-file-symlink(6367) A long 'synch' delay in Logitech wireless mice and keyboard receivers allows a remote attacker to hijack connections via a man-in-the-middle attack. 20010516 logitech wireless devices: man-in-the-middle attack 20010522 Logitech vulnerability (DoS, man-in-the-middle-attack) - Resend 2738 logitech-wireless-unauthorized-access(6562) LogLine function in klogd in sysklogd 1.3 in various Linux distributions allows an attacker to cause a denial of service (hang) by causing null bytes to be placed in log messages. IMNX-2001-70-026-01 20010614 sysklogd update -- Immunix OS 6.2, 7.0-beta, 7.0 VU#249579 klogd-null-byte-dos(7098) Guardian Digital WebTool in EnGarde Secure Linux 1.0.1 allows restarted services to inherit some environmental variables, which could allow local users to gain root privileges. ESA-20010529-02 RHSA-2001:126 linux-webtool-inherit-privileges(7404) 3COM OfficeConnect 812 and 840 ADSL Router 4.2, running OCR812 router software 1.1.9 and earlier, allows remote attackers to cause a denial of service via a long string containing a large number of "%s" strings, possibly triggering a format string vulnerability. 20010515 3COM OfficeConnect DSL router vulneratibilities 20010921 3Com OfficeConnect 812/840 Router DoS exploit code 20010924 Regarding: 3Com OfficeConnect 812/840 Router DoS exploit code 2721 3com-officeconnect-http-dos(6573) Cisco Hot Standby Routing Protocol (HSRP) allows local attackers to cause a denial of service by spoofing HSRP packets. 20010503 Cisco HSRP Weakness/DoS http://www.cisco.com/networkers/nw00/pres/2402.pdf 2684 cisco-hsrp-dos(6497) Buffer overflow in Computalynx CMail POP3 mail server 2.4.9 allows remote attackers to run arbitrary code via a long HELO command. http://www.securiteam.com/windowsntfocus/5UP0B204AY.html Paging function in O'Reilly WebBoard Pager 4.10 allows remote attackers to cause a denial of service via a message with an escaped ' character followed by JavaScript commands. 20010602 O'Reilly WebBoard 4.10.30 JavaScript code execution problem 2814 Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file. CSSA-2001-025.0 20010531 Imp-2.2.4 temporary files http://www.horde.org/imp/2.2/news.php Netscape 4.7x allows remote attackers to obtain sensitive information such as the user's login, mailbox location and installation path via Javascript that accesses the mailbox: URL in the document.referrer property. 20010605 SECURITY.NNOV: Netscape 4.7x Messanger user information retrival netscape-user-info-retrieval(7417) Buffer overflow in Web Publisher in iPlanet Web Server Enterprise Edition 4.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a request for a long URI with (1) GETPROPERTIES, (2) GETATTRIBUTENAMES, or other methods. 20010515 iPlanet - Netscape Enterprise Web Publisher Buffer Overflow http://iplanet.com/products/iplanet_web_enterprise/iwsalert5.11.html 2732 netscape-enterprise-uri-bo(6554) Buffer overflow in iPlanet Web Server (iWS) Enterprise Edition 4.1, service packs 3 through 7, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long method name in an HTTP request. 20010518 Netscape Enterprise Server 4 Method and URI overflow http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert5.11.html Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several / (slash) characters to the URI. 20020702 Cisco Secure ACS Unix Acme.server Information Disclosure Vulnerability acme-serve-directory-traversal(6634) 20010531 Acme.Server v1.7 of 13nov96 Directory Browsing 2809 Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root. 20010524 IPC@Chip Security 2775 ipcchip-web-root-system(8922) Cisco IOS 12.1(2)T, 12.1(3)T allow remote attackers to cause a denial of service (reload) via a connection to TCP ports 3100-3999, 5100-5999, 7100-7999 and 10100-10999. 20010524 IOS Reload after Scanning Vulnerability 2804 cisco-ios-tcp-dos(6589) Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections. 20010522 More Multiple Vulnerabilities in CBOS tcp-seq-predict(139) Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via an ICMP ECHO REQUEST (ping) with the IP Record Route option set. 20010522 More Multiple Vulnerabilities in CBOS cisco-cbos-record-dos(7298) Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges. 20010522 More Multiple Vulnerabilities in CBOS cisco-cbos-execenable-info-disclosure(44544) Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via a series of large ICMP ECHO REPLY (ping) packets, which cause it to enter ROMMON mode and stop forwarding packets. 20010522 More Multiple Vulnerabilities in CBOS cisco-cbos-multiple-echo(7299) Buffer overflow in ftp daemon (ftpd) 6.2 in Debian GNU/Linux allows attackers to cause a denial of service and possibly execute arbitrary code via a long SITE command. 20010518 Tamersahin.net Security Announcement: Debian 2.2 is 2.2r3 Ftpd Daemon Buffer Owerflow Vulnerability CatalogMgr.pl in VirtualCatalog (incorrectly claimed to be in VirtualCart) allows remote attackers to execute arbitrary code via the template parameter. 20010607 cgisecurity.com Advisory #5 20010611 re: Advisory #5 Corrections. Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) 12.1DC card does not properly disable access when a password has not been set for vtys, which allows remote attackers to obtain access via telnet. L-097 20010614 Cisco 6400 NRP2 Telnet Vulnerability VU#516659 2874 cisco-nrp2-telnet-access(6691) Directory traversal vulnerability in Shambala 4.5 allows remote attackers to escape the FTP root directory via "CWD ..." command. http://www.securiteam.com/windowsntfocus/5SP011P4KC.html Buffer overflow in bctool in Jetico BestCrypt 0.8.1 and earlier allows local users to execute arbitrary code via a file or directory with a long pathname, which is processed during an unmount. 20010614 Buffer overflow in BestCrypt for Linux 2875 Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field. 20010630 Nfuse reveals full path 20010702 Re: Nfuse reveals full path 2956 citrix-nfuse-path-disclosure(6786) Buffer overflow in HttpSave.dll in Trend Micro InterScan WebManager 1.2 allows remote attackers to execute arbitrary code via a long value to a certain parameter. 20010702 [SNS Advisory No.36] TrendMicro InterScan WebManager Version 1.2 HttpSave.dll Buffer Overflow Vulnerability 2959 Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument. 20010602 su-wrapper 1.1.1 Local root exploit. Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, which is not properly handled by the svc_logprint function. 20010608 potential buffer overflow in xinetd-2.1.8.9pre11-1 CLA-2001:404 IMNX-2001-70-024-01 L-104 DSA-063 ESA-20010621-01 RHSA-2001:075 2840 xinetd-identd-bo(6670) Buffer overflow in ntping in scotty 2.1.0 allows local users to execute arbitrary code via a long hostname as a command line argument. 20010609 suid scotty / ntping overflow 20010615 Re: suid scotty (ntping) overflow (fwd) SuSE-SA:2001:023 20010621 suid scotty (ntping) overflow (fwd) 2911 scotty-ntping-bo(6735) BisonFTP V4R1 allows local users to access directories outside of their home directory by uploading .bdl files, which can then be linked to other directories. 20010702 BisonFTP Server V4R1 *.bdl upload Directory Traversal http://www.bisonftp.com/ServRev.htm 2963 bisonftp-bdl-directory-traversal(6782) Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters. 20010610 Mac OS X - Apache & Case Insensitive Filesystems 2852 Directory traversal vulnerability in GuildFTPd 0.9.7 allows attackers to list or read arbitrary files and directories via a .. in (1) LS or (2) GET. 20010526 GuildFTPD v0.97 Directory Traversal / Weak password encryption http://www.nitrolic.com/ 2789 GuildFTPd 0.9.7 stores user names and passwords in plaintext in the default.usr file, which allows local users to gain privileges as other FTP users by reading the file. 20010526 GuildFTPD v0.97 Directory Traversal / Weak password encryption 2792 guildftpd-usr-plaintext-passwords(6611) Memory leak in GuildFTPd Server 0.97 allows remote attackers to cause a denial of service via a request containing a null character. 20010527 def-2001-27: GuildFTPD Buffer Overflow and Memory Leak DoS guildftpd-null-memory-leak(6613) Buffer overflow in GuildFTPd Server 0.97 allows remote attacker to execute arbitrary code via a long SITE command. 20010527 def-2001-27: GuildFTPD Buffer Overflow and Memory Leak DoS http://www.nitrolic.com/help/history.htm guildftpd-site-bo(6612) Spytech SpyAnywhere 1.50 allows remote attackers to gain administrator access via a single character in the "loginpass" field. 20010521 SpyAnywhere Authentication Bypassing Vulnerabilities 2755 spyanywhere-weak-authentication(6578) Buffer overflows and other vulnerabilities in multiple Common Desktop Environment (CDE) modules in HP-UX 10.10 through 11.11 allow attackers to cause a denial of service and possibly gain additional privileges. HPSBUX0105-151 hpux-cde-bo(6585) oval:org.mitre.oval:def:6022 Cayman 3220-H DSL Router 1.0 allows remote attacker to cause a denial of service (crash) via a series of SYN or TCP connect requests. VU#312761 20010709 Cayman-DSL Model 3220-H DOS with nmap 3001 cayman-dsl-portscan-dos(6825) Tripwire 1.3.1, 2.2.1 and 2.3.0 allows local users to overwrite arbitrary files and possible gain privileges via a symbolic link attack on temporary files. VU#349019 MDKSA-2001:064 20010709 Tripwire temporary files 3003 tripwire-tmpfile-symlink(6820) Buffer overflow in xloadimage 4.1 (aka xli 1.16 and 1.17) in Linux allows remote attackers to execute arbitrary code via a FACES format image containing a long (1) Firstname or (2) Lastname field. DSA-069 DSA-695 GLSA-200503-05 xloadimage-faces-bo(6821) SA:2001:024 RHSA-2001:088 20010710 xloadimage remote exploit - tstot.c 3006 Buffer overflow in DynFX MailServer version 2.10 allows remote attackers to conduct a denial of service via a long username to the POP3 service. 20010526 DynFX POPd Denial of Service Vulnerability 2781 dynfx-mailserver-pop3-bo(6615) Omnicron OmniHTTPd 2.0.8 allows remote attackers to cause a denial of service (memory exhaustion) via a series of requests for PHP scripts. 20010526 Remote vulnerabilities in OmniHTTPd 2783 omnihttpd-php-request-dos(6620) OmniHTTPd 2.0.8 and earlier allow remote attackers to obtain source code via a GET request with the URL-encoded symbol for a space (%20). 20010525 Remote vulnerabilities in OmniHTTPd http://www.omnicron.ca/httpd/docs/release.html omnihttpd-reveal-source-code(6621) Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username. 00209 M-008 VU#327281 20010528 solaris 2.6, 7 yppasswd vulnerability 20011004 Patches for Solaris rpc.yppasswdd available 2763 solaris-yppasswd-bo(6629) oval:org.mitre.oval:def:102 oval:org.mitre.oval:def:56 Directory traversal vulnerability in cosmicpro.cgi in Cosmicperl Directory Pro 2.0 allows remote attackers to gain sensitive information via a .. (dot dot) in the SHOW parameter. 20010527 directorypro.cgi , directory traversal 2793 Buffer overflow in SpoonFTP 1.0.0.12 allows remote attackers to execute arbitrary code via a long argument to the commands (1) CWD or (2) LIST. SpoonFTP v1.0.0.13 fixes problem. 20010530 SpoonFTP Buffer Overflow Vulnerabilities spoonftp-cwd-list-bo(6630) KDE ktvision 0.1.1-271 and earlier allows local attackers to gain root privileges via a symlink attack on a user configuration file. 20010622 Symlinks symlinks...this time KTVision ktvision-symlink(6741) Cisco TFTP server 1.1 allows remote attackers to read arbitrary files via a ..(dot dot) attack in the GET command. 20010618 Cisco TFTPD 1.1 Vulerablity 2886 http://www.sentry-labs.com/files/cisco0201061701.txt cisco-tftp-directory-traversal(6722) Directory traversal vulnerability in Icecast 1.3.10 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack using encoded URL characters. 20010626 Advisory DSA-089 RHSA-2001:105 RHSA-2002:063 2932 icecast-dot-directory-traversal(6752) Directory traversal in Webpaging interface in Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows allows remote attackers to read arbitrary files via a .. (dot dot) attack. 20010618 Multiple Vulnerabilities In AMLServer 2883 Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 stores user passwords in plaintext in the pUser.Dat file. 20010618 Multiple Vulnerabilities In AMLServer 2882 LPRng in Red Hat Linux 7.0 and 7.1 does not properly drop memberships in supplemental groups when lowering privileges, which could allow a local user to elevate privileges. L-096 RHSA-2001:077 2865 lprng-supplementary-groups(6703) Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows remote attackers to obtain an absolute path for the server directory by viewing the Location header. 20010618 Multiple Vulnerabilities In AMLServer 2881 Format string vulnerability in avpkeeper in Kaspersky KAV 3.5.135.2 for Sendmail allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed mail message. <a href="http://cwe.mitre.org/data/definitions/134.html" rel="nofollow">CWE-134: Use of Externally-Controlled Format String</a> 20010621 SECURITY.NNOV: KAV (AVP) for sendmail format string vulnerability Specter IDS version 4.5 and 5.0 allows a remote attacker to cause a denial of service (CPU exhaustion) via a port scan, which causes the server to consume CPU while preparing alerts. 20010527 Trend Micro InterScan VirusWall for Windows NT allows remote attackers to make configuration changes by directly calling certain CGI programs, which do not restrict access. 20010531 [SNS Advisory No.28]InterScan VirusWall for NT remote configuration Format string vulnerability in XChat 1.2.x allows remote attackers to execute arbitrary code via a malformed nickname. http://www.securiteam.com/exploits/5AP0Q2A4AQ.html xchat-nickname-format-string(7416) Buffer overflow in A-FTP Anonymous FTP Server allows remote attackers to cause a denial of service via a long USER command. 20010621 A-FTP Anonymous FTP Server Remote DoS attack Vulnerability Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file names. 20010625 Perception LiteServe MS-DOS filename vulnerability 2926 SGI IRIX 6.5 through 6.5.12f and possibly earlier versions, and FreeBSD 3.0, allows remote attackers to cause a denial of service via a malformed IGMP multicast packet with a small response delay. 20011001-01-P http://www.freebsd.org/cgi/query-pr.cgi?pr=8990 3463 irix-igmp-dos(7332) Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin. 20011201-01-I CSSA-2001-SCO.40 20011214 Sun Solaris login bug patches out 00213 CA-2001-34 VU#569272 20011219 Linux distributions and /bin/login overflow 3681 IY26221 20011212 Buffer Overflow in /bin/login telnet-tab-bo(7284) oval:org.mitre.oval:def:2025 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. Buffer overflows in lpsched in IRIX 6.5.13f and earlier allow remote attackers to execute arbitrary commands via a long argument. 20011003-02-P http://www.lsd-pl.net/files/get?IRIX/irx_lpsched2 irix-lpsched-bo(7641) lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters. 20011003-02-P http://www.lsd-pl.net/files/get?IRIX/irx_lpsched2 27566 lpstat in IRIX 6.5.13f and earlier allows local users to gain root privileges by specifying a Trojan Horse nettype shared library. 20011003-02-P http://www.lsd-pl.net/files/get?IRIX/irx_lpstat2 irix-lpstat-net-type-library(7639) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands. 20011107-01-P CSSA-2001-SCO.30 SSRT541 00214 CA-2001-31 CA-2002-01 VU#172583 HPSBUX0111-175 3517 20011112 Multi-Vendor Buffer Overflow Vulnerability in CDE Subprocess Control Service cde-dtspcd-bo(7396) oval:org.mitre.oval:def:70 oval:org.mitre.oval:def:74 Directory traversal vulnerability in story.pl in Interactive Story 1.3 allows a remote attacker to read arbitrary files via a .. (dot dot) attack on the "next" parameter. 20010715 Interactive Story File Disclosure Vulnerability 3028 http://www.valeriemates.com/story_download.html interactive-story-next-directory-traversal(6843) Directory traversal vulnerability in ttawebtop.cgi in Tarantella Enterprise 3.00 and 3.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the pg parameter. 20010619 Re: SCO Tarantella Remote file read via ttawebtop.cgi 20010618 SCO Tarantella Remote file read via ttawebtop.cgi 2890 tarantella-ttawebtop-read-files(6723) Apple MacOS X 10.0 and 10.1 allow a local user to read and write to a user's desktop folder via insecure default permissions for the Desktop when it is created in some languages. 20010626 MacOSX 10.0.X Permissions uncorrectly set 20010704 Re: MacOSX 10.0.X Permissions uncorrectly set - I got it 20011007 OS X 10.1 and localized desktop folder still vulnerable 2930 macos-desktop-insecure-permissions(6750) Internet Explorer 5.0, and possibly other versions, may allow remote attackers (malicious web pages) to read known text files from a client's hard drive via a SCRIPT tag with a SRC value that points to the text file. 20010606 security bug Internet Explorer 5 ie-local-file-disclosure(6688) gnatsweb.pl in GNATS GnatsWeb 2.7 through 3.95 allows remote attackers to execute arbitrary commands via certain characters in the help_file parameter. 20010627 gnats update http://sources.redhat.com/gnats/gnatsweb/advisory-jun-26-2001.html gnatsweb-helpfile-execute-commands(6753) Vulnerability in CIFS/9000 Server (SAMBA) A.01.06 and earlier in HP-UX 11.0 and 11.11, when configured as a print server, allows local users to overwrite arbitrary files by modifying certain resources. HPSBUX0106-155 oval:org.mitre.oval:def:5673 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2001. Notes: none. Buffer overflow in PerlIS.dll in Activestate ActivePerl 5.6.1.629 and earlier allows remote attackers to execute arbitrary code via an HTTP request for a long filename that ends in a .pl extension. http://bugs.activestate.com/show_bug.cgi?id=18062 20011115 NSFOCUS SA2001-07 : ActivePerl PerlIS.dll Remote Buffer Overflow Vulnerability 3526 activeperl-perlis-filename-bo(7539) OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands. 20010918 OpenSSH: sftp & bypassing keypair auth restrictions CLSA-2001:431 IMNX-2001-70-034-01 RHSA-2001:154 openssh-sftp-bypass-restrictions(7634) Vulnerability in HP-UX line printer daemon (rlpdaemon) in HP-UX 10.01 through 11.11 allows remote attackers to modify arbitrary files and gain root privileges via a certain print request. HPSBUX0111-176 CA-2001-32 M-021 VU#638011 3561 20011120 Remote Logic Flaw Vulnerability in HP-UX Line Printer Daemon hpux-rlpdaemon-logic-flaw(7234) A buffer overflow the '\s' console command in MDBMS 0.99b9 and earlier allows remote attackers to execute arbitrary commands by sending the command a large amount of data. 20010612 Remote buffer overflow in MDBMS. 2867 mdbms-query-display-bo(6700) A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute arbitrary code via a large 'To:' field in an email header. FreeBSD-SA-01:43 CLA-2001:403 IMNX-2001-70-025-01 CSSA-2001-022.1 DSA-060 MDKSA-2001:063 ESA-20010620-01 SuSE-SA:2001:026 RHSA-2001:103 2877 fetchmail-long-header-bo(6704) Buffer overflows in GazTek ghttpd 1.4 allows a remote attacker to execute arbitrary code via long arguments that are passed to (1) the Log function in util.c, or (2) serveconnection in protocol.c. 20010617 Buffer Overflow in GazTek HTTP Daemon v1.4 (ghttpd) 20010630 Advisory Ghttp 1.4 2879 2965 gaztek-ghttpd-bo(6702) The default configuration of DCShop 1.002 beta places sensitive files in the cgi-bin directory, which could allow remote attackers to read sensitive data via an HTTP GET request for (1) orders.txt or (2) auth_user_file.txt. 20010618 DCShop vulnerability http://www.dcscripts.com/dcforum/dcshop/44.html 2889 dcshop-cgi-retrieve-information(6707) FPF kernel module 1.0 allows a remote attacker to cause a denial of service via fragmented packets. 20010602 fpf module and packet fragmentation:local/remote DoS. http://www.pkcrew.org/news.php 2816 linux-fpf-kernel-dos(6659) The pmpost program in Performance Co-Pilot (PCP) before 2.2.1-3 allows a local user to gain privileges via a symlink attack on the NOTICES file in the PCP log directory (PCP_LOG_DIR). 20010601-01-A 20010619 Re: pmpost - another nice symlink follower 20010618 pmpost - another nice symlink follower 2887 irix-pcp-pmpost-symlink(6724) Cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 allows remote attackers to execute Javascript by inserting the Javascript into (1) a request for a .JSP file, or (2) a request to the webapp/examples/ directory, which inserts the Javascript into an error page. 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability 2969 Buffer overflow in internal string handling routines of xinetd before 2.1.8.8 allows remote attackers to execute arbitrary commands via a length argument of zero or less, which disables the length check. CLA-2001:406 IMNX-2001-70-029-01 RHSA-2001:092 2971 xinetd-zero-length-bo(6804) Buffer overflows in CesarFTPD 0.98b allows remote attackers to execute arbitrary commands via long arguments to (1) HELP, (2) USER, (3) PASS, (4) PORT, (5) DELE, (6) REST, (7) RMD, or (8) MKD. 20010704 CesarFTPd, Cerberus FTPd 20010630 cesarFTP v0.98b 'HELP' buffer overflow 2972 Cerberus FTP server 1.0 - 1.5 allows remote attackers to cause a denial of service (crash) via a large number of "PASV" requests. 20010704 CesarFTPd, Cerberus FTPd 2976 A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript. 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability http://www.caucho.com/products/resin/changes.xtp VU#981651 2981 java-servlet-crosssite-scripting(6793) A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message. 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme 2982 6tunnel 0.08 and earlier does not properly close sockets that were initiated by a client, which allows remote attackers to cause a denial of service (resource exhaustion) by repeatedly connecting to and disconnecting from the server. ftp://213.146.38.146/pub/wojtekka/6tunnel-0.09.tar.gz 20011023 Remote DoS in 6tunnel 3467 6tunnel-open-socket-dos(7337) Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SET_LABEL, or SQL*Predicate is being used, allows local users to gain additional access. 20011023 FW: ASI Oracle Security Alert: 3 new security alerts http://otn.oracle.com/deploy/security/pdf/OLS817alert.pdf oracle-label-security-access(7344) 3465 Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorrect file permissions in (1) the ORACLE_HOME/rdbms/log directory or (2) an alternate directory as specified in the ORACLE_HOME environmental variable, aka the "Oracle File Overwrite Security Vulnerability." 20011023 FW: ASI Oracle Security Alert: 3 new security alerts http://otn.oracle.com/deploy/security/pdf/oracle_race.pdf Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable, aka the "Oracle Trace Collection Security Vulnerability." 20011023 FW: ASI Oracle Security Alert: 3 new security alerts 20010802 vulnerability in otrcrep binary in Oracle 8.0.5. 20011024 Oracle Trace Collection Security Vulnerability http://otn.oracle.com/deploy/security/pdf/otrcrep.pdf M-011 3139 oracle-binary-symlink(6940) htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file. CLA-2001:429 20011007 Re: Bug found in ht://Dig htsearch CGI http://sourceforge.net/tracker/index.php?func=detail&aid=458013&group_id=4593&atid=104593 CSSA-2001-035.0 DSA-080 MDKSA-2001:083 SuSE-SA:2001:035 RHSA-2001:139 3410 htdig-htsearch-infinite-loop(7262) htdig-htsearch-retrieve-files(7263) Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags by specifying them in (1) search keywords embedded in HTTP referrer information, or (2) host names that are retrieved via a reverse DNS lookup. SuSE-SA:2001:040 20011024 Cross-site Scripting Flaw in webalizer ESA-20011101-01 http://www.mrunix.net/webalizer/news.html RHSA-2001:140 RHSA-2001:141 3473 webalizer-html-tag-host(7350) webalizer-html-tags-keywords(7351) Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request. 20011018 def-2001-30 20011024 Oracle9iAS Web Cache Overflow Vulnerability http://otn.oracle.com/deploy/security/pdf/webcache.pdf CA-2001-29 VU#649979 oracle-appserver-http-bo(7306) DeltaThree Pc-To-Phone 3.0.3 places sensitive data in world-readable locations in the installation directory, which allows local users to read the information in (1) temp.html, (2) the log folder, and (3) the PhoneBook folder. 20011025 Pc-to-Phone vulnerability - broken by design 3475 pc2phone-temp-account-readable(7393) Format string vulnerability in Network Solutions Rwhoisd 1.5.x allows remote attackers to execute arbitrary code via format string specifiers in the -soa command. 20011025 RWhoisd remote format string vulnerability ibillpm.pl in iBill password management system generates weak passwords based on a client's MASTER_ACCOUNT, which allows remote attackers to modify account information in the .htpasswd file via brute force password guessing. 20011025 Weak authentication in iBill's Password Management CGI 3476 ibillpm-cgi-insecure-password(7352) Buffer overflow in Compaq Insight Manager XE 2.1b and earlier allows remote attackers to execute arbitrary code via (1) SNMP and (2) DMI. SSRT0766 compaq-insightmanager-xe-bo(7411) VU#908611 3482 Directory traversal vulnerability in Search.cgi in Ikonboard ib219 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie. 20011030 Ikonboard Cookie filter vulnerability ikonboard-cookie-auth-privileges(7433) 3486 Directory traversal vulnerability in Search.cgi in Leoboard LB5000 LB5000II 1029 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie. 20011030 LB5000 Cookie filter vulnerability leoboard-cookie-auth-privileges(7436) 3484 Squid proxy server 2.4 and earlier allows remote attackers to cause a denial of service (crash) via a mkdir-only FTP PUT request. CLA-2001:426 20010921 squid DoS DSA-077 MDKSA-2001:088 SuSE-SA:2001:037 RHSA-2001:113 3354 squid-mkdir-put-dos(7157) Vulnerability in (1) Book of guests and (2) Post it! allows remote attackers to execute arbitrary code via shell metacharacters in the email parameter. 20011030 cgi vulnerability bookofguests-cgi-command-execution(7434) postit-cgi-command-execution(7435) 3483 3485 Vulnerability in DECwindows Motif Server on OpenVMS VAX or Alpha 6.2 through 7.3, and SEVMS VAX or Alpha 6.2, allows local users to gain access to unauthorized resources. SSRT0738 3492 openvms-dms-unauthorized-access(7425) Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file (webadmin.ntf). 20011030 Lotus Domino Web Administrator Template ReplicaID Access (#NISR29102001A) 3491 lotus-domino-replicaid-access(7424) Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via (1) URL encoding the request, or (2) directly requesting the ReplicaID. 20011031 Lotus Domino Default Navigator Protection By-pass (#NISR29102001B) 3488 lotus-domino-navigator-access(7423) join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon (;) in a form variable. 20011101 Fuse Talk vulnerability fusetalk-joincfm-sql-execution(7445) 3496 viralator CGI script in Viralator 0.9pre1 and earlier allows remote attackers to execute arbitrary code via a URL for a file being downloaded, which is insecurely passed to a call to wget. 20011101 Vulnerability in Viralator proxy extension http://viralator.loddington.com/changes.html 3495 viralator-cgi-command-execution(7440) A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions, which could allow local or remote users to exploit those functions with a buffer overflow. CSSA-2001-037.0 openlinux-libdb-bo(7427) Linux kernel 2.0, 2.2 and 2.4 with syncookies enabled allows remote attackers to bypass firewall rules by brute force guessing the cookie. CLA-2001:432 CSSA-2001-38.0 MDKSA-2001:082 ESA-20011106-01 SuSE-SA:2001:039 RHSA-2001:142 linux-syncookie-bypass-filter(7461) TUX HTTP server 2.1.0-2 in Red Hat Linux allows remote attackers to cause a denial of service via a long Host: header. 20011105 RH Linux Tux HTTPD DoS http://marc.info/?l=tux-list&m=100584714702328&w=2 RHSA-2001:142 3506 tux-http-host-dos(7464) Directory traversal vulnerability in Entrust GetAccess allows remote attackers to read arbitrary files via a .. (dot dot) in the locale parameter to (1) helpwin.gas.bat or (2) AboutBox.gas.bat. 20011105 Entrust Bulletin E01-005: GetAccess Access Service vulnerability 20011105 New getAccess[tm] Vulnerability VU#243243 3508 getaccess-shellscripts-retrieve-files(7474) PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user. 20011105 Copying and Deleting Files Using PHP-Nuke phpnuke-filemanager-gain-privileges(7478) 3510 Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable. 20011109 ClearCase db_loader TERM environment variable buffer overflow vulnerability clearcase-dbloader-term-bo(7488) 3523 Common Cryptographic Architecture (CCA) in IBM 4758 allows an attacker with physical access to the system and Combine_Key_Parts permissions, to steal DES and 3DES keys by using a brute force attack to create a 3DES exporter key. 20011109 Extracting a 3DES key from an IBM 4758 http://www.cl.cam.ac.uk/~rnc1/descrack/ http://www.cl.cam.ac.uk/~rnc1/descrack/attack.html 3524 Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message parameter. CLA-2001:437 20011109 Imp Webmail session hijacking vulnerability 20011110 IMP 2.2.7 (SECURITY) released CSSA-2001-039.0 3525 imp-css-steal-cookies(7496) Buffer overflow in pppattach and other linked PPP utilities in Caldera Open Unix 8.0 and UnixWare 7.1.0 and 7.1.1 allows local users to gain privileges. CSSA-2001-SCO.32 20011113 Security Update: [CSSA-2001-SCO.32] Open UNIX, UnixWare 7: buffer overflow in ppp utilities unixware-openunix-ppp-bo(7570) 2.4.3-12 kernel in Red Hat Linux 7.1 Korean installation program sets the setting default umask for init to 000, which installs files with world-writeable permissions. HPSBTL0112-006 RHSA-2001:148 3527 linux-korean-default-umask(7549) Terminal Services Manager MMC in Windows 2000 and XP trusts the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through a Network Address Translation (NAT). 20011114 Xato Advisory: Win2k/XP Terminal Services IP Spoofing 3541 win-terminal-spoof-address(7538) Cisco 12000 with IOS 12.0 and line cards based on Engine 2 and earlier allows remote attackers to cause a denial of service (CPU consumption) by flooding the router with traffic that generates a large number of ICMP Unreachable replies. M-018 20011114 ICMP Unreachable Vulnerability in Cisco 12000 Series Internet Router 3534 cisco-icmp-unreachable-dos(7536) Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not block non-initial packet fragments, which allows remote attackers to bypass the ACL. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router 3535 cisco-acl-noninital-dos(7550) Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets that are sent to the router, which allows remote attackers to cause a denial of service via a flood of fragments. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router 3539 cisco-acl-outgoing-fragment(7551) Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip any any" rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router 3536 cisco-acl-deny-ip(7553) Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router 3540 cisco-turbo-acl-dos(7552) Cisco 12000 with IOS 12.0 and lines card based on Engine 2 does not properly handle an outbound ACL when an input ACL is not configured on all the interfaces of a multi port line card, which could allow remote attackers to bypass the intended access controls. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router cisco-input-acl-configured(7554) 3537 Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls. M-018 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router 3538 cisco-acl-fragment-bypass(7555) Red Hat Stronghold 2.3 to 3.0 allows remote attackers to retrieve system information via an HTTP GET request to (1) stronghold-info or (2) stronghold-status. 20011123 Redhat Stronghold Secure Server File System Disclosure Vulnerability 3577 apache-strongholdinfo-info-disclosure(51950) apache-strongholdstatus-info-disclosure(51951) stronghold-webserver-obtain-information(7582) Format string vulnerability in the default logging callback function _sasl_syslog in common.c in Cyrus SASL library (cyrus-sasl) may allow remote attackers to execute arbitrary commands. FreeBSD-SA-02:15 CLA-2001:444 MDKSA-2002:018 SuSE-SA:2001:042 CSSA-2001-040.0 RHSA-2001:150 RHSA-2001:151 3498 cyrus-sasl-format-string(7443) HTTP server in Alchemy Eye and Alchemy Network Monitor 1.9x through 2.6.18 is enabled without authentication by default, which allows remote attackers to obtain network monitoring logs with potentially sensitive information by directly requesting the eye.ini file. 20011130 Rapid 7 Advisory R7-0002: Alchemy Eye Remote Unauthenticated Log Viewing 3598 alchemy-http-view-log(7630) Directory traversal vulnerability in HTTP server for Alchemy Eye and Alchemy Network Monitor allows remote attackers to execute arbitrary commands via an HTTP request containing (1) a .. in versions 2.0 through 2.6.18, or (2) a DOS device name followed by a .. in versions 2.6.19 through 3.0.10. 20011129 Rapid 7 Advisory R7-0001: Alchemy Eye HTTP Remote Command Execution VU#220715 3599 alchemy-http-dot-commands(7625) alchemy-http-dot-variant(7626) OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges. CSSA-2001-042.1 CLA-2001:446 MDKSA-2001:092 SuSE-SA:2001:045 20011204 [Fwd: OpenSSH 3.0.2 fixes UseLogin vulnerability] http://marc.info/?l=openssh-unix-dev&m=100747128105913&w=2 M-026 DSA-091 VU#157447 RHSA-2001:161 3614 HPSBUX0112-005 openssh-uselogin-execute-code(7647) uuxqt in Taylor UUCP package does not properly remove dangerous long options, which allows local users to gain privileges by calling uux and specifying an alternate configuration file with the --config option. CLA-2001:425 20011130 Redhat 7.0 local root (via uucp) (attempt 2) RHSA-2001:165 CSSA-2001-033.0 DSA-079 SuSE-SA:2001:38 20010908 Multiple vendor 'Taylor UUCP' problems. 3312 uucp-argument-gain-privileges(7099) Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes information from a frame in the client's domain to a frame in the web site's domain, a variant of the "Frame Domain Verification" vulnerability. M-027 3693 MS01-058 ie-frame-verification-variant2(7702) Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download. 20011126 File extensions spoofable in MSIE download dialog 3597 MS01-058 ie-file-download-ext-spoof(7636) oval:org.mitre.oval:def:1014 Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL. 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities CA-2001-37 M-030 VU#951555 3723 MS01-059 win-upnp-notify-bo(7721) Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to connect to a service on another machine that generates a large amount of traffic (e.g., chargen), or (2) via a spoofed SSDP announcement to broadcast or multicast addresses, which could cause all UPnP clients to send traffic to a single target system. 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities CA-2001-37 M-030 VU#411059 20020109 UPNP Denial of Service 3724 MS01-059 win-upnp-udp-dos(7722) Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service. 20011221 @stake advisory: Multiple overflow and format string vulnerabilities in in Microsoft SQL Server A122001-1 3732 MS01-060 mssql-c-runtime-format-string(7725) oval:org.mitre.oval:def:253 Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a malicious link that is accessed by other web users. RHSA-2001:168 RHSA-2001:169 RHSA-2001:170 CLA-2001:445 20011128 Cgisecurity.com Advisory #7: Mailman Email Archive Cross Site Scripting 3602 mailman-java-css(7617) Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that ends in a brace "{" character. CLA-2002:447 IMNX-2001-70-037-01 http://sources.redhat.com/ml/bug-glibc/2001-11/msg00109.html M-029 DSA-103 MDKSA-2001:095 ESA-20011217-01 RHSA-2001:160 20011217 [Global InterSec 2001121001] glibc globbing issues. 3707 HPSBTL0112-008 glibc-glob-bo(7705) xSANE 0.81 and earlier allows local users to modify files of other xSANE users via a symlink attack on temporary files. RHSA-2001:171 RHSA-2001:172 FreeBSD-SA-01:68 3700 xsane-temp-symlink(7714) Atmel Firmware 1.3 Wireless Access Point (WAP) allows remote attackers to cause a denial of service via a SNMP request with (1) a community string other than "public" or (2) an unknown OID, which causes the WAP to deny subsequent SNMP requests. 20011221 VIGILANTe advisory 2001003 : Atmel SNMP Non Public Community String DoS Vulnerability 3734 atmel-snmp-community-dos(7734) Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters. 20011219 [ph10@cus.cam.ac.uk: [Exim] Potential security problem] DSA-097 VU#283723 RHSA-2001:176 3728 exim-pipe-hostname-commands(7738) Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink attack on temporary files. RHSA-2001:171 xsane-temp-symlink(7714) 3987 Format string vulnerability in NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX allows a local user to gain root privileges by using qsub to submit a batch job whose name contains formatting characters. 20020101-01-I 20011127 UNICOS LOCAL HOLE ALL VERSIONS 3590 unicos-nqsd-format-string(7618) Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /. 20011113 Cgisecurity.com Advisory #6: thttpd and mini_http Permission bypass vuln http://www.acme.com/software/thttpd/ Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /. 20011113 Cgisecurity.com Advisory #6: thttpd and mini_http Permission bypass vuln http://www.acme.com/software/mini_httpd/ httpd-bypass-permissions(7541) Vulnerability in Postfix SMTP server before 20010228-pl07, when configured to email the postmaster when SMTP errors cause the session to terminate, allows remote attackers to cause a denial of service (memory exhaustion) by generating a large number of SMTP errors, which forces the SMTP session log to grow too large. CLA-2001:439 MDKSA-2001:089 20011115 Postfix session log memory exhaustion bugfix DSA-093 RHSA-2001:156 3544 postfix-smtp-log-dos(7568) Multiple Cisco networking products allow remote attackers to cause a denial of service on the local network via a series of ARP packets sent to the router's interface that contains a different MAC address for the router, which eventually causes the router to overwrite the MAC address in its ARP table. 20011115 Cisco IOS ARP Table Overwrite Vulnerability VU#399355 3547 cisco-arp-overwrite-table(7547) Inetd in OpenServer 5.0.5 allows remote attackers to cause a denial of service (crash) via a port scan, e.g. with nmap -PO. CSSA-2001-SCO.33 20020201 RE: DoS bug on Tru64 20020205 nmap vs. inetd on Caldera (ex-SCO) OpenServer, Re: DoS bug on Tru64 openserver-nmap-po-option(7571) Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) before 5.47e allows remote attackers to steal user cookies via an [IMG] tag that references an about: URL with an onerror field. 20011115 UBB vulnerablietis + about: using example 20011115 Re: UBB vulnerablietis + about: using example Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses setTimeout to (1) access data after a new window to the domain has been opened or (2) access data via about:cache. 20011115 Several javascript vulnerabilities in Opera 20011116 Re: Several javascript vulnerabilities in Opera opera-java-cross-site(7567) 3553 Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable. 20011116 Network Tool 0.2 Addon for PHPNuke vulnerable to remote command execution http://phpnukerz.org/modules.php?name=Downloads&d_op=viewsdownload&sid=32 phpnuke-nettools-command-execution(7578) Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the include parameter. 20011118 Gallery Addon for PhpNuke remote file viewing vulnerability 3554 phpnuke-gallery-directory-traversal(7580) Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment. 20011119 Hypermail SSI Vulnerability http://www.hypermail.org/dist/hypermail-2.1.4.tar.gz hypermail-ssi-execute-commands(7576) Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters. 20011120 IIS logging issue 20011120 IIS logging issue 6795 iis-fake-log-entry(7613) Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication. 20011120 A Cryptanalysis of the High-bandwidth Digital Content Protection System hdcp-authentication-keys(7612) 3558 Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP_USER_AGENT (UserAgent) information that indicates that the patch has been installed, which could allow remote malicious web sites to more easily identify and exploit vulnerable clients. 20011120 MSIE 5.5/6 Q312461 patch disclose patch information ie-q312461-patch-existence(7581) 3556 Race condition in signal handling of procmail 3.20 and earlier, when running setuid, allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running. FreeBSD-SA-01:60 CLA-2001:433 DSA-083 MDKSA-2001:085 RHSA-2001:093 3071 procmail-signal-handling-race(6872) teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr. IMNX-2001-70-030-01 MDKSA-2001:086 RHSA-2001:102 20010622 LPRng + tetex tmpfile race - uid lp exploit 2974 tetex-lprng-tmp-race(6785) Linux kernel 2.2.1 through 2.2.19, and 2.4.1 through 2.4.10, allows local users to cause a denial of service via a series of deeply nested symlinks, which causes the kernel to spend extra time when trying to access the link. CSSA-2001-036.0 IMNX-2001-70-035-01 MDKSA-2001:079 20011018 Flaws in recent Linux kernels 20011019 TSLSA-2001-0028 linux-multiple-symlink-dos(7312) MDKSA-2001:082 ESA-20011019-02 SuSE-SA:2001:036 3444 CITRIX Metaframe 1.8 logs the Client Address (IP address) that is provided by the client instead of obtaining it from the packet headers, which allows clients to spoof their public IP address, e.g. through Network Address Translation (NAT). 20011121 CITRIX & Microsoft Windows Terminal Services False IP Address Vulnerability 3566 win-terminal-spoof-address(7538) Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL. 20011121 Buffer overflow in Windows XP "helpctr.exe" 6802 winxp-helpctr-bo(7605) Legato Networker before 6.1 allows remote attackers to bypass access restrictions and gain privileges on the Networker interface by spoofing the admin server name and IP address and connecting to Networker from an IP address whose hostname can not be determined by a DNS reverse lookup. 20011121 Legato Networker vulnerability 3564 networker-reverse-dns-bypass-auth(7601) PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it. 20011121 PhpNuke Admin password can be stolen ! 3567 phpnuke-postnuke-insecure-passwords(7596) Packaging error for expect 8.3.3 in Mandrake Linux 8.1 causes expect to search for its libraries in the /home/snailtalk directory before other directories, which could allow a local user to gain root privileges. MDKSA-2001:087 linux-expect-unauth-root(7604) Format string vulnerability in Network Solutions Rwhoisd 1.5.7.2 and earlier, when using syslog, allows remote attackers to corrupt memory and possibly execute arbitrary code via a rwhois request that contains format specifiers. http://lists.research.netsol.com/pipermail/rwhois-announce/2001-November/000023.html 20011122 [NetGuard Security] NSI Rwhoisd another Remote Format String Vulnerability Linux kernel before 2.4.11pre3 in multiple Linux distributions allows local users to cause a denial of service (crash) by starting the core vmlinux kernel, possibly related to poor error checking during ELF loading. 20011121 SuSE 7.3 : Kernel 2.4.10-4GB Bug 20011122 Re: SuSE 7.3 : Kernel 2.4.10-4GB Bug 3570 linux-vmlinux-dos(7591) Format string vulnerability in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via format specifiers in the check argument of a shell definition. 20011121 Advisory: Berkeley pmake pmake-shell-format-string(7602) 3572 Buffer overflow in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via a long check argument of a shell definition. 20011121 Advisory: Berkeley pmake pmake-shell-bo(7603) 3573 Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. 20011122 Hi http://marc.info/?l=tomcat-dev&m=100658457507305&w=2 tomcat-reveal-install-path(7599) [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ Vulnerabilities in CGI scripts in susehelp in SuSE 7.2 and 7.3 allow remote attackers to execute arbitrary commands by not opening files securely. SuSE-SA:2001:041 3576 susehelp-cgi-command-execution(7583) Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt to allow cookies to be stored on your machine" enabled does not warn a user when a cookie is set using Javascript. 20011126 Javascript can bypass user preference for cookie prompt in IE5.50.4134.0100 Format string vulnerability in auto nice daemon (AND) 1.0.4 and earlier allows a local user to possibly execute arbitrary code via a process name containing a format string. http://and.sourceforge.net/ 20011126 [CERT-intexxia] Auto Nice Daemon Format String Vulnerability 3580 and-format-string(7606) Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the password has been typed, which is printed in cleartext. 20011121 Mac Netscape password fields 3565 macos-netscape-print-passwords(7593) ndcgi.exe in Netdynamics 4.x through 5.x, and possibly earlier versions, allows remote attackers to steal session IDs and hijack user sessions by reading the SPIDERSESSION and uniqueValue variables from the login field, then using those variables after the next user logs in. 20011126 NMRC Advisory - NetDynamics Session ID is Reusable 3583 netdynamics-session-hijacking(7620) RPM Package Manager 4.0.x through 4.0.2.x allows an attacker to execute arbitrary code via corrupted data in the RPM file when the file is queried. CLA-2001:440 20011025 Advisory: Corrupt RPM Query Vulnerability 3472 Linux-rpm-execute-code(7349) Directory traversal vulnerability in ifx CGI program in Informix Web DataBlade allows remote attackers to read arbitrary files via a .. (dot dot) in the LO parameter. 20011122 double dot vulnerability on a site running Informix database. 20011127 Re: double dot vulnerability on a site running Informix database. 3575 informix-web-datablade-directory-traversal(7585) The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex. http://www.apacheweek.com/features/security-13 DSA-067 MDKSA-2001:077 ESA-20010620-02 20010312 FORW: [ANNOUNCE] Apache 1.3.19 Released 20010419 OpenBSD 2.8patched Apache vuln! 20010624 Fw: Bugtraq ID 2503 : Apache Artificially Long Slash Path Directory Listing Exploit 2503 20010726 Apache Artificially Long Slash Path Directory Listing Vulnerabili ty -- FILE READ ACCESS apache-slash-directory-listing(6921) SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages (.jsp) and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an #include statement. 20011128 JRun SSI Request Body Parsing http://www.macromedia.com/v1/handlers/index.cfm?ID=22261&Method=Full 3589 allaire-jrun-view-source(7622) Format string vulnerability in the permitted function of GNOME libgtop_daemon in libgtop 1.0.12 and earlier allows remote attackers to execute arbitrary code via an argument that contains format specifiers that are passed into the (1) syslog_message and (2) syslog_io_message functions. 20011127 [CERT-intexxia] libgtop_daemon Remote Format String Vulnerability DSA-098 Buffer overflow in the permitted function of GNOME gtop daemon (libgtop_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to execute arbitrary code via long authentication data. 20011128 Re: [CERT-intexxia] libgtop_daemon Remote Format String Vulnerability DSA-098 DSA-301 VU#705771 3594 Cisco IOS Firewall Feature set, aka Context Based Access Control (CBAC) or Cisco Secure Integrated Software, for IOS 11.2P through 12.2T does not properly check the IP protocol type, which could allow remote attackers to bypass access control lists. 20011128 A Vulnerability in IOS Firewall Feature Set VU#362483 3588 ios-cbac-bypass-acl(7614) Sendpage.pl allows remote attackers to execute arbitrary commands via a message containing shell metacharacters. 20011128 Sendpage (Perl CGI) Remote Execution Vulnerability sendpage-message-command-execution(7609) Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a .. (dot dot) in (1) LS or (2) GET. 20011128 PowerFTP-server-Bugs&Exploits-Remotes 3593 powerftp-dot-directory-traversal(7615) Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long command. 20011128 PowerFTP-server-Bugs&Exploits-Remotes 3595 powerftp-long-command-dos(7616) Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls (LIST) command that includes the drive letter as an argument, e.g. "ls C:". 20011128 PowerFTP-server-Bugs&Exploits-Remotes Cooolsoft PowerFTP Server 2.03 allows remote attackers to obtain the physical path of the server root via the pwd command, which lists the full pathname. 20011128 PowerFTP-server-Bugs&Exploits-Remotes Vulnerability in wu-ftpd 2.6.0, and possibly earlier versions, which is unrelated to the ftpglob bug described in CVE-2001-0550. SuSE-SA:2001:043 Buffer overflow in Frox transparent FTP proxy 0.6.6 and earlier, with the local caching method selected, allows remote FTP servers to run arbitrary code via a long response to an MDTM request. http://frox.sourceforge.net/security.txt 20011130 Alert: Vulnerability in frox transparent ftp proxy. 3606 frox-ftp-proxy-bo(7632) PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid parameters. 20011130 Vulnerabilities in PGPMail.pl 20011129 PGPMail.pl possible remote command execution Directory traversal vulnerability in AspUpload 2.1, in certain configurations, allows remote attackers to upload and read arbitrary files, and list arbitrary directories, via a .. (dot dot) in the Filename parameter in (1) UploadScript11.asp or (2) DirectoryListing.asp. 20011130 Aspupload installs exploitable scripts aspupload-upload-directory-traversal(7628) aspupload-directory-browsing-download(7629) 3608 Lotus Domino 5.08 and earlier allows remote attackers to cause a denial of service (crash) via a SunRPC NULL command to port 443. 20011130 Denial of Service in Lotus Domino 5.08 and earlier HTTP Server 3607 http://www-1.ibm.com/support/manager.wss?rs=0&rt=0&org=sims&doc=4C8E450DBF2E7F1885256B200079FA88 lotus-domino-nhttp-dos(7631) Buffer overflow in the GUI authentication code of Check Point VPN-1/FireWall-1 Management Server 4.0 and 4.1 allows remote attackers to execute arbitrary code via a long user name. 20010921 Check Point FireWall-1 GUI Buffer Overflow 20011130 Fw: Firewall-1 remote SYSTEM shell buffer overflow 20010919 Check Point FireWall-1 GUI Log Viewer vulnerability (vuldb 3336) 20011128 Firewall-1 remote SYSTEM shell buffer overflow 20010919 GUI Buffer Overflow 3336 fw1-log-viewer-bo(7145) Buffer overflow in dbsnmp in Oracle 8.0.6 through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable. 20011130 ASI Oracle Security Alert: Oracle Home Environment Variable Buffer Overflow http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf 3138 oracle-dbsnmp-home-bo(7643) dbsnmp in Oracle 8.1.6 and 8.1.7 uses the ORACLE_HOME environment variable to find and execute the dbsnmp program, which allows local users to execute arbitrary programs by pointing the ORACLE_HOME to an alternate directory that contains a malicious version of dbsnmp. http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf 20011130 ASI Oracle Security Alert: Oracle Home Environment Variable Validation Vulnerability 3137 oracle-dbsnmp-home-validation(7645) dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs. http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf 20011130 ASI Oracle Security Alert: CHOWN Path Environment Variable Vulnerability 20010801 Oracle 8.1.5 dbnsmp vulnerability 3129 DDE in mIRC allows local users to launch applications under another user's account via a DDE message that executes a command, which may be executed by the other user's process. 20011202 mIRC bug? Buffer overflow in Outlook Express 5.0 through 5.02 for Macintosh allows remote attackers to cause a denial of service via an e-mail message that contains a long line. 20011203 Buffer over flow on Outlook express for Macintosh macos-outlook-long-message-bo(7648) 3611 apmscript in Apmd in Red Hat 7.2 "Enigma" allows local users to create or change the modification dates of arbitrary files via a symlink attack on the LOW_POWER temporary file, which could be used to cause a denial of service, e.g. by creating /etc/nologin and disabling logins. 20011204 Symlink attack with apmd of RH 7.2 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=56389 apmd-apmscript-symlink(8268) Forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) 3.3 through 4.2.1 allows remote attackers to determine the real pathname of the server by requesting an invalid extension, which produces an error page that includes the path. 20011204 NMRC Advisory - Multiple Valicert Problems 3615 http://www.valicert.com/support/security_advisory_eva.html eva-forms-reveal-path(7649) Cross-site scripting (CSS) vulnerability in ValiCert Enterprise Validation Authority (EVA) 3.3 through 4.2.1 allows remote attackers to execute arbitrary code or display false information by including HTML or script in the certificate's description, which is executed when the certificate is viewed. 20011204 NMRC Advisory - Multiple Valicert Problems 3619 http://www.valicert.com/support/security_advisory_eva.html eva-admin-script-injection(7650) Buffer overflows in forms.exe CGI program in ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 allows remote attackers to execute arbitrary code via long arguments to the parameters (1) Mode, (2) Certificate_File, (3) useExpiredCRLs, (4) listenLength, (5) maxThread, (6) maxConnPerSite, (7) maxMsgLen, (8) exitTime, (9) blockTime, (10) nextUpdatePeriod, (11) buildLocal, (12) maxOCSPValidityPeriod, (13) extension, and (14) a particular combination of parameters associated with private key generation that form a string of a certain length. 20011204 NMRC Advisory - Multiple Valicert Problems 3621 3622 3624 3625 3627 3628 3629 3630 3631 3632 3633 3634 3635 3636 http://www.valicert.com/support/security_advisory_eva.html eva-forms-bo(7652) ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing. 20011204 NMRC Advisory - Multiple Valicert Problems 3618 3620 http://www.valicert.com/support/security_advisory_eva.html eva-insecure-key-storage(7651) eva-insecure-key-generation(7653) Windows 2000 allows remote attackers to cause a denial of service (CPU consumption) by flooding Internet Key Exchange (IKE) UDP port 500 with packets that contain a large number of dot characters. 20011207 UDP DoS attack in Win2k via IKE 20011211 UDP DoS attack in Win2k via IKE 3652 win2k-ike-dos(7667) THQ Volition Red Faction Game allows remote attackers to cause a denial of service (hang) of a client or server via packets to UDP port 7755. 20011207 Red Faction Server/Client DOS 3651 red-faction-udp-dos(7672) Kebi WebMail allows remote attackers to access the administrator menu and gain privileges via the /a/ hidden directory, which is installed under the web document root. 20011208 kebi-Webmail Solution vulnerability (Tested) 3655 kebi-webmail-admin-dir-access(7674) Lotus Domino 5.0.5 and 5.0.8, and possibly other versions, allows remote attackers to cause a denial of service (block access to databases that have not been previously accessed) via a URL that includes the . (dot) directory. 20011207 Lotus Domino Web server vulnerability 3656 http://www-1.ibm.com/support/manager.wss?rs=1&rt=0&org=sims&doc=255CC03D83CFF50C85256B1E005E349B lotus-domino-database-dos(7684) Buffer overflow in fbglyph.c in XFree86 before 4.2.0, related to glyph clipping for large origins, allows attackers to cause a denial of service and possibly gain privileges via a large number of characters, possibly through the web page search form of KDE Konqueror or from an xterm command with a long title. http://cvsweb.xfree86.org/cvsweb/xc/programs/Xserver/fb/fbglyph.c 20011207 Crashing X 20011208 Re: Crashing X 20010922 XFree86 DOS / Buffer overflow local and remote. 3657 3663 http://www.xfree86.org/4.2.0/RELNOTES2.html#2 http://www.xfree86.org/security/ xfree86-konqueror-bo(7673) xfree86-xterm-title-bo(7683) speechd 0.54 and earlier, with the Festival or rsynth speech synthesis package, allows attackers to execute arbitrary commands via shell metacharacters. 20010911 security alert: speechd from speechio.org 3326 http://www.speechio.org/speechd.html speechd-execute-commands(7121) Buffer overflows in eManager plugin for Trend Micro InterScan VirusWall for NT 3.51 and 3.51J allow remote attackers to execute arbitrary code via long arguments to the CGI programs (1) register.dll, (2) ContentFilter.dll, (3) SFNofitication.dll, (4) register.dll, (5) TOP10.dll, (6) SpamExcp.dll, and (7) spamrule.dll. 20010912 [SNS Advisory No.42] Trend Micro InterScan eManager for NT Multiple Program Buffer Overflow Vulnerability 3327 http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=3142 interscan-emanager-bo(7104) Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 creates a hidden share named ARCSERVE$, which allows remote attackers to obtain sensitive information and overwrite critical files. 20010915 ARCserve 6.61 Share Access Vulnerability http://support.ca.com/Download/patches/asitnt/QO00945.html 3342 arcserve-aremote-plaintext(7122) Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremote.dmp file in the ARCSERVE$ hidden share, which allows local and remote attackers to gain privileges. 20010915 ARCserve 6.61 Share Access Vulnerability http://support.ca.com/Download/patches/asitnt/QO00945.html 3343 arcserve-aremote-plaintext(7122) Buffer overflow in tab expansion capability of the most program allows local or remote attackers to execute arbitrary code via a malformed file that is viewed with most. DSA-076 3347 most-file-create-bo(7149) IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privileges of WebSphere users via brute force guessing. 20010928 Re: Websphere cookie/sessionid predictable http://www14.software.ibm.com/webapp/download/postconfig.jsp?id=4000805&pf=Multi-Platform&v=3.0.2&e=Standard+%26+Advanced+Editions&cat=&s=p ibm-websphere-seq-predict(7153) Directory traversal vulnerability in SpoonFTP 1.1 allows local and sometimes remote attackers to access files outside of the FTP root via a ... (modified dot dot) in the CD (CWD) command. 20010920 Vulnerability in SpoonFTP http://www.pi-soft.com/spoonftp/index.shtml 3351 spoonftp-dot-directory-traversal(7147) Buffer overflow in client for Half-Life 1.1.0.8 and earlier allows malicious remote servers to execute arbitrary code via a long console command. 20010920 Advisory: Half-Life remote buffer overflow vulnerability halflife-connect-bo(7148) glFTPD 1.23 allows remote attackers to cause a denial of service (CPU consumption) via a LIST command with an argument that contains a large number of * (asterisk) characters. 20010817 [ASGUARD-LABS] glFTPD v1.23 DOS Attack http://www.glftpd.org/ glftpd-list-dos(7001) 3201 Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in the CD (CWD) command. 20010818 [Real Security] Advisory for Nudester 1.10 3202 Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct brute force password guessing. 20010817 Arkeia Possible remote root & information leakage 3204 Knox Arkeia server 4.2, and possibly other versions, installs its root user with a null password by default, which allows local and remote users to gain privileges. 20010817 Arkeia Possible remote root & information leakage 3203 ipfw in FreeBSD does not properly handle the use of "me" in its rules when point to point interfaces are used, which causes ipfw to allow connections from arbitrary remote hosts. FreeBSD-SA-01:53 3206 ipfw-me-unauthorized-access(7002) Cross-site scripting vulnerability in TDForum 1.2 CGI script (tdforum12.cgi) allows remote attackers to execute arbitrary script on other clients via a forum message that contains the script. 20010820 Re: tdforum 1.2 Messageboard 20010820 tdforum 1.2 Messageboard VU#782243 3207 tdforum-cross-site-scripting(7009) Directory traversal vulnerability in ACI 4d webserver allows remote attackers to read arbitrary files via a .. (dot dot) or drive letter (e.g., C:) in an HTTP request. 4d-webserver-directory-traversal(7010) 20010820 ACI 4D WebServer Directory traversal. 3209 Surf-Net ASP Forum before 2.30 uses easily guessable cookies based on the UserID, which allows remote attackers to gain administrative privileges by calculating the value of the admin cookie (UserID 1), i.e. "0888888." 20010820 security problem in surf-net ASP Discussion Forum < 2.30 3210 surfnet-asp-cookie-seq-predictable(7011) BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink into the data-bag space. 20010822 BSCW symlink vulnerability http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txt bscw-extracted-file-symlink(7029) VU#465971 3227 Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. CA-2001-18 L-116 VU#869184 3048 oracle-ldap-protos-format-string(6903) Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. http://otn.oracle.com/deploy/security/pdf/oid_cert_bof.pdf CA-2001-18 L-116 VU#869184 3047 oracle-ldap-protos-bo(6902) Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gain root privileges via modified libraries or environment variables. HPSBUX0108-165 slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field. CLA-2001:417 CA-2001-18 DSA-068 VU#935800 MDKSA-2001:069 RHSA-2001:098 3049 openldap-ldap-protos-dos(6904) login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password guessing attacks without being detected or observed using the lastb program. PHCO_17719 hpux-login-btmp(8632) 3289 Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argument. 20010903 hpux warez 3279 hpux-swverify-bo(7078) docview before 1.0-15 allows remote attackers to execute arbitrary commands via shell metacharacters that are processed when converting a man page to a web page. CSSA-2001-026.0 3052 docview-httpd-command-execution(6854) HP CIFS/9000 Server (SAMBA) A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the username of the user making the request, which could cause the server to change the password of a different user. HPSBUX0108-164 hp-cifs-change-passwords(7051) Directory traversal vulnerability in IBM Tivoli WebSEAL Policy Director 3.01 through 3.7.1 allows remote attackers to read arbitrary files or directories via encoded .. (dot dot) sequences containing "%2e" strings. ftp://ftp.tivoli.com/support/patches/patches_3.7.1/3.7.1-POL-0003/3.7.1-POL-0003.README 20010723 iXsecurity.20010618.policy_director.a 3080 IY18152 tivoli-secureway-dot-directory-traversal(6884) UltraEdit uses weak encryption to record FTP passwords in the uedit32.ini file, which allows local users who can read the file to decrypt the passwords and gain privileges. 20010823 Re: Respondus v1.1.2 stores passwords using weak encryption http://www.eve-software.com/security/ueditpw.html Password Safe 1.7(1) leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with the "Clear the password when minimized" and "Lock password database on minimize and prompt on restore" options enabled, which could allow an attacker with access to the memory (e.g. an administrator) to read the passwords. 20010913 leak of information in counterpane/Bruce Schneier's Password Safe program 3337 counterpane-password-access(7123) shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page" parameter. http://www.irata.com/shopver.html 20010908 Shopping Cart Version 1.23 3308 hassan-cart-command-execution(7106) SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo. 20010914 Security Vulnerability with Microsoft Index Server 2.0(Sample file reveals file info, physical path etc) 3339 winnt-indexserver-sqlqhit-asp(7125) Cross-site scripting vulnerability in CGIWrap before 3.7 allows remote attackers to execute arbitrary Javascript on other web clients by causing the Javascript to be inserted into error messages that are generated by CGIWrap. 20010722 Re: [cgiwrap-users] Re: Security hole in CGIWrap (cross-site scripting vulnerability) http://cgiwrap.sourceforge.net/changes.html 3084 cgiwrap-cross-site-scripting(6886) Arkeia backup server 4.2.8-2 and earlier creates its database files with world-writable permissions, which could allow local users to overwrite the files or obtain sensitive information. 20010723 permission probs with Arkeia 3085 arkeia-insecure-file-permissions(6885) Buffer overflows in Pileup before 1.2 allows local users to gain root privileges via (1) long command line arguments, or (2) a long callsign. 20010723 pileup 1.2 http://www.babbage.demon.co.uk/linux/pileup-1.2/pileup-1.2.tar.gz 3086 Inter7 vpopmail 4.10.35 and earlier, when using the MySQL module, compiles authentication information in cleartext into the libvpopmail.a library, which allows local users to obtain the MySQL username and password by inspecting the vpopmail programs that use the library. http://www.inter7.com/vpopmail/ChangeLog 20010904 BUZ.CH Security Advisory 200109041: Inter7 vpopmail DB pw problem 3284 vpopmail-insecure-auth-data(7076) Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients via an incorrect URL containing the malicious script, which is printed back in an error message. 20010724 Proxomitron Cross-site Scripting Vulnerability 3087 proxomitron-cross-site-scripting(6887) shopplus.cgi in ShopPlus shopping cart allows remote attackers to execute arbitrary commands via shell metacharacters in the "file" parameter. 20010905 ShopPlus Cart shopplus-command-execution(7077) sendmsg function in NetBSD 1.3 through 1.5 allows local users to cause a denial of service (kernel trap or panic) via a msghdr structure with a large msg_controllen length. NetBSD-SA2001-011 3088 bsd-kernel-sendmsg-dos(6908) Marconi ForeThought 7.1 allows remote attackers to cause a denial of service by causing both telnet sessions to be locked via unusual input (e.g., from a port scanner), which prevents others from logging into the device. 20010904 Telnet DoS Vulnerability in Marconi ATM Switch Software 3286 forethought-telnet-dos(7082) PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI programs. http://www.phprojekt.com/ChangeLog 20010826 security hole in os groupware suite PHProjekt 3239 phprojekt-id-modify(7035) POP3Lite before 0.2.4 does not properly quote a . (dot) in an email message, which could allow a remote attacker to append arbitrary text to the end of an email message, which could then be interpreted by various mail clients as valid POP server responses or other input that could cause clients to crash or otherwise behave unexpectedly. 20010902 POP3Lite 0.2.3b minor client side DoS and message injection 3278 pop3lite-dot-message-injection(7075) Textor Webmasters Ltd listrec.pl CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the TEMPLATE parameter. 20010911 Textor Webmasters Ltd (listrec.pl) listrecpl-remote-command-execution(7117) IBM HACMP 4.4 allows remote attackers to cause a denial of service via a completed TCP connection to HACMP ports (e.g., using a port scan) that does not send additional data, which causes a failure in snmpd. 20010924 HACMP and port scans 20011002 Vulnerability 3358, "IBM HACMP Port Scan Denial of Service Vulnerability" 3358 IY17630 IY20943 hacmp-portscan-dos(7165) Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script. 20010912 FREAK SHOW: Outlook Express 6.00 20010915 Proof-Of-Concept Perl Script for Bugtraq-ID: #3334 3334 outlook-express-text-script-execution(7118) rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack on the rlmadmin.help file. 20010907 rlmadmin v3.8M view file symlink vulnerability 3302 radius-rlmadmin-help-symlink(7096) The default configuration of the DVI print filter (dvips) in Red Hat Linux 7.0 and earlier does not run dvips in secure mode when dvips is executed by lpd, which could allow remote attackers to gain privileges by printing a DVI file that contains malicious commands. 20010827 LPRng/rhs-printfilters - remote execution of commands RHSA-2001:102 3241 dvips-lpd-command-execution(16509) Respondus 1.1.2 for WebCT uses weak encryption to remember usernames and passwords, which allows local users who can read the WEBCT.SVR file to decrypt the passwords and gain additional privileges. 20010823 Respondus v1.1.2 stores passwords using weak encryption Cross-site scripting (CSS) vulnerability in gnut Gnutella client before 0.4.27 allows remote attackers to execute arbitrary script on other clients by sharing a file whose name contains the script tags. 20010830 gnut gnutella client html injection Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges. 20010824 Starfish Truesync Desktop + REX 5000 Pro multiple vulnerabilities 3231 Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which allows an attacker to read the files using a different application. 20010824 Starfish Truesync Desktop + REX 5000 Pro multiple vulnerabilities 3232 Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack. 20010824 Starfish Truesync Desktop + REX 5000 Pro multiple vulnerabilities Java Plugin 1.4 for JRE 1.3 executes signed applets even if the certificate is expired, which could allow remote attackers to conduct unauthorized activities via an applet that has been signed by an expired certificate. 20010824 Java Plugin 1.4 with JRE 1.3 -> Ignores certificates. javaplugin-jre-expired-certificate(7048) 3245 Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request. 20010809 Fetchmail security advisory CLA-2001:419 DSA-071 fetchmail-signed-integer-index(6965) MDKSA-2001:072 ESA-20010816-01 SuSE-SA:2001:026 RHSA-2001:103 3164 3166 Directory traversal vulnerability in pagecount CGI script in Sambar Server before 5.0 beta 5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) attack on the page parameter. 20010721 Sambar Web Server pagecount exploit code http://www.sambar.com/security.htm 3092 sambar-pagecount-overwrite-files(6916) index2.php in Mambo Site Server 3.0.0 through 3.0.5 allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters. 20010725 Serious security hole in Mambo Site Server version 3.0.X http://prdownloads.sourceforge.net/mambo/mambov3.0.6.tar.gz 3093 mambo-phpsessid-gain-privileges(6910) Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirectory under /tmp/screens/. SuSE-SA:2001:030 screen-local-privilege-elevation(7134) Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server. 20000707 (no subject) 20000707 Re: apache and 404/404 status codes 20000707 Re: your mail 20010912 Is there user Anna at your host ? 3335 linux-apache-username-exists(7129) eshop.pl in WebDiscount(e)shop allows remote attackers to execute arbitrary commands via shell metacharacters in the seite parameter. 20010915 advisory 3340 eshop-script-execute-commands(7128) Buffer overflow in Snes9x 1.37, when installed setuid root, allows local users to gain root privileges via a long command line argument. 20011016 [ ** Snes9x buffer overflow vulnerability ** ] 3437 PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability." http://www.pgp.com/support/product-advisories/pgpsdk.asp 20010904 PGPsdk Key Validity Vulnerability 3280 pgp-invalid-key-display(7081) rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original file, which could allow local users to gain privileges by reading the copied file while rmuser is running, obtain the password hashes, and crack the passwords. FreeBSD-SA-01:59 3282 rmuser-insecure-password-file(7086) Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / (slash) characters. 20010919 lotus domino server 5.08 is very gabby 3350 lotus-domino-ip-reveal(7180) Directory traversal vulnerability in view_item CGI program in sglMerchant 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTML_FILE parameter. 20010908 sglMerchant Version 1.0 3309 sglmerchant-dot-directory-traversal(7100) edit_image.php in Vibechild Directory Manager before 0.91 allows remote attackers to execute arbitrary commands via shell metacharacters in the userfile_name parameter, which is sent unfiltered to the PHP passthru function. 20010905 directorymanager bug http://sourceforge.net/project/shownotes.php?release_id=51589 3288 directory-manager-execute-commands(7079) Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDTM, (3) MLST, (4) MKD, (5) RMD, (6) RNFR, (7) RNTO, (8) SIZE, (9) STAT, (10) XMKD, or (11) XRMD. 20010726 def-2001-28 - WS_FTP server 2.0.2 Buffer Overflow and possible DOS http://www.ipswitch.com/Support/WS_FTP-Server/patch-upgrades.html wsftp-long-command-bo(6911) Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command. CLA-2001:428 DSA-072 DSA-107 RHSA-2002:004 20010727 ADV/EXP:pic/lpd remote exploit - RH 7.0 3103 linux-groff-format-string(6918) Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, which returns the full pathname in the Content-PageName header. 20010921 IRM Security Advisory: Xcache Path Disclosure Vulnerability 3352 xcache-path-disclosure(7159) login.gas.bat and other CGI scripts in Entrust getAccess allow remote attackers to execute Java programs, and possibly arbitrary commands, by specifying an alternate -classpath argument. 20010727 Entrust - getAccess entrust-getaccess-execute-commands(6915) PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do not already define the prefix variable (e.g., by including mainfile.php), such as article.php. 20010803 [VulnWatch] 3 phpnuke bugs (2 possibly lead to admin privs) 3149 Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs when they are modified in certain ways such as (1) using a double slash (//) instead of a single slash, (2) URL-encoded characters, (3) requesting the IP address instead of the domain name, or (4) using a leading 0 in an octet of an IP address. 20010709 Various problems in Ternd Micro AppletTrap URL filtering 2996 2998 3000 content-slash-bypass-filter(6816) applettrap-unicode-bypass-filter(6817) applettrap-bypass-ip-restrictions(6818) applettrap-zero-bypass-restrictions(6819) Buffer overflow in WindowMaker (aka wmaker) 0.64 and earlier allows remote attackers to execute arbitrary code via a long window title. CLA-2001:411 DSA-074 MDKSA-2001:074 SuSE-SA:2001:032 3177 http://www.windowmaker.org/src/ChangeLog windowmaker-title-bo(6969) Buffer overflow in ultimate_source function of man 1.5 and earlier allows local users to gain privileges. man-ultimate-source-bo(8622) RHSA-2001:072 libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files. 20010920 Local vulnerability in libutil derived with FreeBSD 4.4-RC (and earlier) bsd-libutil-privilege-dropping(8697) Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_proxy off settings are used, which allows attackers to bypass the ACLs and conduct unauthorized activities such as port scanning. 20010719 TSLSA-2001-0013 - Squid IMNX-2001-70-031-01 CSSA-2001-029.0 MDKSA-2001:066 RHSA-2001:097 20010718 Squid httpd acceleration acl bug enables portscanning squid-http-accelerator-portscanning(6862) Directory traversal vulnerability in Meteor FTP 1.0 allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the ls/LIST command, or (2) a ... in the cd/CWD command. 20010927 CARTSA-2001-03 Meteor FTPD 1.0 Directory Traversal 3374 meteor-ftpd-directory-traversal(7176) admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file by directly calling admin.php with an upload parameter and specifying the file to copy. 20010924 twlc advisory: all versions of php nuke are vulnerable... http://sourceforge.net/forum/forum.php?forum_id=113892 3361 php-nuke-admin-file-overwrite(7170) Compaq TruCluster 1.5 allows remote attackers to cause a denial of service via a port scan from a system that does not have a DNS PTR record, which causes the cluster to enter a "split-brain" state. 20010925 Re: HACMP and port scans 3362 trucluster-portscan-dos(7171) Format string vulnerability in Hylafax on FreeBSD allows local users to execute arbitrary code via format specifiers in the -h hostname argument for (1) faxrm or (2) faxalter. 20010923 hylafax 3357 hylafax-hostname-format-string(7164) Binary decoding feature of slrn 0.9 and earlier allows remote attackers to execute commands via shell scripts that are inserted into a news post. DSA-078 3364 slrn-decode-script-execution(7166) GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory. 20010801 Slackware 8.0, 7.1 Vulnerability: /usr/bin/locate 3127 locate-command-execution(6932) Cisco SN 5420 Storage Router 1.1(3) and earlier allows local users to access a developer's shell without a password and execute certain restricted commands without being logged. 20010711 Vulnerabilities in Cisco SN 5420 Storage Routers 3131 cisco-sn-gain-access(6827) Cisco SN 5420 Storage Router 1.1(3) and earlier allows remote attackers to cause a denial of service (reboot) via a series of connections to TCP port 8023. L-112 20010711 Vulnerabilities in Cisco SN 5420 Storage Routers 3014 cisco-sn-dos(6826) The JetAdmin web interface for HP JetDirect does not set a password for the telnet interface when the admin password is changed, which allows remote attackers to gain access to the printer. 20010801 HP Jetdirect passwords don't sync 3132 HP LaserJet, and possibly other JetDirect devices, resets the admin password when the device is turned off, which could allow remote attackers to access the device without the password. 20010802 Re: HP Jetdirect passwords don't sync 3132 oracle program in Oracle 8.0.x, 8.1.x and 9.0.1 allows local users to overwrite arbitrary files via a symlink attack on an Oracle log trace (.trc) file that is created in an alternate home directory identified by the ORACLE_HOME environment variable. 20011024 Oracle File Overwrite Security Vulnerability 20010802 vulnerability in oracle binary in Oracle 8.0.5 - 8.1.6 http://otn.oracle.com/deploy/security/pdf/oracle_race.pdf 3135 Transsoft Broker 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file. 20010701 Broker 5.9.5.0 Directory Traversal 2960 ftp-lnk-directory-traversal(6760) ArGoSoft FTP Server 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file. 20010701 ArGoSoft 1.2.2.2 *.lnk upload Directory Traversal 2961 ftp-lnk-directory-traversal(6760) Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file. 20010112 Basilix Webmail System *.class *.inc Permission Vulnerability 2198 basilix-webmail-retrieve-files(5934) Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the request_id[DUMMY] parameter. 20010706 basilix bug 2995 basilix-webmail-view-files(6873) Buffer overflow in qpopper (aka qpop or popper) 4.0 through 4.0.2 allows remote attackers to gain privileges via a long username. CSSA-2001-SCO.8 20010420 Qpopper 4.0 Buffer Overflow 20010602 Qpopper 4.0.3 **** Fixes Buffer Overflow **** (fwd) 2811 qpopper-username-bo(6647) Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or (2) calling dup2 on a file descriptor in one process, then setting the descriptor to NULL via a close in another process that is created via rfork. 20010602 Locally exploitable races in OpenBSD VFS 2817 2818 openbsd-dup2-race-dos(6660) openbsd-pipe-race-dos(6661) AWOL PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit http://www.geocrawler.com/archives/3/14414/2001/9/0/6668723/ http://www.gospelcom.net/mnn/topher/awol/changelog.php php-includedir-code-execution(7215) 3387 Phorecast PHP script before 0.40 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit http://phorecast.org/ php-includedir-code-execution(7215) 3388 CCCSoftware CCC PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit 3389 php-includedir-code-execution(7215) Dark Hart Portal (darkportal) PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit http://sourceforge.net/tracker/index.php?func=detail&aid=440666&group_id=20971&atid=120971 3390 php-includedir-code-execution(7215) Empris PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit 3391 php-includedir-code-execution(7215) AdLogin.pm in AdCycle 1.15 and earlier allows remote attackers to bypass authentication and gain privileges by injecting SQL code in the $password argument. 20010713 AdCycle SQL Command Insertion Vulnerability - qDefense Advisory Number QDAV-2001-7-2 http://www.adcycle.com/cgi-bin/download.cgi?type=UNIX&version=1.17 3032 adcycle-insert-sql-command(6837) PHPAdsNew PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit http://sourceforge.net/forum/forum.php?forum_id=117952 http://sourceforge.net/forum/forum.php?thread_id=148900&forum_id=117952 php-includedir-code-execution(7215) 3392 The Microsoft Windows network stack allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed ARP request packets with random source IP and MAC addresses, as demonstrated by ARPNuke. 20010730 ARPNuke - 80 kb/s kills a whole subnet 3113 win-arp-packet-flooding-dos(6924) IRC DCC helper in the ip_masq_irc IP masquerading module 2.2 allows remote attackers to bypass intended firewall restrictions by causing the target system to send a "DCC SEND" request to a malicious server which listens on port 6667, which may cause the module to believe that the traffic is a valid request and allow the connection to the port specified in the DCC SEND request. 20010730 [RAZOR] Linux kernel IP masquerading vulnerability 20010730 Re: [RAZOR] Linux kernel IP masquerading vulnerability (_actual_ patch) linux-ipmasqirc-bypass-protection(6923) 3117 The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by connecting to port 16286 and not disconnecting, which prevents users from making license requests. 20010730 a couple minor issues with mathematica license manager 3120 mathematica-license-dos(6926) The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to bypass access control (specified by the -restrict argument) and steal a license via a client request that includes the name of a host that is allowed to obtain the license. 20010730 a couple minor issues with mathematica license manager 3118 mathematica-license-retrieval(6927) VMWare creates a temporary file vmware-log.USERNAME with insecure permissions, which allows local users to read or modify license information. 20010730 vmware bug? 3119 vmware-obtain-license-info(6925) phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php. http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/ 20010731 New command execution vulnerability in myPhpAdmin 3121 Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error. IY22255 Buffer overflow in mana in OpenServer 5.0.6a and earlier allows local users to execute arbitrary code. CSSA-2001-SCO.12 openserver-mana-bo(7034) Buffer overflow in uidadmin in Caldera Open Unix 8.0.0 and UnixWare 7 allows local users to gain root privileges via a long -S (scheme) command line argument. CSSA-2001-SCO.14 3244 unixware-openunix-uidadmin-bo(7036) Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap allows remote attackers to cause a denial of service via multiple connections to the router on the (1) HTTP or (2) telnet service, which causes the router to become unresponsive and stop forwarding packets. 20010823 CBOS Web-based Configuration Utility Vulnerability 3236 cisco-cbos-telnet-dos(7025) cisco-cbos-http-dos(7026) Web-based configuration utility in Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap binds itself to port 80 even when web-based configuration services are disabled, which could leave the router open to attack. 20010823 CBOS Web-based Configuration Utility Vulnerability cisco-cbos-web-config(7027) ns6install installation script for Netscape 6.01 on Solaris, and other versions including 6.2.1 beta, allows local users to overwrite arbitrary files via a symlink attack. 20010827 Dangerous temp file creation during installation of Netscape 6. 20010827 Dangerous temp file creation during installation of Netscape 6. 3243 netscape-install-tmpfile-symlink(7042) Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via an HTTP request with a long Authorization header. 20010822 AOLserver 3.0 vulnerability 20010906 AOLserver exploit code 3230 aolserver-long-password-dos(7030) qpopper 4.01 with PAM based authentication on Red Hat systems generates different error messages when an invalid username is provided instead of a valid name, which allows remote attackers to determine valid usernames on the system. 20010825 qpopper and pam.d 3242 qpopper-pam-auth-error(7047) libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior. http://lists.debian.org/debian-security/2001/debian-security-200101/msg00085.html 20010822 Adobe Acrobat creates world writable ~/AdobeFnt.lst files 3225 adobe-acrobat-insecure-permissions(7024) Sage Software MAS 200 allows remote attackers to cause a denial of service by connecting to port 10000 and entering a series of control characters. 20010821 Bug in MAS90 Accounting Platform remote access? 3221 mas-telnet-connect-dos(7020) Cisco IOS 12.2 and earlier running Cisco Discovery Protocol (CDP) allows remote attackers to cause a denial of service (memory consumption) via a flood of CDP neighbor announcements. VU#139491 20011009 Cisco CDP attacks 20011009 Cisco Systems - Vulnerability in CDP 3412 cisco-ios-cdp-dos(7242) Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail. http://www.apacheweek.com/issues/02-02-01#security 20010812 Are your mod_rewrite rules doing what you expect? 3176 apache-rewrite-bypass-directives(8633) Webridge PX Application Suite allows remote attackers to obtain sensitive information via a malformed request that generates a server error message, which includes full pathname or internal IP address information in the variables (1) APPL_PHYSICAL_PATH, (2) PATH_TRANSLATED, and (3) LOCAL_ADDR. 20010815 webridge application suite gives up too much error information on Internal Server Error 3182 webridge-px-reveal-information(6993) Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges. 20010526 Webmin Doesn't Clean Env (root exploit) CSSA-2001-019.1 MDKSA-2001:059 2795 webmin-gain-information(6627) poprelayd script before 2.0 in Cobalt RaQ3 servers allows remote attackers to bypass authentication for relaying by causing a "POP login by user" string that includes the attacker's IP address to be injected into the maillog log file. 20010703 poprelayd and sendmail relay authentication problem (Cobalt Raq3) 20010709 Re: poprelayd and sendmail relay authentication problem (Cobalt Raq3) 2986 cobalt-poprelayd-mail-relay(6806) Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable. 20010705 Solaris whodo Vulnerability 2935 solaris-whodo-bo(6802) oval:org.mitre.oval:def:34 oval:org.mitre.oval:def:47 Buffer overflow in tt_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument. IMNX-2001-70-028-01 DSA-062 MDKSA-2001:060 20010615 Rxvt vulnerability 2878 rxvt-ttprintf-bo(6701) Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in the SMTP commands (1) HELO, (2) EHLO, (3) MAIL FROM, or (4) RCPT TO, and the POP3 commands (5) USER and (6) other commands that can be executed after POP3 authentication. 20010622 eXtremail Remote Format String ('s) http://www.extremail.com/history.htm http://www.extremail.com/news.htm 2908 extremail-flog-format-string(6733) create_keyfiles in PSSP 3.2 with DCE 3.1 authentication on AIX creates keyfile directories with world-writable permissions, which could allow a local user to delete key files and cause a denial of service. IY19069 aix-keyfile-world-writable(8923) diagrpt in AIX 4.3.x and 5.1 uses the DIAGDATADIR environment variable to find and execute certain programs, which allows local users to gain privileges by modifying the variable to point to a Trojan horse program. 2916 MSS-OAR-E01-2001:225.1 aix-diagrpt-root-shell(6734) Format string vulnerabilities in Livingston/Lucent RADIUS before 2.1.va.1 may allow local or remote attackers to cause a denial of service and possibly execute arbitrary code via format specifiers that are injected into log messages. [fm-news] 20010713 Newsletter for Friday, July 13th 2001 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://freshmeat.net/releases/52020/ 2994 Directory traversal vulnerability in Livingston/Lucent RADIUS before 2.1.va.1 may allow attackers to read arbitrary files via a .. (dot dot) attack. http://freshmeat.net/releases/52020/ Icecast 1.3.7, and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service (crash) via a URL that ends in . (dot), / (forward slash), or \ (backward slash). CSSA-2002-020.0 DSA-089 http://www.icecast.org/index.html http://www.icecast.org/releases/icecast-1.3.11.tar.gz RHSA-2001:105 RHSA-2002:063 20010626 Advisory 2933 icecast-http-remote-dos(6751) Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message. 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability VU#654643 MPSB01-06 2983 java-servlet-crosssite-scripting(6793) Lmail 2.7 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file. 20010705 lmail local root exploit 2984 lmail-tmpfile-symlink(6809) XDM in XFree86 3.3 and 3.3.3 generates easily guessable cookies using gettimeofday() when compiled with the HasXdmXauth option, which allows remote attackers to gain unauthorized access to the X display via a brute force attack. 20010705 Re: xdm cookies fast brute force 20010704 xdm cookies fast brute force 2985 xdm-cookie-brute-force(6808) The default configuration of the config.http.tunnel.allow_ports option on NetCache devices is set to +all, which allows remote attackers to connect to arbitrary ports on remote systems behind the device. 20010705 RE: Tunnel ports allowed on NetApp NetCaches 2990 netcache-tunnel-default-configuration(6807) Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user. http://support.microsoft.com/default.aspx?scid=kb;EN-US;q234241 20010605 SECURITY.NNOV: Outlook Express address book spoofing 2823 outlook-address-book-spoofing(6655) libnss-pgsql in nss-pgsql 0.9.0 and earlier allows remote attackers to execute arbitrary SQL queries by inserting SQL code into an HTTP request. 20010910 RUS-CERT Advisory 2001-09:01 3314 postgresql-nss-authentication-modules(7111) nss_postgresql 0.6.1 and before allows a remote attacker to execute arbitrary SQL queries by inserting SQL code into an HTTP request. 20010910 RUS-CERT Advisory 2001-09:01 3315 postgresql-nss-authentication-modules(7111) The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable. NetBSD-SA2001-014 bsd-dump-tty-privileges(7037) msgchk in Digital UNIX 4.0G and earlier allows a local user to read the first line of arbitrary files via a symlink attack on the .mh_profile file. VU#440539 20010910 Digital Unix 4.0x msgchk multiple vulnerabilities 3320 du-msgchk-symlink(7102) Buffer overflow in msgchk in Digital UNIX 4.0G and earlier allows local users to execute arbitrary code via a long command line argument. 20010910 Digital Unix 4.0x msgchk multiple vulnerabilities 3311 du-msgchk-bo(7101) NetOp School 1.5 allows local users to bypass access restrictions on the administration version by logging into the student version, closing the student version, then starting the administration version. 20010911 NetOP School Admin Vulnerability for Windows 2000 Terminal Services and NT4 3321 netop-school-bypass-authentication(7120) Buffer overflow in uuq in AIX 4 could allow local users to execute arbitrary code via a long -r parameter. IY23401 IY24231 Buffer overflows in muxatmd in AIX 4 allows an attacker to cause a core dump and possibly execute code. IY23402 Cisco routers and switches running IOS 12.0 through 12.2.1 allows a remote attacker to cause a denial of service via a flood of UDP packets. 20010811 Re: UDP packet handling weird behaviour of various operating systems 20010724 UDP packet handling weird behaviour of various operating systems 3096 cisco-ios-udp-dos(6319) Cisco PIX firewall manager (PFM) 4.3(2)g logs the enable password in plaintext in the pfm.log file, which could allow local users to obtain the password by reading the file. 20011010 Vulnerability: Cisco PIX Firewall Manager VU#639507 3419 cisco-pfm-plaintext-password(7265) The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content, which includes the path in the rejection notice. 20010907 Microsoft Exchange + Norton AntiVirus leak local information 20010912 Re: Microsoft Exchange + Norton AntiVirus leak local information 3305 nav-exchange-reveal-information(7093) sendmessage.cgi in W3Mail 1.0.2, and possibly other CGI programs, allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the 'Compose Message' page. 20011007 Bug found at W3Mail Webmail 3673 http://www.w3mail.org/ChangeLog w3mail-metacharacters-command-execution(7230) The Log Viewer function in the Check Point FireWall-1 GUI for Solaris 3.0b through 4.1 SP2 does not check for the existence of '.log' files when saving files, which allows (1) remote authenticated users to overwrite arbitrary files ending in '.log', or (2) local users to overwrite arbitrary files via a symlink attack. 20010908 Bug in remote GUI access in CheckPoint Firewall 3303 fw1-log-file-overwrite(7095) Check Point FireWall-1 3.0b through 4.1 for Solaris allows local users to overwrite arbitrary files via a symlink attack on temporary policy files that end in a .cpp extension, which are set world-writable. 20010908 Bug in compile portion for older versions of CheckPoint Firewalls 3300 fw1-tmp-file-symlink(7094) FTP Voyager ActiveX control before 8.0, when it is marked as safe for scripting (the default) or if allowed by the IObjectSafety interface, allows remote attackers to execute arbitrary commands. VU#320944 ftp-voyager-embedded-script-execution(7119) SonicWALL SOHO uses easily predictable TCP sequence numbers, which allows remote attackers to spoof or hijack sessions. 20010725 Weak TCP Sequence Numbers in Sonicwall SOHO Firewall 3098 RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure. L-141 20010912 Vulnerable SSL Implementation in iCDN http://www.rsasecurity.com/products/bsafe/bulletins/BSAFE_SSL-J_3.x.SecurityBulletin.html 3329 bsafe-ssl-bypass-authentication(7112) The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwords, which could allow local users to break all user passwords by cracking the key or modifying a copy of the sambar program to call the decryption procedure. 20010725 Sambar Server password decryption 3095 sambar-insecure-passwords(6909) SnapStream PVS 1.2a stores its passwords in plaintext in the file SSD.ini, which could allow a remote attacker to gain privileges on the server. 20010726 Snapstream PVS vulnerability http://discuss.snapstream.com/ubb/Forum1/HTML/000216.html 3101 snapstream-dot-directory-traversal(6917) Directory traversal vulnerability in SnapStream PVS 1.2a allows remote attackers to read arbitrary files via a .. (dot dot) attack in the requested URL. 20010726 Snapstream PVS vulnerability http://discuss.snapstream.com/ubb/Forum1/HTML/000216.html 3100 snapstream-dot-directory-traversal(6917) Directory traversal vulnerability in EFTP 2.0.7.337 allows remote authenticated users to reveal directory contents via a .. (dot dot) in the (1) LIST, (2) QUOTE SIZE, and (3) QUOTE MDTM commands. http://www.eftp.org/releasehistory.html 20010912 EFTP Version 2.0.7.337 vulnerabilities 3331 3333 eftp-list-directory-traversal(7113) eftp-quote-reveal-information(7114) EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection. 20010912 EFTP Version 2.0.7.337 vulnerabilities EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file. 20010912 EFTP Version 2.0.7.337 vulnerabilities 3332 eftp-plaintext-password(7116) Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters. 20010912 EFTP Version 2.0.7.337 vulnerabilities 3330 eftp-lnk-bo(7115) Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories with long names, then running the ls -R (recursive) command. ftp://ftp.trolltech.com/freebies/ftpd/troll-ftpd-1.27.tar.gz 20010813 Local exploit for TrollFTPD-1.26 3174 trollftpd-long-path-bo(6974) book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter. 20010813 NetCode NC Book 0.2b remote command execution vulnerability 3178 netcode-book-pipes-command(6986) generate.cgi in SIX-webboard 2.01 and before allows remote attackers to read arbitrary files via a dot dot (..) in the content parameter. 20010813 SIX-webboard 2.01 "show files" vulnerability 3175 sixwebboard-dot-directory-traversal(6975) Identix BioLogon 2.03 and earlier does not lock secondary displays on a multi-monitor system running Windows 98 or ME, which allows an attacker with physical access to the system to bypass authentication through a secondary display. 20010802 Identix BioLogon Client security bug 20010808 Response to Identix BioLogon Client security bug 3140 identix-biologon-auth-bypass(6948) LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user passwords by connecting to the router and viewing the HTML source for (1) index.htm and (2) Password.htm. ftp://ftp.linksys.com/pub/befsr41/befsr-fw1402.zip 20010802 Advisory Update: Design Flaw in Linksys EtherFast 4-Port 20010810 Linksys router security fix 3141 linksys-etherfast-reveal-passwords(6949) A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL. http://download.roxen.com/2.0/patch/security-notice.html 20010802 Roxen security alert: URL decoding vulnerable 20010802 FW: Security alert: Remote user can access any file 3145 roxen-urlrectifier-retrieve-files(6937) cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack. VU#105347 SuSE-SA:2001:025 3148 xmcd-cda-symlink(6941) Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or (2) overwrite ColdFusion Server templates. http://www.allaire.com/handlers/index.cfm?id=21566 VU#135531 20010712 New Cold Fusion vulnerability 3018 coldfusion-unauthorized-file-access(6839) DEPRECATED. This entry has been deprecated. It is a duplicate of CVE-2001-1084. Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in 'SPECIAL' mode. 20010803 REPOST: A damaging local DoS in WinNT SP6a 3144 winnt-nt4all-dos(6943) Vulnerability in Network Node Manager (NNM) 6.2 and earlier in HP OpenView allows a local user to execute arbitrary code, possibly via a buffer overflow in a long hostname or object ID. VU#782155 HPSBUX0110-170 HPSBUX0112-177 3399 openview-nmm-gain-privileges(7222) rpcbind in HP-UX 11.00, 11.04 and 11.11 allows remote attackers to cause a denial of service (core dump) via a malformed RPC portmap requests, possibly related to a buffer overflow. M-003 HPSBUX0110-169 3400 hp-rpcbind-dos(7221) oval:org.mitre.oval:def:5683 Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site. http://www.sarc.com/avcenter/security/Content/2001.10.05.html 20011005 Symantec LiveUpdate attacks 3403 liveupdate-host-verification(7235) Symantec LiveUpdate 1.4 through 1.6, and possibly later versions, allows remote attackers to cause a denial of service (flood) via DNS spoofing of the update.symantec.com site. http://www.sarc.com/avcenter/security/Content/2001.10.05.html 20011005 Symantec LiveUpdate attacks 3413 liveupdate-host-verification(7235) Buffer overflow in Progress database 8.3D and 9.1C could allow a local user to execute arbitrary code via (1) _proapsv, (2) _mprosrv, (3) _mprshut, (4) orarx, (5) sqlcpp, (6) _probrkr, (7) _sqlschema and (8) _sqldump. 20011005 Progress Database vulnerabilities 3404 progress-strcpy-bo(7236) Buffer overflow in Progress database 8.3D and 9.1C allows local users to execute arbitrary code via long entries in files that are specified by the (1) PROMSGS or (2) PROTERMCAP environment variables. 20011008 Progress TERM (protermcap) overflows and PROMSGS overflows 3414 progress-protermcap-bo(7264) Format string vulnerabilities in (1) _probuild, (2) _dbutil, (3) _mprosrv, (4) _mprshut, (5) _proapsv, (6) _progres, (7) _proutil, (8) _rfutil and (9) prolib in Progress database 9.1C allows a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable. 20011102 Progres Databse PROMSGS Format strings issue. 3502 progress-promsgs-format-string(7457) Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file. SuSE-SA:2001:027 20010802 suse: sdbsearch.cgi vulnerability sdbsearch-cgi-command-execution(7003) Directory traversal vulnerability in WhitSoft Development SlimFTPd 2.2 allows an attacker to read arbitrary files and directories via a ... (modified dot dot) in the CD command. http://www.securiteam.com/windowsntfocus/5RP0L0055O.html Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during the call to the crypt function during authentication. CLA-2001:420 mailman-blank-passwords(7091) Vulnerability in a system call in BSDI 3.0 and 3.1 allows local users to cause a denial of service (reboot) in the kernel via a particular sequence of instructions. bsd-kernel-dos(7023) 20010821 BSDi (3.0/3.1) reboot machine code as any user (non-specific) 3220 Xerox DocuPrint N40 Printers allow remote attackers to cause a denial of service via malformed data, such as that produced by the Code Red worm. xerox-docuprint-dos(6976) 20010720 Re: Two birds with one worm 20010809 Xerox N40 printers and Code Red worm 3170 ZyXEL Prestige 642R and 642R-I routers do not filter the routers' Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router, if the password is known. 20010809 ZyXEL Prestige 642R: Exposed Admin Services on WAN with Default Password 20010810 Re: ZyXEL Prestige 642R: Exposed Admin Services on WAN with Default Password 20010814 Fwd: ZyXEL Prestige 642 Router Administration Interface Vulnerability 20010918 SECURITY RISK: ZyXEL ADSL Router 642R - WAN filter bypass from internal network 3346 prestige-wan-bypass-filter(7146) The libsecurity library in HP-UX 11.04 (VVOS) allows attackers to cause a denial of service. HPSBUX0109-166 L-143 3338 hp-virtualvault-libsecurity-dos(7124) D-Link DI-704 Internet Gateway firmware earlier than V2.56b6 allows remote attackers to cause a denial of service (reboot) via malformed IP datagram fragments. 20010906 Malformed Fragmented Packets DoS Dlink Firewall/Routers 3306 dlink-fragmented-packet-dos(7090) Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the FILE parameter. 20010907 *** Security Advisory *** Power UP HTML 3304 powerup-rcgi-directory-traversal(7092) Directory traversal vulnerability in ASCII NT WinWrapper Professional allows remote attackers to read arbitrary files via a .. (dot dot) in the server request. winwrapper-dot-directory-traversal(7015) 20010822 [SNS Advisory No.39] WinWrapper Professional 2.0 Remote Arbitrary File Disclosure Vulnerability 3219 http://www.tsc.ant.co.jp/products/download.htm BadBlue Personal Edition v1.02 beta allows remote attackers to read source code for executable programs by appending a %00 (null byte) to the request. 20010822 -- [ iSecureLabs BadBlue v1.02 beta for Windows 98, ME and 2000 Advisory ] -- 3222 badblue-file-source-disclosure(7021) The Pseudo-Random Number Generator (PRNG) in SSLeay and OpenSSL before 0.9.6b allows attackers to use the output of small PRNG requests to determine the internal state information, which could be used by attackers to predict future pseudo-random numbers. NetBSD-SA2001-013 CLA-2001:418 MDKSA-2001:065 ESA-20010709-01 RHSA-2001:051 FreeBSD-SA-01:51 20010710 OpenSSL Security Advisory: PRNG weakness in versions up to 0.9.6a 3004 openssl-prng-brute-force(6823) ArGoSoft FTP Server 1.2.2.2 uses weak encryption for user passwords, which allows an attacker with access to the password file to gain privileges. argosoft-ftp-weak-encryption(6848) 20010712 ArGoSoft FTP Server 1.2.2.2 Weak password encryption 3029 IBM DB2 7.0 allows a remote attacker to cause a denial of service (crash) via a single byte to (1) db2ccs.exe on port 6790, or (2) db2jds.exe on port 6789. ibm-db2-ccs-dos(6832) ibm-db2-jds-dos(6833) 20010711 IBM Windows DB2 DoS 3010 Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request. mcafee-mycio-directory-traversal(6834) VU#190267 20010716 McAfee ASaP Virusscan - MyCIO HTTP Server Directory Traversal Vul nerability 20010711 McAfee ASaP Virusscan - myCIO HTTP Server Directory Traversal Vulnerabilty 3020 fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories. FreeBSD-SA-01:40 NetBSD-SA2001-016 bsd-fts-race-condition(8715) 20010530 029: SECURITY FIX: May 30, 2001 3205 AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 creates temporary files with predictable names, which allows local users to modify files via a symlink attack. ESA-20010711-01 3016 allcommerce-temp-symlink(6830) The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pam_limits. M-009 utillinux-pamlimits-gain-privileges(7266) MDKSA-2001:084 SuSE-SA:2001:034 RHSA-2001:132 20011008 pam_limits.so Bug!! 3415 Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh, (2) auditsh, (3) authsh, (4) backupsh, (5) lpsh, (6) sysadm.menu, or (7) termsh. CSSA-2001-SCO.25 20010613 SCO atcronsh auditsh termsh overflows openserver-scoadmin-sysadm-bo(7281) Panda Antivirus Platinum before 6.23.00 allows a remore attacker to cause a denial of service (crash) when a user selects an action for a malformed UPX packed executable file. 20010821 RE: Bug report -- Incident number 240649 Vulnerability in cgiWebupdate.exe in Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.5.2 through 3.5.4 allows remote attackers to read arbitrary files. officescan-iuser-read-files(7014) 20010822 [SNS Advisory No.38] Trend Micro Virus Buster (Ver.3.5x) Remote 20010824 [SNS Advisory No.40] TrendMicro OfficeScan Corp Edition ver.3.54 Remote read file of IUSER authority Vulnerability 3216 Trend Micro OfficeScan Corporate Edition (aka Virus Buster) 3.53 allows remote attackers to access sensitive information from the hotdownload directory without authentication, such as the ofcscan.ini configuration file, which contains a weakly encrypted password. 20011015 [SNS Advisory No.44] Trend Micro OfficeScan Corporate Edition(Virus Buster Corporate Edition) http://www.trendmicro.co.jp/esolution/solutionDetail.asp?solutionID=318 officescan-config-file-access(7286) Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters. http://www.mimesweeper.com/support/technotes/notes/1043.asp 20010905 Various problems in Baltimore WebSweeper URL filtering 3296 lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument. CSSA-2001-SCO.15 openunix-lpsystem-bo(7041) 3248 Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients. 20010830 Possible Denial of Service with PHP and Cyrus IMAP on BSDi 4.2 3260 cyrus-imap-php-dos(7053) TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing. FreeBSD-SA-01:56 TYPSoft FTP 0.95 allows remote attackers to cause a denial of service (CPU consumption) via a "../../*" argument to (1) STOR or (2) RETR. http://membres.lycos.fr/typsoft/eng/history.html typsoft-ftp-retr-stor-dos(7247) 20011008 [ASGUARD-LABS] TYPSoft FTP Server v0.95 STOR/RETR Denial of Service Vulnerability 3409 Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via (1) an extra leading < and one or more characters before the SCRIPT tag, or (2) tags using Unicode. 20010812 Various problems in Baltimore's WEBSweeper Script filter ing 3172 3173 Check Point VPN-1/FireWall-1 4.1 base.def contains a default macro, accept_fw1_rdp, which can allow remote attackers to bypass intended restrictions with forged RDP (internal protocol) headers to UDP port 259 of arbitrary hosts. 20010709 Check Point FireWall-1 RDP Bypass Vulnerability L-109 20010709 Check Point response to RDP Bypass CA-2001-17 20010712 RDP Bypass workaround for VPN-1/FireWall 4.1 SPx VU#310295 2952 fw1-rdp-bypass(6815) load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers to (1) view sensitive files via the config_php and data_dir options, and (2) execute arbitrary code by using options_order.php to upload a message that could be interpreted as PHP. 20010702 (SRADV00010) Remote command execution vulnerabilities in SquirrelMail squirrelmail-loadprefs-execute-code(6775) 2968 http://www.squirrelmail.org/changelog.php udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field. 20010618 udirectory from Microburst Technologies remote command execution 2884 udirectory-remote-command-execution(6706) Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script. lotus-domino-css(6789) VU#642239 20010702 Lotus Domino Server Cross-Site Scripting Vulnerability 20010702 Re: Lotus Domino Server Cross-Site Scripting Vulnerability 2962 Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file. 20011002-01-P L-105 CLA-2001:405 IMNX-2001-70-027-01 http://us1.samba.org/samba/whatsnew/macroexploit.html CSSA-2001-024.0 DSA-065 MDKSA-2001-062 RHSA-2001:086 HPSBUX0107-157 20010623 smbd remote file creation vulnerability 2928 samba-netbios-file-creation(6731) Buffer overflow in Munica Corporation NetSQL 1.0 allows remote attackers to execute arbitrary code via a long CONNECT argument to port 6500. 2885 Buffer overflow in uucp utilities in UnixWare 7 allows local users to execute arbitrary code via long command line arguments to (1) uucp, (2) uux, (3) bnuconvert, (4) uucico, (5) uuxcmd, or (6) uuxqt. CSSA-2001-SCO.4 Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which allows local users to gain privileges by decrypting the information, e.g., with the Disengage tool. fileguard-weak-password-encryption(7018) http://www.securemac.com/fileguard.php#disengage 3213 linprocfs on FreeBSD 4.3 and earlier does not properly restrict access to kernel memory, which allows one process with debugging rights on a privileged process to read restricted memory from that process. FreeBSD-SA-01:55 linprocfs-process-memory-leak(7017) 3217 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2001-0976. Reason: This candidate is a duplicate of CVE-2001-0976. Notes: CVE-2001-0976 should be used instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Directory traversal vulnerability in index.php in PhpMyExplorer before 1.2.1 allows remote attackers to read arbitrary files via a ..%2F (modified dot dot) in the chemin parameter. 20010829 eRisk Security Advisory: PhpMyExplorer vulnerable to directory traversal. 20010830 Re: eRisk Security Advisory: PhpMyExplorer vulnerable to directory traversal. keyinit in S/Key does not require authentication to initialize a one-time password sequence, which allows an attacker who has gained privileges to a user account to create new one-time passwords for use in other activities that may use S/Key authentication, such as sudo. 20010902 S/Key keyinit(1) authentication (lack thereof) + sudo(1) AmTote International homebet program stores the homebet.log file in the homebet/ virtual directory, which allows remote attackers to steal account and PIN numbers. 20010929 Vulnerability in Amtote International homebet self service wagering system. 3370 homebet-view-logfile(7186) Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy. 20010907 Bug in compile portion for older versions of CheckPoint Firewalls OmniSecure HTTProtect 1.1.1 allows a superuser without omnish privileges to modify a protected file by creating a symbolic link to that file. 20010719 [SNS Advisory No.37] HTTProtect allows attackers to change the protected file using a symlink http://www.omnisecure.com/security-alert.html httprotect-protected-file-symlink(6880) Vulnerability in MasqMail before 0.1.15 allows local users to gain privileges via piped aliases. ftp://innominate.org/oku/masqmail/ChangeLog-stable Buffer overflow in Elm 2.5.5 and earlier allows remote attackers to execute arbitrary code via a long Message-ID header. MDKSA-2001:067 RHSA-2001:091 elm-messageid-bo(6852) vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing. RHSA-2001:095 RHSA-2001:132 3036 vipw-world-readable-files(6851) Format string vulnerability in Check Point VPN-1/FireWall-1 4.1 allows a remote authenticated firewall administrator to execute arbitrary code via format strings in the control connection. 20010712 VPN-1/FireWall-1 Format Strings Vulnerability http://www.checkpoint.com/techsupport/alerts/format_strings.html 3021 fw1-management-format-string(6849) ml85p in Samsung ML-85G GDI printer driver before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. 20010717 Samsung ML-85G Printer Linux Helper/Driver Binary Exploit (Mandrake: ghostscript package) 3008 samsung-printer-temp-symlink(6845) Buffer overflow in xman allows local users to gain privileges via a long MANPATH environment variable. 20010711 suid xman 3.1.6 overflows 3030 xfree86-xman-manpath-bo(6853) xman allows local users to gain privileges by modifying the MANPATH to point to a man page whose filename contains shell metacharacters. 20010717 xman (suid) exploit, made easier. FreeBSD 4.3 does not properly clear shared signal handlers when executing a process, which allows local users to gain privileges by calling rfork with a shared signal handler, having the child process execute a setuid program, and sending a signal to the child. FreeBSD-SA-01:42 20010710 FreeBSD 4.3 local root, yet Linux and *BSD much better than Windows L-111 VU#943633 3007 bsd-rfork-signal-handlers(6829) Dynamically Loadable Kernel Module (dlkm) static kernel symbol table in HP-UX 11.11 is not properly configured, which allows local users to gain privileges. HPSBUX0107-159 L-115 hpux-dlkm-gain-privileges(6861) oval:org.mitre.oval:def:5479 Vulnerability in login in HP-UX 11.00, 11.11, and 10.20 allows restricted shell users to bypass certain security checks and gain privileges. HPSBUX0107-160 oval:org.mitre.oval:def:5657 PPTP implementation in Cisco IOS 12.1 and 12.2 allows remote attackers to cause a denial of service (crash) via a malformed packet. 20010712 Cisco IOS PPTP Vulnerability VU#656315 3022 cisco-ios-pptp-dos(6835) wrshdsp.exe in Denicomp Winsock RSHD/NT 2.21.00 and earlier allows remote attackers to cause a denial of service (CPU consumption) via (1) in 2.20.00 and earlier, an invalid port number such as a negative number, which causes a connection attempt to that port and all ports below 1024, and (2) in 2.21.00, a port number of 1024. 20011213 WRSHDNT 2.21.00 CPU overusage http://www.denicomp.com/rshdnt.htm winsock-rshdnt-error-dos(7694) 20011208 Winsock RSHD/NT 2.20.00 CPU overusage when invalid data is send 3659 Some AIO operations in FreeBSD 4.4 may be delayed until after a call to execve, which could allow a local user to overwrite memory of the new process and gain privileges. bsd-aio-overwrite-memory(7693) 20011210 AIO vulnerability 3661 Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents IIS from timing out the connection. 20011211 Microsoft IIS/5 bogus Content-length bug Memory attack 20011212 Microsoft IIS/5.0 Content-Length DoS (proved) iis-false-content-length-dos(7691) 20011211 Microsoft IIS/5 bogus Content-length bug. 3667 csvform.pl 0.1 allows remote attackers to execute arbitrary commands via metacharacters in the file parameter. 20011211 CSVForm (Perl CGI) Remote Execution Vulnerability csvform-cgi-execute-commands(7692) 3668 mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, email, server, subject, and resulturl hidden form fields. 20011211 SPAMMERS DELIGHT: as feeble as feeble can be 3669 IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script. websphere-java-plaintext-passwords(7698) 20011213 IBM WebSphere on UNIX security alert ! 3682 The default PAM files included with passwd in Mandrake Linux 8.1 do not support MD5 passwords, which could result in a lower level of password security than intended. linux-passwd-weak-encryption(7706) MDKSA-2001:091 3683 WebSeal in IBM Tivoli SecureWay Policy Director 3.8 allows remote attackers to cause a denial of service (crash) via a URL that ends in %2e. 20011211 Webseal 3.8 3685 Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is downloaded and automatically executed by the client. 20011213 Kikkert Security Advisory: Potentially serious security flaw in Citrix Client 3688 citrix-ica-gain-root(7697) Directory traversal vulnerability in EFTP 2.0.8.346 allows local users to read directories via a ... (modified dot dot) in the CWD command. http://www.eftp.org/releasehistory.html VU#413875 20011213 EFTP 2.0.8.346 directory content disclosure 3691 eftp-dot-directory-traversal(7699) Zyxel Prestige 681 and 1600 SDSL Routers allow remote attackers to cause a denial of service via malformed packets with (1) an IP length less than actual packet size, or (2) fragmented packets whose size exceeds 64 kilobytes after reassembly. 20011214 Zyxel Prestige 681 and 1600 (possibly other?) remote DoS 20011218 Re: Zyxel Prestige 681 and 1600 (possibly other?) remote DoS 3695 prestige-dsl-packet-length-dos(7704) Novell Groupwise 5.5 and 6.0 Servlet Gateway is installed with a default username and password for the servlet manager, which allows remote attackers to gain privileges. http://support.novell.com/cgi-bin/search/searchtid.cgi?/10067329.htm groupwise-servlet-manager-default(7701) 20011215 Novell Groupwise servlet gateway default username and password 3697 Directory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argument. 20011218 Re: webmin 0.91 ../.. problem webmin-dot-directory-traversal(7711) 20011217 webmin 0.91 ../.. problem 3698 klprfax_filter in KDE2 KDEUtils allows local users to overwrite arbitrary files via a symlink attack on the klprfax.filter temporary file. 20011214 Re: klprfax_filter symlink vulnerability 20011214 klprfax_filter symlink vulnerability 3694 kdeutils-klprfax-symlink(7700) RLPDaemon in HP-UX 10.20 and 11.0 allows local users to overwrite arbitrary files and gain privileges by specifying the target file in the -L option. hp-rlpd-create-log(7729) 20011215 HP-UX setuid rlpdaemon induced to make illicit file writes 3701 oval:org.mitre.oval:def:5763 Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug mode is enabled, allows remote attackers to execute Javascript on other clients via the cart_id parameter. http://www.agoracgi.com/security.html agora-cgi-css(7708) 20011217 Agoracgi v3.3e Cross Site Scripting Vulnerability 3702 Microsoft Windows XP allows local users to bypass a locked screen and run certain programs that are associated with Hot Keys. winxp-hotkey-execute-programs(7713) 20011217 Hot keys permissions bypass under XP 3703 Buffer overflow in wmcube-gdk for WMCube/GDK 0.98 allows local users to execute arbitrary code via long lines in the object description file. 20011217 New Advisory + Exploit 20011218 wmcube-gdk is vulnerable to a local exploit wmcubegdk-object-file-bo(7720) http://www.ne.jp/asahi/linux/timecop/software/wmcube-gdk-0.98p2.tar.gz 3706 Cross-site scripting vulnerability in DeleGate 7.7.0 and 7.7.1 does not quote scripting commands within a "403 Forbidden" error page, which allows remote attackers to execute arbitrary Javascript on other clients via a URL that generates an error. 20011228 DeleGate Cross Site Scripting Vulnerability delegate-proxy-css(7745) 3749 Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges. DSA-095 3750 linux-gpm-format-string(7748) Directory traversal vulnerability in phprocketaddin in Total PC Solutions PHP Rocket Add-in for FrontPage 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. 20011228 PHP Rocket Add-in (file transversal vulnerability) 3751 phprocket-directory-traversal(7749) Directory traversal vulnerability in lastlines.cgi for Last Lines 2.0 allows remote attackers to read arbitrary files via '..' sequences in the $error_log variable. 20011230 lastlines.cgi path traversal and command execution vulns 3754 Matrix CGI vault Last Lines 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the $error_log variable. 20011230 lastlines.cgi path traversal and command execution vulns 3755 Buffer overflows in DayDream BBS 2.9 through 2.13 allow remote attackers to possibly execute arbitrary code via the control codes (1) ~#MC, (2) ~#TF, or (3) ~#RA. daydream-bbs-control-code-bo(7755) 3757 Format string vulnerability in DayDream BBS allows remote attackers to execute arbitrary code via format string specifiers in a file containing a ~#RA control code. 20011231 Daydream BBS Format strings issue. Directory traversal vulnerability in zml.cgi allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. 20011231 [VulnWatch] blackshell2: zml.cgi remote exploit 20011231 blackshell2: zml.cgi remote exploit zml-cgi-directory-traversal(7751) http://www.jero.cc/zml/zml.html 3759 Cisco ubr900 series routers that conform to the Data-over-Cable Service Interface Specifications (DOCSIS) standard must ship without SNMP access restrictions, which can allow remote attackers to read and write information to the MIB using arbitrary community strings. 20011230 Possible security problem with Cisco ubr900 series routers 20020103 Security Problem in Cisco ubr900 Series Routers cisco-docsis-default-strings(7806) 3758 Ipswitch IMail 7.0.4 and earlier allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server via the (1) aliasadmin or (2) listadm1 CGI programs, which do not properly verify that an administrator is the administrator for the target domain. http://support.ipswitch.com/kb/IM-20011219-DM01.htm http://support.ipswitch.com/kb/IM-20020301-DM02.htm imail-admin-domain-change(7752) 20011231 IMail Web Service User Aliases / Mailing Lists Admin Vulnerability 3766 Cross-site scripting vulnerability in catgy.cgi for Aktivate 1.03 allows remote attackers to execute arbitrary Javascript via the desc parameter. aktivate-shopping-css(7717) 3714 The default configuration of DataWizard FtpXQ 2.0 and 2.1 includes a default username and password, which allows remote attackers to read and write arbitrary files in the root folder. ftpxq-default-permissions(7715) 20011218 FTPXQ default install read/write capabilities 3716 manual.php in Marcus S. Xenakis Unix Manual 1.0 allows remote attackers to execute arbitrary code via a URL that contains shell metacharacters. unixmanual-php-command-execution(7719) VU#672419 20011215 *ALERT* "Unix Manual" PHP-Script allows arbitrary code execution 3718 Format string vulnerability in PFinger 0.7.5 through 0.7.7 allows remote attackers to execute arbitrary code via format string specifiers in a .plan file. pfinger-plan-format-string(7742) 20011220 [CERT-intexxia] pfinger Format String Vulnerability 3725 http://www.xelia.ch/unix/pfinger/ChangeLog Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page. http://otn.oracle.com/deploy/security/pdf/modplsql.pdf oracle-appserver-modplsql-bo(7727) VU#500203 20011221 Buffer Overflow in Oracle 9iAS (#NISR20122001) 3726 Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences. http://otn.oracle.com/deploy/security/pdf/modplsql.pdf oracle-appserver-modplsql-traversal(7728) VU#758483 20011221 Buffer Overflow in Oracle 9iAS (#NISR20122001) 3727 Microsoft Internet Explorer for Unix 5.0SP1 allows local users to possibly cause a denial of service (crash) in CDE or the X server on Solaris 2.6 by rapidly scrolling Chinese characters or maximizing the window. 20011220 E5 (SP1) crash the X server on Solaris2.6 chinese edition 3729 Microsoft Internet Explorer 6.0 and earlier allows malicious website operators to cause a denial of service (client crash) via JavaScript that continually refreshes the window via self.location. 20011220 MSIE DoS Using javascript 3730 D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remote attackers to gain administrative privileges. dlink-ap-public-mib(7733) 20011221 D-Link DWL-1000AP can be compromised because of SNMP configuration 3735 D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'public' which allows remote attackers to gain sensitive information. 20011221 D-Link DWL-1000AP can be compromised because of SNMP configuration 3736 Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the target's IP address and a valid account name for the domain. psa-php-reveal-source(7735) 20011221 twlc advisory: plesk (psa) allows reading of .php files 3737 The web administration server for ELSA Lancom 1100 Office does not require authentication, which allows arbitrary remote attackers to gain administrative privileges by connecting to the server. elsa-lancom-web-administration(7739) 20011226 Phoenix Sistemi Security Advisory: ELSA Lancom 1100 Office Security Problems 3746 get_input in adrotate.pm for Les VanBrunt AdRotate Pro 2.0 allows remote attackers to modify the database and possibly execute arbitrary commands via a SQL code injection attack. adrotate-sql-execute-commands(7736) 20011223 GOBBLES CGI MARATHON #001 3739 Hughes Technology Mini SQL 2.0.10 through 2.0.12 allows local users to cause a denial of service by creating a very large array in a table, which causes miniSQL to crash when the table is queried. msql-char-array-dos(7746) 20011226 msql DoS 3742 AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database. adcycle-modify-sql-query(7762) 20011225 GOBBLES CGI MARATHON #002 3741 Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags. MDKSA-2001:080 RHSA-2001:072 RHSA-2001:115 3425 zope-fmt-access-methods(7271) Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server. NetBSD-SA2002-002 20011230 gzip bug w/ patch.. gzip-long-filename-bo(7882) 3712 Buffer overflows in (1) Icecast before 1.3.9 and (2) libshout before 1.0.4 allow remote attackers to cause a denial of service (crash) and execute arbitrary code. CLA-2001:387 20010312 Icecast / Libshout remote vulnerabilities RHSA-2002:063 Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service (crash) and execute arbitrary code. 20010313 More Icecast remote vulnerabilities DSA-089 RHSA-2002:063 GroupWise 5.5 and 6 running in live remote or smart caching mode allows remote attackers to read arbitrary users' mailboxes by extracting usernames and passwords from sniffed network traffic, as addressed by the "Padlock" fix. http://support.novell.com/padlock/details.htm 20010814 Fwd: Security Alert: Groupwise - Action Required 3189 novell-groupwise-admin-privileges(6998) GroupWise WebAccess 5.5 with directory indexing enabled allows a remote attacker to view arbitrary directory contents via an HTTP request with a lowercase "get". 20010815 Groupwise Webaccess, NetWare web server, and Novell 3188 netware-get-directory-listing(6988) Netware Enterprise Web Server 5.1 running GroupWise WebAccess 5.5 with Novell Directory Services (NDS) enabled allows remote attackers to enumerate user names, group names and other system information by accessing ndsobj.nlm. 20010815 Groupwise Webaccess, NetWare web server, and Novell netware-nds-information-leak(6987) Bharat Mediratta Gallery PHP script before 1.2.1 allows remote attackers to execute arbitrary code by including files from remote web sites via an HTTP request that modifies the includedir variable. 20011002 results of semi-automatic source code audit http://prdownloads.sourceforge.net/gallery/gallery-1.2.5.tar.gz php-includedir-code-execution(7215) 3397 pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable. 20011002 results of semi-automatic source code audit php-includedir-code-execution(7215) VU#847803 3395 myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable. 20011002 results of semi-automatic source code audit php-includedir-code-execution(7215) VU#847803 3394 Phormation PHP script 0.9.1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the phormationdir variable. 20011002 results of semi-automatic source code audit php-includedir-code-execution(7215) VU#847803 http://www.peaceworks.ca/phormation/phormation-0.9.2.tar.gz 3393 Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped with the Task Manager. 20010716 W2k: Unkillable Applications 3033 win2k-taskmanager-unkillable-process(6919) PowerNet IX allows remote attackers to cause a denial of service via a port scan. 2992 The default configuration of sudo in Engarde Secure Linux 1.0.1 allows any user in the admin group to run certain commands that could be leveraged to gain full root access. ESA-20010711-02 Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "#!" and the desired program name. 20010717 multiple vulnerabilities in un-cgi 20010718 Re: [Khamba Staring <purrcat@edoropolis.org>] multiple uncgi-unexecutable-cgi(6847) http://www.midwinter.com/~koreth/uncgi.html http://www.midwinter.com/~koreth/uncgi-changes.html 3057 Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an HTML form. 20010717 multiple vulnerabilities in un-cgi 20010718 Re: [Khamba Staring <purrcat@edoropolis.org>] multiple vulnerabilities in un-cgi uncgi-dot-directory-traversal(6846) http://www.midwinter.com/~koreth/uncgi-changes.html 3056 Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject. iis-device-asp-dos(6800) 20010704 NERF Advisory #4: MS IIS local and remote DoS 2973 Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process. 20010708 Small TCP packets == very large overhead == DoS? 2997 tcp-mss-dos(6824) Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly with a header whose value is the same as a MIME header name. 20010712 Re: Opera Browser Heap Overflow (Session Replay Attack) opera-browser-header-bo(6838) 3012 PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters. 20010630 php breaks safe mode php-safemode-elevate-privileges(6787) http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz RHSA-2002:102 RHSA-2002:129 RHSA-2003:159 2954 PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files. 20010630 php breaks safe mode http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz RHSA-2002:035 vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character (%20). 20010629 4 New vulns. vWebServer and SmallHTTP vwebserver-asp-reveal-source(6769) 2975 vWebServer 1.2.0 allows remote attackers to cause a denial of service via a URL that contains MS-DOS device names. 20010629 4 New vulns. vWebServer and SmallHTTP 2978 vWebServer 1.2.0 allows remote attackers to cause a denial of service (hang) via a small number of long URL requests, possibly due to a buffer overflow. 20010629 4 New vulns. vWebServer and SmallHTTP vwebserver-long-url-dos(6771) 2979 SmallHTTP 1.204 through 3.00 beta 8 allows remote attackers to cause a denial of service via multiple long URL requests. 20010629 4 New vulns. vWebServer and SmallHTTP vwebserver-long-url-dos(6771) 2980 Network Associates PGP Keyserver 7.0 allows remote attackers to bypass authentication and access the administrative web interface via URLs that directly access cgi-bin instead of keyserver/cgi-bin for the programs (1) console, (2) cs, (3) multi_config and (4) directory. 20010928 SNS-43: PGP Keyserver Permissions Misconfiguration pgp-keyserver-http-dos(7203) http://www.pgp.com/support/product-advisories/keyserver.asp 3375 Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users. 20010927 Two problems with Alexis/InternetPBX from COM2001 alexis-http-plaintext-information(7205) Web Access component for COM2001 Alexis 2.0 and 2.1 in InternetPBX sends username and voice mail passwords in the clear via a Java applet that sends the information to port 8888 of the server, which could allow remote attackers to steal the passwords via sniffing. 20010927 Two problems with Alexis/InternetPBX from COM2001 3373 WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database. 20011002 WinMySQLadmin 1.1 Store MySQL password in clear text winmysqladmin-password-plaintext(7206) 3381 kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files. L-093 HPSBUX0106-153 VU#127435 http://www.kb.cert.org/vuls/id/TJSL-4Z5Q92 20010604 yet another sym link followers 2821 hpux-kmmodreg-symlink(6656) oval:org.mitre.oval:def:5628 Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email. CLA-2001:410 http://online.securityfocus.com/archive/1/198495 CSSA-2001-027.0 DSA-073 imp-cross-site-scripting(6905) 3082 Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server. CLA-2001:410 http://online.securityfocus.com/archive/1/198495 CSSA-2001-027.0 DSA-073 imp-prefslang-gain-privileges(6906) 3083 Avaya Argent Office allows remote attackers to cause a denial of service by sending UDP packets to port 53 with no payload. 20010807 Multiple vulnerabilities in Avaya Argent Office argent-office-udp-dos(6953) Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator privileges by sniffing and decrypting the sniffing the passwords during a system reboot. 20010807 Multiple vulnerabilities in Avaya Argent Office argent-office-weak-encryption(6954) Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file. 20010807 Multiple vulnerabilities in Avaya Argent Office argent-office-change-music(6956) Avaya Argent Office 2.1 compares a user-provided SNMP community string with the correct string only up to the length of the user-provided string, which allows remote attackers to bypass authentication with a 0 length community string. 20010807 Multiple vulnerabilities in Avaya Argent Office argent-office-community-string(6955) telnet95.exe in Pragma InterAccess 4.0 build 5 allows remote attackers to cause a denial of service (crash) via a large number of characters to port 23, possibly due to a buffer overflow. 20010606 advisory for Pragma Interaccess 2834 pragma-interaccess-dos(6658) Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges. L-119 VU#420475 HPSBUX0107-161 3072 hp-virtualvault-mkacct-privilege-elevation(6867) Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a .. (dot dot) attack. 20010720 IBM TFTP Server for Java vulnerability 3076 ibm-tftp-directory-traversal(6864) Directory traversal vulnerability in Doug Neal's HTTPD Daemon (DNHTTPD) before 0.4.1 allows remote attackers to view arbitrary files via a .. (dot dot) attack using the dot hex code '%2E'. http://archives.neohapsis.com/archives/apps/freshmeat/2001-07/0002.html http://dnhttpd.sourceforge.net/changelog.html Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot). ftp://alpha.gnu.org/gnu/tar/tar-1.13.25.tar.gz CLA-2002:538 HPSBTL0209-068 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers 47800 archive-extraction-directory-traversal(10224) MDKSA-2002:066 RHSA-2002:096 RHSA-2002:138 RHSA-2003:218 3024 Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename. 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers 47800 1000928 http://www.info-zip.org/pub/infozip/UnZip.html Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character. 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers 47800 1000928 http://www.info-zip.org/pub/infozip/UnZip.html Directory traversal vulnerability in the console version of PKZip (pkzipc) 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec (recursive) option via a .. (dot dot) attack on the archived files. 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers http://www.security.nnov.ru/advisories/archdt.asp Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) attack on archived filenames. 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers http://www.security.nnov.ru/advisories/archdt.asp wmtv 0.6.5 and earlier does not properly drop privileges, which allows local users to execute arbitrary commands via the -e (external command) option. DSA-092 wmtv-execute-commands(7669) 3658 The "mxcsr P4" vulnerability in the Linux kernel before 2.2.17-14, when running on certain Intel CPUs, allows local users to cause a denial of service (system halt). L-045 RHSA-2001:013 Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges. CLA-2001:375 FreeBSD-SA-01:16 CSSA-2001-006.0 DSA-013 MDKSA-2001:014 http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.3 RHSA-2001:003 MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking. FreeBSD-SA-01:16 CSSA-2001-006.0 MDKSA-2001:014 RHSA-2001:003 ispell before 3.1.20 allows local users to overwrite files of other users via a symlink attack on a temporary file. IMNX-2001-62-004-01 20010621 ispell update -- Immunix OS 6.2 MDKSA-2001:058 RHSA-2001:074 makewhatis in the man package before 1.5i2 allows an attacker in group man to overwrite arbitrary files via a man page whose name contains shell metacharacters. 20010611 man 1.5h10 + man 1.5i-4 exploits RHSA-2001:072 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=41805 Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags. MDKSA-2001:080 RHSA-2001:115 3425 Buffer overflow in print-rx.c of tcpdump 3.x (probably 3.6x) allows remote attackers to cause a denial of service and possibly execute arbitrary code via AFS RPC packets with invalid lengths that trigger an integer signedness error, a different vulnerability than CVE-2000-1026. CSSA-2002-025.0 FreeBSD-SA-01:48 CLA-2002:480 tcpdump-afs-rpc-bo(7006) VU#797201 MDKSA-2002:032 RHSA-2001:089 3065 POP3 Server for Ipswitch IMail 7.04 and earlier generates different responses to valid and invalid user names, which allows remote attackers to determine users on the system. 20011011 Vulnerabilities in Ipswitch IMail Server 7.04 http://www.ipswitch.com/Support/IMail/news.html 3424 Web Messaging Server for Ipswitch IMail 7.04 and earlier allows remote authenticated users to change information for other users by modifying the olduser parameter in the "Change User Information" web form. 20011011 Vulnerabilities in Ipswitch IMail Server 7.04 http://www.ipswitch.com/Support/IMail/news.html 3429 Ipswitch IMail 7.04 and earlier records the physical path of attachments in an e-mail message header, which could allow remote attackers to obtain potentially sensitive configuration information. 20011011 Ipswitch Imail 7.04 vulnerabilities http://www.ipswitch.com/Support/IMail/news.html 3426 The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service (crash) via a mailbox name that contains a large number of . (dot) or other characters to programs such as (1) readmail.cgi or (2) printmail.cgi, possibly due to a buffer overflow that may allow execution of arbitrary code. 20011011 Ipswitch Imail 7.04 vulnerabilities http://www.ipswitch.com/Support/IMail/news.html 3427 Ipswitch IMail 7.04 and earlier uses predictable session IDs for authentication, which allows remote attackers to hijack sessions of other users. 20011011 Ipswitch Imail 7.04 vulnerabilities http://www.ipswitch.com/Support/IMail/news.html 3428 Directory traversal vulnerability in readmail.cgi for Ipswitch IMail 7.04 and earlier allows remote attackers to access the mailboxes of other users via a .. (dot dot) in the mbx parameter. 20011011 Ipswitch Imail 7.04 vulnerabilities http://www.ipswitch.com/Support/IMail/news.html 3432 Ipswitch IMail 7.04 and earlier stores a user's session ID in a URL, which could allow remote attackers to hijack sessions by obtaining the URL, e.g. via an HTML email that causes the Referrer to be sent to a URL under the attacker's control. 20011011 Ipswitch Imail 7.04 vulnerabilities 20020310 IMail Account hijack through the Web Interface http://www.ipswitch.com/Support/IMail/news.html 3432 Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. 20011012 def-2001-29 http://www.ipswitch.com/Support/IMail/news.html 3431 Windows 2000 and Windows NT allows local users to cause a denial of service (reboot) by executing a command at the command prompt and pressing the F7 and enter keys several times while the command is executing, possibly related to an exception handling error in csrss.exe. 20010729 Re: w2k dos 20010730 RE: bug w2k 20010727 bug w2k 20010731 NT TS / Win 2K and F7 - Enter bug 20010801 F7-Enter bug details & workaround 3115 Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins with several char-255 characters. 20010730 ADV: Quake 3 Arena 1.29f/g Vulnerability 3123 admin.cgi in Active Classifieds Free Edition 1.0, and possibly commercial versions, allows remote attackers to modify the configuration, gain privileges, and execute arbitrary Perl code via the table_width parameter. 20010627 Active Web Classifieds failure to authenticate leads to arbitrary code execution 2942 active-classifieds-admin-access(6754) The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing. 20010712 3Com TelnetD 3034 3com-telnetd-brute-force(6855) Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password. 20010813 Sambar Telnet Proxy/Server multiple vulnerablietis sambar-telnet-bo(6973) Buffer overflow in web server of 3com HomeConnect Cable Modem External with USB (#3CR29223) allows remote attackers to cause a denial of service (crash) via a long HTTP request. 20010926 3Com(r) HomeConnect(r) Cable Modem Denial of Service VU#500027 3366 Buffer overflow in A-V Tronics Inetserv 3.2.1 and earlier allows remote attackers to cause a denial of service (crash) in the Webmail interface via a long username and password. inetserv-webmail-bo(7022) 20000117 Remote Buffer Exploit - InetServ 3.0 3224 Directory traversal vulnerability in Cerberus FTP Server 1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the CD command. http://www.greenepa.net/~averett/cerberus-releasenotes.htm#ReleaseNotes cerberus-ftp-directory-traversal(7004) http://www.securiteam.com/windowsntfocus/5SP0M0055W.html More.groupware PHP script allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit php-includedir-code-execution(7215) http://www.moregroupware.org/index.php?action=detail&news_id=24 3383 PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter. 20011002 results of semi-automatic source code audit http://sourceforge.net/project/shownotes.php?release_id=58331 php-includedir-code-execution(7215) 3384 Webodex PHP script 1.0 and earlier allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit php-includedir-code-execution(7215) 3385 Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable. 20011002 results of semi-automatic source code audit http://www.come.to/zorbat/ php-includedir-code-execution(7215) VU#847803 http://www.kb.cert.org/vuls/id/JARL-53RJKV 3386 Directory traversal vulnerability in Dynu FTP server 1.05 and earlier allows remote attackers to read arbitrary files via a .. in the CD (CWD) command. dynuftp-dot-directory-traversal(7045) http://www.securiteam.com/windowsntfocus/5KP0N0A55M.html rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users via a symlink attack on a temporary file. 20010807 rcs2log http://savannah.gnu.org/cgi-bin/viewcvs/emacs/emacs/lib-src/rcs2log?only_with_tag=EMACS_PRETEST_21_0_95 rcs2log-tmp-symlink(11210) The change password option in the Windows Security interface for Windows 2000 allows attackers to use the option to attempt to change passwords of other users on other systems or identify valid accounts by monitoring error messages, possibly due to a problem in the NetuserChangePassword function. 20010718 Changing NT/2000 accounts password from the command line 3063 win2k-change-network-passwords(6876) The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication. 20010718 Firewall-1 Information leak 3058 fw1-securemote-gain-information(6857) Buffer overflow in SHOUTcast Server 1.8.2 allows remote attackers to cause a denial of service (crash) via several HTTP requests with a long (1) user-agent or (2) host HTTP header. 20010803 Denial of Service in SHOUTcast Server 1.8.2 Linux/w32/? shoutcast-http-field-bo(6938) ICQ 2001a Alpha and earlier allows remote attackers to automatically add arbitrary UINs to an ICQ user's contact list via a URL to a web page with a Content-Type of application/x-icq, which is processed by Internet Explorer. 20010822 Hexyn / Securax Advisory #22 - ICQ Forced Auto-Add Users icq-auto-add-user(7028) 3226 iPlanet Directory Server 4.1.4 and earlier (LDAP) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid BER length of length fields, as demonstrated by the PROTOS LDAPv3 test suite. 20011102-01-I CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#276944 http://www.kb.cert.org/vuls/id/JPLA-4WESMM Buffer overflows in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. 20011102-01-I CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#276944 http://www.kb.cert.org/vuls/id/JPLA-4WESMM 3038 iplanet-ldap-protos-bo(6893) Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. 20011102-01-I L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#276944 http://www.kb.cert.org/vuls/id/JPLA-4WESMM 3039 iplanet-ldap-protos-format-string(6898) Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#505564 http://www.kb.cert.org/vuls/id/CFCR-4YQ33Y 3040 secureway-ldap-protos-dos(6894) IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for the L field of a BER encoding, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#505564 http://www.kb.cert.org/vuls/id/CFCR-4YQ33Y 3040 secureway-ldap-protos-dos(6894) Buffer overflows in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#583184 http://www.notes.net/r5fixlist.nsf/Search!SearchView&Query=DWUU4W6NC8 20030313 R7-0012: Lotus Notes/Domino R6-beta PROTOS LDAP Denial of Service Regression 3041 domino-ldap-protos-bo(6895) Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#583184 http://www.notes.net/r5fixlist.nsf/Search!SearchView&Query=DWUU4W6NC8 3042 domino-ldap-protos-format-string(6896) Lotus Domino R5 before R5.0.7a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via miscellaneous packets with semi-valid BER encodings, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#583184 http://www.notes.net/r5fixlist.nsf/Search!SearchView&Query=DWUU4W6NC8 Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. 20010731 RE: CERT Advisory CA-2001-18, Critical Path directory products ar e vulnerable L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#657547 http://www.kb.cert.org/vuls/id/JPLA-4ZKLEM 3124 Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed BER encodings, as demonstrated by the PROTOS LDAPv3 test suite. 20010731 RE: CERT Advisory CA-2001-18, Critical Path directory products ar e vulnerable L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#657547 http://www.kb.cert.org/vuls/id/JPLA-4ZKLEM Buffer overflows in Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#688960 http://www.kb.cert.org/vuls/id/JPLA-4WESNA 3044 teamware-ldap-protos-bo(6897) Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for certain BER object types, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#688960 http://www.kb.cert.org/vuls/id/JPLA-4WESNA Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#717380 http://www.kb.cert.org/vuls/id/JPLA-4WESNA 3043 Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#763400 http://www.kb.cert.org/vuls/id/CFCN-4YAQC7 3045 exchange-ldap-protos-dos(6899) Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#765256 http://www.kb.cert.org/vuls/id/JPLA-4WESNK 3046 pgp-keyserver-ldap-bo(6900) Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER values, as demonstrated by the PROTOS LDAPv3 test suite. L-116 CA-2001-18 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ VU#869184 http://www.kb.cert.org/vuls/id/JPLA-4WESNV xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to read or modify files that are created by an application that runs under xinetd but does not set its own safe umask. CLA-2001:404 IMNX-2001-70-024-01 DSA-063 xinetd-insecure-permissions(6657) MDKSA-2001:055 ESA-20010621-01 RHSA-2001:075 2826 Buffer overflow in MIT Kerberos 5 (krb5) 1.2.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via base-64 encoded data, which is not properly handled when the radix_encode function processes file glob output from the ftpglob function. IMNX-2001-70-022-01 20010426 Security advisory: krb5 ftpd buffer overflows http://web.mit.edu/kerberos/www/advisories/ftpbuf.txt RHSA-2001:060 cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges. http://multivac.cwru.edu/idtools/admin_idtools.tar.bz2 1001839 2934 Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using an IFRAME tag, possibly due to a vulnerability in Windows Scripting Host (WSH). 20010420 XML scripting in IE, Outlook Express 2633 ie-xml-stylesheets-scripting(6448) Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in HTML content" option is disabled, via an HTML email with a form that is activated from an image that the attacker spoofs as a link, which causes the user to execute the form and access embedded attachments. 20010528 feeble.hey!dora.exploit part.II 2796 pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privileges by exploiting vulnerabilities in pmake or programs that are used by pmake. pmake-binary-gain-privileges(9988) TLSA2001024 Buffer overflow in ypbind daemon in Solaris 5.4 through 8 allows remote attackers to execute arbitrary code. AA-2001.03 00203 L-103 solaris-ypbind-bo(6828) oval:org.mitre.oval:def:1844 Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument. 20010611 rsh bufferoverflow on AIX 4.2 Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument. 20010611 rsh bufferoverflow on AIX 4.2 mandb in the man-db package before 2.3.16-3 allows local users to overwrite arbitrary files via the command line options (1) -u or (2) -c, which do not drop privileges and follow symlinks. http://online.securityfocus.com/advisories/3307 DSA-056 2720 Buffer overflows in Linux CUPS before 1.1.6 may allow remote attackers to execute arbitrary code. CLA-2001:384 CLA-2001:386 SuSE-SA:2002:005 MDKSA-2001:048 Linux CUPS before 1.1.6 does not securely handle temporary files, possibly due to a symlink vulnerability that could allow local users to overwrite files. CLA-2001:384 CLA-2001:386 SuSE-SA:2002:005 MDKSA-2001:048 Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block and specifying the target file as the source URL. 20010515 PHPSlash : potential vulnerability in URL blocks http://marc.info/?l=phpslash&m=99029398904419&w=2 phpslash-block-read-files(9990) 2724 Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary files via a GET with a filename that contains a ...%5c (modified dot dot). 20010527 CesarFTP v0.98b triple dot Directory Traversal / Weak password encryption cesarftp-directory-traversal(6606) 2786 CesarFTP 0.98b and earlier stores usernames and passwords in plaintext in the settings.ini file, which allows attackers to gain privileges. 20010527 CesarFTP v0.98b triple dot Directory Traversal / Weak password encryption cesarftp-settings-plaintext-password(6608) 2785 Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request. ipcchip-http-dos(6594) 20010524 IPC@Chip Security 2774 Beck IPC GmbH IPC@CHIP TelnetD server generates different responses when given valid and invalid login names, which allows remote attackers to determine accounts on the system. 20010602 IPC@Chip - Fixes ipcchip-telnet-verify-account(6595) VU#198979 20010524 IPC@Chip Security 2773 Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks. 20010602 IPC@Chip - Fixes ipcchip-telnet-bruteforce-passwords(6605) VU#198979 20010524 IPC@Chip Security 2771 Beck GmbH IPC@Chip TelnetD service supports only one connection and does not disconnect a user who does not complete the login process, which allows remote attackers to lock out the administrator account by connecting to the service. 20010602 IPC@Chip - Fixes ipcchip-telnet-admin-lockout(6596) VU#756019 20010524 IPC@Chip Security 2772 The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information via a request to the program. 20010602 IPC@Chip - Fixes ipcchip-chipcfg-gain-information(6600) VU#574739 20010524 IPC@Chip Security 2767 Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer. http://bugs.apache.org/index.cgi/full/7522 20010522 [Announce] Apache 1.3.20 Released 20010412 Apache Win32 8192 chars string bug http://www.apacheweek.com/issues/01-05-25 apache-server-dos(6527) 2740 ws_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter. 20010612 bug 2861 webstore-cgi-command-execution(6685) WSSecurity.pl in WebStore allows remote attackers to bypass authentication by providing the program with a filename that exists, which is made easier by (1) inserting a null character or (2) .. (dot dot). 20010612 bug 2860 webstore-cgi-command-execution(6685) bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program. 20010604 Fatal flaw in BestCrypt <= v0.7 (Linux) http://www.jetico.com/index.htm#/linux.htm 2820 bestcrypt-bctool-gain-privileges(6648) Computer Associates ARCserveIT 6.61 and 6.63 (also called ARCservIT) allows local users to overwrite arbitrary files via a symlink attack on the temporary files (1) asagent.tmp or (2) inetd.tmp. 20010518 tmp-races in ARCservIT Unix Client 2741 2748 Windows 2000 allows local users to cause a denial of service and possibly gain privileges by setting a hardware breakpoint that is handled using global debug registers, which could cause other processes to terminate due to an exception, and allow hijacking of resources such as named pipes. 20010524 Elevation of privileges with debug registers on Win2K win2k-debug-elevate-privileges(6590) 2764 TWIG 2.6.2 and earlier allows remote attackers to perform unauthorized database operations via a SQL injection attack on the id parameter. 20010528 TWIG SQL query bugs http://twig.screwdriver.net/index.php3 twig-webmail-query-modification(6619) 2791 Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers. http://archives.neohapsis.com/archives/sendmail/2001-q2/0001.html 20010528 Unsafe Signal Handling in Sendmail RHSA-2001:106 sendmail-signal-handling(6633) 20010529 sendmail 8.11.4 and 8.12.0.Beta10 available (fwd) 2794 Cross-site scripting vulnerability in namazu.cgi for Namazu 2.0.7 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the lang parameter. RHSA-2001:162 http://search.namazu.org/ml/namazu-devel-ja/msg02114.html Cross-site scripting vulnerability in Namazu 2.0.8 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the index file name that is displayed when displaying hit numbers. RHSA-2001:162 linux-namazu-css(7875) Cross-site scripting vulnerability in Namazu 2.0.9 and earlier allows remote attackers to execute arbitrary Javascript as other web users via an error message that is returned when an invalid index file is specified in the idxname parameter. 20011227 Re: [RHSA-2001:162-04] Updated namazu packages are available RHSA-2001:179 20020109 Details on the updated namazu packages that are available linux-namazu-css(7875) ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp' user via the file operator, even with -dSAFER enabled. HPSBUX0112-009 http://marc.info/?l=lprng&m=100083210910857&w=2 RHSA-2001:112 RHSA-2001:138 NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password. 20010720 NetWin Authentication Module 3.0b password storage vulnerabilities / buffer overflows 3075 netwin-nwauth-weak-encryption(6866) Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command. 20010720 NetWin Authentication Module 3.0b password storage vulnerabilities / buffer overflows 3077 netwin-nwauth-bo(6865) NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021. 20010804 SurgeFTP admin account bruteforcable surgeftp-weak-password-encryption(6961) 3157 Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown consequences, possibly related to user spoofing or improperly initialized variables. http://www.phpheaven.net/projects/phpMyChat/changes.php3 Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library file in the L (localization) parameter. http://www.phpheaven.net/projects/phpMyChat/changes.php3 Volution clients 1.0.7 and earlier attempt to contact the computer creation daemon (CCD) when an LDAP authentication failure occurs, which allows remote attackers to fully control clients via a Trojan horse Volution server. CSSA-2001-021.0 2850 volution-authentication-failure-access(6672) Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned. ftp://ftp.mostang.com/pub/sane/sane-1.0.8/sane-backends-1.0.8.tar.gz 20010719 [VulnWatch] Changelog maddness (14 various broken apps) Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links. 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://twig.screwdriver.net/file.php3?file=CHANGELOG Vulnerability in the server for nPULSE before 0.53p4. 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://freshmeat.net/releases/51981/ Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain administrative privileges. 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://phpwebsite.appstate.edu/downloads/0.7.9/phpWebSite-en-0.7.9.tar.gz Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified. ftp://ftp.earth.li/pub/projectpurple/autodns-0.0.4.tar.gz 20010719 [VulnWatch] Changelog maddness (14 various broken apps) Vulnerability in IntraGnat before 1.4. http://archives.neohapsis.com/archives/apps/freshmeat/2001-07/0011.html 20010719 [VulnWatch] Changelog maddness (14 various broken apps) netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information. 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://netscript.sourceforge.net/netscript-1.6.2.tgz The checkAccess function in PHPSlice 0.1.4, and all other versions between 0.1.1 and 0.1.6, does not properly verify the administrative access level, which could allow remote attackers to gain privileges. 20010719 [VulnWatch] Changelog maddness (14 various broken apps) http://phpslice.org/comments.php?aid=1031& phpslice-checkaccess-function-privileges(9649) Vulnerability in iPlanet Web Server 4 included in Virtualvault Operating System (VVOS) 4.0 running HP-UX 11.04 could allow attackers to corrupt data. HPSBUX0106-152 hp-virtualvault-iws-corrupt-data(6697) Leon J Breedt pam-pgsql before 0.5.2 allows remote attackers to execute arbitrary SQL code and bypass authentication or modify user account records by injecting SQL statements into user or password fields. FreeBSD-SA-02:14 postgresql-pam-authentication-module(7110) 3319 prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib. CSSA-2001-027.0 CLA-2001:410 20010726 TSLSA-2001-0014 - PHPLib 20010721 IMP 2.2.6 (SECURITY) released DSA-073 phplib-script-execution(6892) 20010722 [SEC] Hole in PHPLib 7.2 prepend.php3 3079 The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager. 20020206 Hackproofing Oracle Application Server paper http://technet.oracle.com/deploy/security/pdf/ias_soap_alert.pdf CA-2002-08 oracle-appserver-soap-components(8449) VU#736923 http://www.nextgenss.com/papers/hpoas.pdf 4289 Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message. 20010917 Yet another path disclosure vulnerability 20010921 Response to "Path disclosure vulnerability in Oracle 9i and 8i http://otn.oracle.com/deploy/security/pdf/jspexecute_alert.pdf CA-2002-08 VU#278971 http://www.nii.co.in/research.html 3341 oracle-jsp-reveal-path(7135) MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, which allows remote attackers to send potentially dangerous attachments. 20010718 ZoneAlarm Pro 3055 http://www.zonelabs.com/products/zap/rel_history.html#2.6.362 zonealarm-bypass-mailsafe(6877) expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd. CLA-2001:409 MDKSA-2002:060 RHSA-2002:148 3074 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=22187 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28224 expect-insecure-library-search(6870) tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory. CLA-2001:409 tcltk-insecure-library-search(6869) MDKSA-2002:060 RHSA-2002:148 3073 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28226 Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data. SuSE-SA:2002:013 CLA-2002:466 20020305 SECURITY.NNOV: few vulnerabilities in multiple RADIUS implementations 20011113 More problems with RADIUS (protocol and implementations) CA-2002-06 VU#589523 RHSA-2002:030 3530 radius-message-digest-bo(7534) Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2. FreeBSD-SN-02:02 SuSE-SA:2002:013 CLA-2002:466 20020305 SECURITY.NNOV: few vulnerabilities in multiple RADIUS implementations CA-2002-06 radius-vendor-attribute-dos(8354) VU#936683 RHSA-2002:030 4230 fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. http://lists.ccil.org/pipermail/fetchmail-announce/2001-March/000015.html RHSA-2001:103 The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name. FreeBSD-SA-02:03 20010829 [VulnWatch] RUS-CERT Advisory 2001-08:01 CLA-2001:427 20010829 RUS-CERT Advisory 2001-08:01 RHSA-2001:124 apache-postgresql-authentication-module(7054) 3251 3253 apache-postgresqlsys-authentication-module(7059) OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses. CLSA-2001:431 IMNX-2001-70-034-01 20010926 OpenSSH Security Advisory (adv.option) RHSA-2001:114 M-010 VU#905795 MDKSA-2001:081 3369 openssh-access-control-bypass(7179) The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used. http://www.openwall.com/Owl/CHANGES-stable.shtml initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized operations on files. RHSA-2001:110 linux-setserial-initscript-symlink(7177) 3367 ptrace in Linux 2.2.x through 2.2.19, and 2.4.x through 2.4.9, allows local users to gain root privileges by running ptrace on a setuid or setgid program that itself calls an unprivileged program, such as newgrp. CSSA-2001-036.0 IMNX-2001-70-035-01 20011018 Flaws in recent Linux kernels 20011019 TSLSA-2001-0028 HPSBTL0112-003 linux-ptrace-race-condition(7311) MDKSA-2001:079 MDKSA-2001:082 ESA-20011019-02 SuSE-SA:2001:036 RHSA-2001:129 RHSA-2001:130 3447 The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts. CLA-2001:373 20010112 PHP Security Advisory - Apache Module bugs DSA-020 php-view-source-code(5939) MDKSA-2001:013 RHSA-2000:136 2205 WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD's check for a ".lnk" extension. 20010701 WFTPD v3.00 R5 Directory Traversal 2957 ftp-lnk-directory-traversal(6760) iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak. http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=50500 RHSA-2001:144 iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users to generate more or less traffic than intended by the administrator. http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=53325 RHSA-2001:144 Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of service or execute arbitrary code, primarily via buffer overflows or improper NULL termination. IMNX-2001-70-033-01 20010830 xinetd 2.3.0 audit status RHSA-2001:109 MDKSA-2001:076 3257 Unknown vulnerability in binfmt_misc in the Linux kernel before 2.2.19, related to user pages. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:18 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Off-by-one vulnerability in CPIA driver of Linux kernel before 2.2.19 allows users to modify kernel memory. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 linux-cpia-memory-overwrite(11162) DSA-047 The Linux kernel before 2.2.19 does not have unregister calls for (1) CPUID and (2) MSR drivers, which could cause a DoS (crash) by unloading and reloading the drivers. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Unknown vulnerability in classifier code for Linux kernel before 2.2.19 could result in denial of service (hang). IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Signedness error in (1) getsockopt and (2) setsockopt for Linux kernel before 2.2.19 allows local users to cause a denial of service. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Unknown vulnerability in sockfilter for Linux kernel before 2.2.19 related to "boundary cases," with unknown impact. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Unknown vulnerabilities in strnlen_user for Linux kernel before 2.2.19, with unknown impact. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 The System V (SYS5) shared memory implementation for Linux kernel before 2.2.19 could allow attackers to modify recently freed memory. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability. IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Certain operations in Linux kernel before 2.2.19 on the x86 architecture copy the wrong number of bytes, which might allow attackers to modify memory, aka "User access asm bug on x86." IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Unknown vulnerabilities in the UDP port allocation for Linux kernel before 2.2.19 could allow local users to cause a denial of service (deadlock). IMNX-2001-70-010-01 CSSA-2001-012.0 20010405 Trustix Security Advisory #2001-0003 - kernel 20010409 PROGENY-SA-2001-01: execve()/ptrace() exploit in Linux kernels MDKSA-2001:037 CLA-2001:394 SuSE-SA:2001:018 http://www.linux.org.uk/VERSION/relnotes.2219.html RHSA-2001:047 DSA-047 Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi. http://bugzilla.mozilla.org/show_bug.cgi?id=39524 http://bugzilla.mozilla.org/show_bug.cgi?id=39526 http://bugzilla.mozilla.org/show_bug.cgi?id=39527 http://bugzilla.mozilla.org/show_bug.cgi?id=39531 http://bugzilla.mozilla.org/show_bug.cgi?id=39533 http://bugzilla.mozilla.org/show_bug.cgi?id=70189 http://bugzilla.mozilla.org/show_bug.cgi?id=82781 20010829 Security Advisory for Bugzilla v2.13 and older RHSA-2001:107 Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi. http://bugzilla.mozilla.org/show_bug.cgi?id=38854 http://bugzilla.mozilla.org/show_bug.cgi?id=38855 http://bugzilla.mozilla.org/show_bug.cgi?id=38859 http://bugzilla.mozilla.org/show_bug.cgi?id=39536 http://bugzilla.mozilla.org/show_bug.cgi?id=87701 http://bugzilla.mozilla.org/show_bug.cgi?id=95235 20010829 Security Advisory for Bugzilla v2.13 and older RHSA-2001:107 Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar. http://bugzilla.mozilla.org/show_bug.cgi?id=15980 20010829 Security Advisory for Bugzilla v2.13 and older RHSA-2001:107 Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges. http://bugzilla.mozilla.org/show_bug.cgi?id=74032 20010829 Security Advisory for Bugzilla v2.13 and older RHSA-2001:107 Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) via a flood of requests to sanitycheck.cgi. http://bugzilla.mozilla.org/show_bug.cgi?id=54556 20010829 Security Advisory for Bugzilla v2.13 and older RHSA-2001:107 process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent. http://bugzilla.mozilla.org/show_bug.cgi?id=66235 20010829 Security Advisory for Bugzilla v2.13 and older bugzilla-processbug-old-restrictions(10478) RHSA-2001:107 Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug. http://bugzilla.mozilla.org/show_bug.cgi?id=96085 20010829 Security Advisory for Bugzilla v2.13 and older bugzilla-duplicate-view-restricted(10479) RHSA-2001:107 Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the mailbox parameter. 20010705 Cobalt Cube Webmail directory traversal 20010818 Cobalt update for my Webmail issue. cobalt-qube-directory-traversal(6805) dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system. http://groups.google.com/groups?selm=20010829121505.A16004%40compusol.com.au 228529 1017429 RHSA-2003:067 Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering. 20030713 IE chromeless window vulnerabilities 20030715 Internet Explorer Full-Screen mode threats http://www.doxdesk.com/personal/posts/bugtraq/20030713-ie/ http://www.guninski.com/popspoof.html VU#490708 20011021 Javascript in IE may spoof the whole screen 3469 http://www.systemintegra.com/ie-fullscreen/ ie-javascript-spoof-dialog(7313) Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs. http://lists.apple.com/mhonarc/security-announce/msg00038.html 20011020 gm4 format strings on OSX macos-gm4-utility-bo(10174) VU#147587 nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument. http://lists.apple.com/mhonarc/security-announce/msg00038.html 20020915 nidump on OS X 20010903 Re: Possible Issue with Netinfo and Mac OS X 1001946 http://www.securemac.com/macosxnidump.php http://www.securiteam.com/securityreviews/5QP032A4UU.html Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument. 20010621 New bugs, old bugs GLSA-200410-08 VU#176363 RHSA-2004:536 ncompress-filename-bo(10619) The Basic Security Module (BSM) for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide their activities, possibly when certain BSM audit files are not present under the FTP root. 40521 7396 solaris-bsm-no-audit(11841) vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes. ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/016_recover.patch VU#191675 bsd-virecover-delete-files(10149) Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow remote attackers to execute arbitrary web script or HTML via an image in the (1) DATA, (2) STYLE, or (3) BINARY tags. VU#541384 http://www.kb.cert.org/vuls/id/JARL-56TPBQ http://www.windowsitpro.com/Articles/Index.cfm?ArticleID=19811&DisplayTab=Article AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application hang or crash) via a buddy icon GIF file whose length and width values are larger than the actual image data. VU#710347 http://www.kb.cert.org/vuls/id/JARL-56TQEN 20011006 AIM Exploits 20011230 Windows AIM Client Exploits 3408 aim-large-buddyicon-dos(7255) AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a malformed WAV file. Fixed in Win AIM Beta 4.8.2540 posted Nov. 19th. VU#990451 http://www.kb.cert.org/vuls/id/JARL-569M8X 20011006 AIM Exploits aim-wav-file-dos(10686) AOL Instant Messenger (AIM) 4.7.2480 and earlier allows remote attackers to cause a denial of service (application crash) via an instant message that contains a large amount of "<!--" HTML comments. Fixed in Win AIM Beta 4.8.2540 posted Nov. 19th. 20011002 AIM 0day DoS VU#507771 http://www.kb.cert.org/vuls/id/JARL-56TPTN 20011230 Windows AIM Client Exploits 3398 aim-html-comments-dos(7233) AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly caused by a buffer overflow. VU#972499 http://www.kb.cert.org/vuls/id/JARL-569MEK 20011006 AIM Exploits 3407 aim-long-filename-dos(7254) AOL Instant Messenger (AIM) 4.7 and earlier allows remote attackers to cause a denial of service (application crash) via a large number of different fonts followed by an HTML HR tag. VU#530299 http://www.kb.cert.org/vuls/id/JARL-569MD7 20011006 AIM Exploits 20011230 Windows AIM Client Exploits 3756 aim-multiple-fonts-dos(7757) WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users. VU#303080 2275 http://www1.corest.com/common/showdoc.php?idxseccion=10&idx=117 vnc-weak-authentication(5992) Advanced Poll before 1.61, when using a flat file database, allows remote attackers to gain privileges by setting the logged_in parameter. 1002516 VU#140723 advancedpoll-php-admin-access(7861) Alcatel Speed Touch ADSL modem running firmware KHDSAA.108, KHDSAA.132, KHDSBA.133, and KHDSAA.134 has a blank default password, which allows remote attackers to gain unauthorized access. http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html CA-2001-08 VU#212088 20010410 multiple vulnerabilities in Alcatel Speed Touch DSL modems 2568 alcatel-blank-password(6335) The challenge-response authentication of the EXPERT user for Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 allows remote attackers to gain privileges by directly computing the response based on information that is provided by the device during login. http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html CA-2001-08 VU#243592 20010410 multiple vulnerabilities in Alcatel Speed Touch DSL modems 2568 alcatel-expert-account(6354) Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 has a TFTP server running without a password, which allows remote attackers to change firmware versions or the device's configurations. CA-2001-08 VU#490344 20010410 multiple vulnerabilities in Alcatel Speed Touch DSL modems 2566 alcatel-tftp-lan-access(6336) Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors. VU#321475 http://www.macromedia.com/devnet/security/security_zone/mpsb01-07.html 3023 coldfusion-overwrite-template(6840) The (1) FTP and (2) Telnet services in Beck GmbH IPC@Chip are shipped with a default password, which allows remote attackers to gain unauthorized access. VU#426459 VU#461219 20010524 IPC@Chip Security 2769 2770 ipcchip-ftp-default-passwords(6597) ipcchip-telnet-default-password(6598) Buffer overflow in mcedit in Midnight Commander 4.5.1 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted text file. VU#203203 midnight-commander-mcedit-bo(10630) Cayman 3220-H DSL Router 1.0 ship without a password set, which allows remote attackers to gain unauthorized access. VU#557136 http://www.kb.cert.org/vuls/id/JARL-4ZTKY9 20010711 cayman strikes again 3017 cayman-dsl-insecure-permissions(6841) Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third packet of a TCP three-way handshake to use the NAT IP address, which allows remote attackers to gain sensitive information. VU#258731 nokia-cp-packet-retransmission(8293) Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. 20011229 Remote Root Hole in Cherokee Webserver VU#464827 3772 cherokee-http-directory-traversal(7799) Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain privileges via other vulnerabilities. 20011229 Remote Root Hole in Cherokee Webserver VU#245795 3771 cherokee-http-insecure-privileges(7797) Cisco IOS 12.0(5)XU through 12.1(2) allows remote attackers to read system administration and topology information via an "snmp-server host" command, which creates a readable "community" community string if one has not been previously created. 20010228 Cisco IOS Software Multiple SNMP Community String Vulnerabilities VU#848944 cisco-ios-snmp-server-community(6178) inetd in Compaq Tru64 UNIX 5.1 allows attackers to cause a denial of service (network connection loss) by causing one of the services handled by inetd to core dump during startup, which causes inetd to stop accepting connections to all of its services. VU#880624 SSRT0708U tru64-inetd-dos(6157) Dallas Semiconductor iButton DS1991 returns predictable values when given an incorrect password, which makes it easier for users with physical access to conduct dictionary attacks against the device password. New version DS1963S corrects problem. A011801-1 VU#178560 ibutton-ds1991-dictionary(10625) easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out. 20011201 easynews 1.5 let's remote users modify database VU#597795 3649 easynews-php-reveal-path(7660) Handspring Visor 1.0 and 1.0.1 with the VisorPhone Springboard module installed allows remote attackers to cause a denial of service (PalmOS crash and VisorPhone database corruption) by sending a large or crafted SMS image. VU#222739 20011022 PalmOS crashes receiving SMS images using Handspring VisorPhone handspring-visor-sms-dos(10637) Buffer overflow in the text editor functionality in HP-UX 10.01 through 11.04 on HP9000 Series 700 and Series 800 allows local users to cause a denial of service ("system availability") via text editors such as (1) e, (2) ex, (3) vi, (4) edit, (5) view, and (6) vedit. ESB-2001.066 VU#268848 HPSBUX0011-132 hp-text-editor-bo(6111) Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the system. 1003038 VU#249491 6839 IY26302 aix-login-unauth-access(8269) Cross-site scripting (XSS) vulnerability in VisualAge for Java 3.5 Professional allows remote attackers to execute JavaScript on other clients via the URL, which injects the script in the resulting error message. 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability VU#270083 java-servlet-crosssite-scripting(6793) Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command line argument. INN 2.3.0 fixes problem. 20010418 Innfeed Buffer Overflow 1001353 VU#943536 20010418 Re: Innfeed Buffer Overflow 2620 innfeed-c-bo(6398) KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption, which allows remote attackers to read communications via a man-in-the-middle attack. http://josefsson.org/ktelnet/kerberos-telnet.html VU#390280 kth-kerberos-unencrypted-connection(10640) The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack. http://josefsson.org/ktelnet/kerberos-telnet.html VU#774587 kth-kerberos-unencrypted-connection(10640) Unknown vulnerability in the SMTP server in Lotus Domino 5.0 through 5.7 allows remote attackers to bypass mail relaying restrictions via crafted e-mail addresses in "RCPT TO" commands. Upgrade to R5.0.8 to resolve the problem. VU#176972 http://www-1.ibm.com/support/docview.wss?rs=899&uid=swg21085603 lotus-domino-smtp-mail-relay(6591) Find-By-Content in Mac OS X 10.0 through 10.0.4 creates world-readable index files named .FBCIndex in every directory, which allows remote attackers to learn the contents of files in web accessible directories. It is reported that this issue is addressed in the Apple Mac OS X and Mac OS X Server release versions 10.2 and above. This is not confirmed. 20010910 Re: More security problems in Apache on Mac OS X VU#177243 3325 macos-apache-directory-disclosure(7103) NetInfo Manager for Mac OS X 10.0 through 10.1 allows local users to gain root privileges by opening applications using the (1) "recent items" and (2) "services" menus, which causes the applications to run with root privileges. 20011017 Mac OS X setuid root security hole 20011017 Re: Mac OS X setuid root security hole M-007 VU#945747 3439 macos-netinfo-root-privileges(7303) Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc, (2) mgrnt, and (3) mgdatasrvr.sc scripts. VU#157795 20011217 MAGIC Enterprise Multiple Vulnerabilities magic-edeveloper-tmp-symlink(10616) The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories. VU#913704 MDKSA-2001:077 mandrake-apache-browse-directories(8029) Microsoft Internet Explorer 5.0 through 6.0 allows attackers to cause a denial of service (browser crash) via a crafted FTP URL such as "/.#./". 20010505 [bug]: Cause IE 5.X to crash VU#199408 ie-ftp-url-dos(10117) Memory leak in the SNMP LAN Manager (LANMAN) MIB extension for Microsoft Windows 2000 before SP3, when the Print Spooler is not running, allows remote attackers to cause a denial of service (memory consumption) via a large number of GET or GETNEXT requests. Q296815 VU#887393 6030 win2k-snmp-lanman-dos(10431) By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS cache via spoofed DNS responses. Q241352 VU#109475 6791 nt-ms-dns-cachepollution(3675) Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote attackers to execute arbitrary code via a long host parameter. Upgrade to the latest version of MySQL (3.23.33 or later) for fix. http://dev.mysql.com/doc/mysql/en/news-3-23-33.html VU#123384 20010209 Some more MySql security issues mysql-libmysqlclient-bo(6418) Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request. http://dev.mysql.com/doc/mysql/en/news-3-23-33.html VU#367320 20010209 Some more MySql security issues mysql-drop-database-bo(6419) Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode characters. VU#837419 6060 siteminder-unicode-bypass(10497) Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted mail message. 20011104-01-I CA-2001-25 VU#206723 3290 gauntlet-csmap-bo(7088) Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable. VU#229955 20010331 Remote buffer overflow in CrazyWWWBoard. crazywwwboard-httpuseragent-bo(10110) Directory traversal vulnerability in Novell GroupWise 5.5 and 6.0 allows remote attackers to read arbitrary files via a request for /servlet/webacc?User.html= that contains "../" (dot dot) sequences and a null character. 20011015 Novell Groupwise arbitrary file retrieval vulnerability http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/advisories_template.htm%3Findexid%3D12 VU#341539 http://www.novell.com/coolsolutions/gwmag/features/a_webaccess_security_gw.html 3436 novell-groupwise-directory-traversal(7287) OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d. 20010619 pam session VU#797027 2917 openssh-rsh-bypass-pam(6757) SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the user parameter. 20011012 Bug in PostNuke 0.62, 0.63 and 0.64 (and possibly PHPnuke) 20011013 Bug in PostNuke 0.62, 0.63 and 0.64 (and possibly PHPnuke) VU#921547 3435 postnuke-getusrinfo-bypass-authentication(7280) Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to access restricted resources via URL-encoded (1) /.. or (2) \.. sequences. VU#348040 3461 securid-webid-unicode-traversal(7397) WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information. VU#609840 3462 securid-webid-debug-mode(7399) The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords. 1002882 VU#279763 servu-ftp-plaintext-password(7925) Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords. VU#403307 crystalreports-plaintext-auth-info(7928) SurfControl SuperScout only filters packets containing both an HTTP GET request and a Host header, which allows local users to bypass filtering by fragmenting packets so that no packet contains both data elements. 1001801 VU#139315 Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary code via a long (1) username or (2) password. 20011230 blackshell1: Multiple Prolems with Vandykes SecureCRT VU#216227 securecrt-ssh1-protocol-bo(10111) mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks. 20010411 flaw in RH ``mkpasswd'' command 20010412 Re: flaw in RH ``mkpasswd'' command (importance of seeds & algorithms) 1001303 VU#527736 2632 mkpasswd-weak-passwords(6382) PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and earlier allows remote attackers to execute arbitrary PHP code by modifying the cfgProgDir parameter to reference a URL on a remote web server that contains the code. 1001408 VU#391347 2970 phpsecurepages-checklogin-execute-code(6774) The RC4 stream cipher as used by SSH1 allows remote attackers to modify messages without detection by XORing the original message's cyclic redundancy check (CRC) with the CRC of a mask consisting of all the bits of the original message that were modified. VU#25309 ssh-rc4-modify-packets(6449) The IDEA cipher as implemented by SSH1 does not protect the final block of a message against modification, which allows remote attackers to modify the block without detection by changing its cyclic redundancy check (CRC) to match the modifications to the message. VU#315308 ssh-idea-modify-packets(6472) prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement. 20010810 Easily and Remotely Pipe a Covert Shell on phpBB version 1.4.0 and below 20010804 Re: phpBB 1.4.0 bug leads to easy admin privileges VU#920931 3167 phpbb-admin-access(6944) SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter. VU#314347 20010803 phpBB 1.4.0 bug leads to easy admin privileges 3142 phpbb-admin-access(6944) The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target. VU#684820 ssh-authentication-forwarding(6603) SSH before 2.0 disables host key checking when connecting to the localhost, which allows remote attackers to silently redirect connections to the localhost by poisoning the client's DNS cache. VU#786900 ssh-dns-authentication-bypass(6604) SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is generated. VU#665372 ssh-rc4-replay-conversation(6490) SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not. VU#565052 ssh-rc4-replay-conversation(6490) The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote domains, even when an ACL exists, which allows users to access services in a remote domain. http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA00-08.jsp bea-tuxedo-remote-access(6326) Buffer overflow in xlock in UnixWare 7.1.0 and 7.1.1 and Open Unix 8.0.0 allows local users to execute arbitrary code. CSSA-2001-SCO.34 3555 unixware-openunix-xlock-bo(7573) smcboot in Sun SMC (Sun Management Center) 2.0 in Solaris 8 allows local users to delete arbitrary files via a symlink attack on /tmp/smc$SMC_PORT. http://www.securiteam.com/unixfocus/6K00S203FC.html 3763 sun-smcboot-tmp-symlink(7756) Java Runtime Environment (JRE) and SDK 1.2 through 1.3.0_04 allows untrusted applets to access the system clipboard. 20011017 Mac OS X v10.0.x J2SE v1.3 clipboard tapping vulnerability HPSBUX0110-174 3441 jre-system-clipboard-access(7333) Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges. http://archives.neohapsis.com/archives/win2ksecadvice/2000-q4/0109.html 20011126 Xitami Webserver stores admin password in clear text. 3582 xitami-default-password-plaintext(7600) SQL injection vulnerability in bb_memberlist.php for phpBB 1.4.2 allows remote attackers to execute arbitrary SQL queries via the $sortby variable. 3411 phpbb-bbmemberlist-modify-sql(7253) One-Time Passwords In Everything (a.k.a OPIE) 2.32 and 2.4 allows remote attackers to determine the existence of user accounts by printing random passphrases if the user account does not exist and static passphrases if the user account does exist. 3549 opie-verify-accounts(7572) Alcatel ADSL modems allow remote attackers to access the Trivial File Transfer Protocol (TFTP) to modify firmware and configuration via a bounce attack from a system on the local area network (LAN) side, which is allowed to access TFTP without authentication. CA-2001-08 VU#211736 alcatel-tftp-lan-access(6336) popauth utility in Qualcomm Qpopper 4.0 and earlier allows local users to overwrite arbitrary files and execute commands as the pop user via a symlink attack on the -trace file option. qpopper-popauth-symlink(7707) Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which allows remote attackers to spoof any valid hostname on the Internet. NOTE: a followup post suggests that this is not an issue in the daemon. irc-openprojects-dns-spoofing(7283) Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. 3684 win-browser-image-dos(7709) Mozilla 0.9.6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. 3684 win-browser-image-dos(7709) Opera 5.11 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. 3684 win-browser-image-dos(7709) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2001-1460. Reason: This candidate is a refinement duplicate of CVE-2001-1460. Notes: All CVE users should reference CVE-2001-1460 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command. 20011213 Silly 'script' hardlink bug - fixed 20011212 Silly 'script' hardlink bug http://support.avaya.com/elmodocs2/security/ASA-2006-014.htm RHSA-2005:782 16280 util-linux-script-hardlink(7718) oval:org.mitre.oval:def:10723 network_query.php in Network Query Tool 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the target parameter. 20011022 [Advisory iSecureLabs] Network Query Tool remote command execution 3455 nqt-php-command-execution(7322) Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attackers to cause a denial of service and possibly execute arbitrary code. 20011120 Off-by-one vulnerability in thttpd!!! 20011123 Re: Off-by-one vulnerability in thttpd!!! 3562 thttpd-basic-authentication-bo(7595) Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack. ie-password-character-information(7592) 20011121 MS IE Password inputs 20011120 Re: MS IE Password inputs 3563 Buffer overflow in mod_bf 0.2 allows local users to execute arbitrary commands via a long script. http://www.bugtraq.org/advisories/GOBBLES-15.txt 3713 brainf*ck-modbf-bo(7730) Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication method being used, which makes it easier for remote attackers to conduct brute force attacks. 20011023 Check Point VPN-1 SecuRemote Flaw 20011024 RE: Check Point VPN-1 SecuRemote Flaw 3470 vpn1-securemote-brute-force(7343) ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged. CLA-2002:450 MDKSA-2002:005 20010907 ProFTPd and reverse DNS 3310 proftpd-unresolved-hostname(7126) The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters, as demonstrated using an ls command with multiple (1) "*/..", (2) "*/.*", or (3) ".*./*?/" sequences in the argument. CLA-2002:450 MDKSA-2002:005 webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE parameter. 20011019 Webcart v.8.4 3453 webcart-cgi-command-execution(7315) The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host. 20011022 Solaris fingerd disclose complete user list 27116 3457 solaris-fingerd-list-accounts(7334) Lotus Notes R5 Client 4.6 allows remote attackers to execute arbitrary commands via a Lotus Notes object with code in an event, which is automatically executed when the user processes the e-mail message. 20011022 Security BugWare Advisory 20011023 Re: Security BugWare Advisory 3458 lotus-notes-execute-objects(7323) tinc 1.0pre3 and 1.0pre4 allows remote attackers to inject data into user sessions by sniffing and replaying packets. 20020109 Security flaws in tinc 3837 vpn-replay-attack(7870) Unknown vulnerability in the file system protection subsystem in HP Secure OS Software for Linux 1.0 allows additional user privileges on some files beyond what is specified in the file system protection rules, which allows local users to conduct unauthorized operations on restricted files. HPSBTL0110-001 3468 hp-secure-unauth-privileges(7342) OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged. 20011119 OpenSSH 3.0.1 (fwd) openssh-kerberos-elevate-privileges(7598) http://www.openbsd.org/errata30.html#sshd 3560 Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows local users to execute arbitrary code as group bin via a long command line argument. CSSA-2001-SCO.38 2597 sco-openserver-lpstat-bo(6413) geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not properly identify a user's effective user id, which could allow local users to gain privileges. hpux-ia-geteuid-gain-privileges(7324) HPSBUX0110-171 3452 oval:org.mitre.oval:def:5364 Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL. allaire-jrun-view-directory(7623) MPSB01-13 3592 JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows remote attackers to read arbitrary JavaServer Pages (JSP) source code via a request URL containing the source filename ending in (1) "jsp%00" or (2) "js%2570". allaire-jrun-view-jsp-source(7676) http://www.macromedia.com/v1/handlers/index.cfm?ID=22288&Method=Full Unknown vulnerability in Allaire JRun 3.1 allows remote attackers to directly access the WEB-INF and META-INF directories and execute arbitrary JavaServer Pages (JSP), a variant of CVE-2000-1050. allaire-jrun-webinf-metainf-jsp(7677) http://www.macromedia.com/v1/handlers/index.cfm?ID=22287 3662 Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain duplicate active user session IDs and perform actions as other users via a URL request for the web application directory without the trailing '/' (slash), as demonstrated using ctx. allaire-jrun-sessionid-duplicated(7680) http://www.macromedia.com/v1/handlers/index.cfm?ID=22260&Method=Full 3600 ColdFusion 4.5 and 5, when running on Windows with the advanced security sandbox type set to "operating system," does not properly pass security context to (1) child processes created with <CFEXECUTE> and (2) child processes that call the CreateProcess function and are executed with <CFOBJECT> or end with the CFX extension, which allows attackers to execute programs with the permissions of the System account. http://www.macromedia.com/v1/Handlers/index.cfm?ID=22263 Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which may cause the directories to have less restrictive permissions than intended. 1002626 3479 Cross-site scripting (XSS) vulnerability in phpReview 0.9.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via user-submitted reviews. phpreview-cross-site-scripting(7218) 3380 ** DISPUTED ** RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it, and the original researcher did not respond to requests for additional information. 20011112 RADIX1112200102 20011114 RE:Radix Research Reports RADIX1112200101, RADIX1112200102, and RADIX1112200103 win2k-runas-reveal-information(7531) 3184 RunAs (runas.exe) in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service (RunAs hang) by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the vendor also presents a scenario in which other users could be affected if running on a Terminal Server. Therefore this is a vulnerability. 20011114 RE:Radix Research Reports RADIX1112200101, RADIX1112200102, and RADIX1112200103 win2k-runas-dos(7533) 3291 ** DISPUTED ** RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it. 20011112 RADIX1112200101 20011114 RE:Radix Research Reports RADIX1112200101, RADIX1112200102, and RADIX1112200103 win2k-runas-pipe-authentication(7532) 3185 Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PDA) via Rextools, and capturing the cleartext PIN. 20011123 Xircom REX6000 PDA Password Retrieval rex6000-pda-password-retrieval(7584) 3574 Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 allows remote attackers to inject arbitrary web script or HTML via the uname parameter. 20011215 PHPNuke holes 20011203 Phpnuke Cross site scripting vulnerability phpnuke-postnuke-css(7654) 3609 Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message. 20011215 Security hole in IMessenger ( PHP-Nuke ) 20011215 Serious bug in IMessenger ( php-nuke ) Cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the topic parameter. 20011216 CSS in DMOZGateway ( php-nuke ) Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php. http://prdownloads.sourceforge.net/phpnuke/PHP-Nuke-5.5.tar.gz phpnuke-postnuke-css(7654) 3609 Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers to modify news.dat, template.dat and possibly other files via a ".." in the cid parameter. 20011201 easynews 1.5 let's remote users modify database easynews-php-modify-data(7657) 3643 Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the zeit parameter. 20011201 easynews 1.5 let's remote users modify database easynews-php-css(7658) easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access. 20011201 easynews 1.5 let's remote users modify database easynews-php-admin-passwd(7659) AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows remote attackers to determine the existence of valid account numbers via a brute force attack. 20010929 Vulnerability in Amtote International homebet self service wagering system. homebet-brute-force-account(7185) 3371 Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows attackers to gain unauthorized access via a long string. NOTE: due to lack of details in the vendor advisory, it is not clear if this is the same issue as CVE-2001-0779. IY21609 run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary commands. 20011022 Webmin 0.88 temporary insecure file creation, root compromise http://www.securiteam.com/unixfocus/6R00M0K2UC.html Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an email attachment with a long filename. 20011019 Claris Emailer buffer over flow vulnerabirity claris-long-filename-bo(7314) 3454 WebX stores authentication information in the HTTP_REFERER variable, which is included in URL links within bulletin board messages posted by users, which could allow remote attackers to hijack user sessions. webcrossing-webx-session-hijack(7458) 20011030 Web Forum Account Hijacking Vuln. ** DISPUTED * Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this "laws of physics" issue might not be included in CVE. 20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability 20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability isa-udp-flood-dos(7446) 3501 mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication. 20011113 Brute-Forcing Web Application Session IDs apache-modusertrack-predicticable-sessionid(7494) 3521 Slashcode 2.0 creates new accounts with an 8-character random password, which could allow local users to obtain session ID's from cookies and gain unauthorized access via a brute force attack. 20011113 Brute-Forcing Web Application Session IDs slashcode-sessionid-brute-force(7493) 3519 Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication information and gain unauthorized access via sniffing or a cross-site scripting attack. 20011127 Audiogalaxy again audiogalaxy-plaintext-password(7621) 3587 The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges. 20011128 TWIG default configurations may lead to insecure auth-cookie password storage twig-password-plaintext-cookie(7619) 3591 SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access. 20011203 SpeedXess HASE-120 router default password speedxess-hase-default-password(7655) 3617 Stack consumption vulnerability in Internet Explorer The JavaScript settimeout function in Internet Explorer allows remote attackers to cause a denial of service (crash) via the JavaScript settimeout function. NOTE: the vendor could not reproduce the problem. 20011202 Stack overflow in all Internet Explorer Versions!! 20011204 RE: Stack overflow in all Internet Explorer Versions!! ie-settimeout-dos(7661) IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a denial of service via fragmented IP packets that split the TCP header. 20011205 IPRoute Fragmentation Denial of Service Vulnerability iproute-fragmented-packet-dos(7664) Buffer overflow in Unix-to-Unix Copy Protocol (UUCP) in BSDI BSD/OS 3.0 through 4.2 allows local users to execute arbitrary code via a long command line argument. bsd-uucp-bo(7633) 20011129 UUCP 3603 NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments. 20011130 Re: NAI Webshield SMTP for WinNT MIME header vuln that allows BadTrans to pass] webshield-smtp-mime-attachments(7637) 3601 Axis network camera 2120, 2110, 2100, 200+ and 200 contains a default administration password "pass", which allows remote attackers to gain access to the camera. 20011205 Axis Network Camera known default password vulnerability 20011206 Re: Axis Network Camera known default password vulnerability axis-default-admin-passwd(7665) 3640 Directory traversal vulnerability in Macromedia JRun Web Server (JWS) 2.3.3, 3.0 and 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP GET request. allaire-jrun-jws-directory-traversal(7678) http://www.macromedia.com/v1/handlers/index.cfm?ID=22290&Method=Full 3666 Macromedia JRun 3.0 and 3.1 appends the jsessionid to URL requests (a.k.a. rewriting) when client browsers have cookies enabled, which allows remote attackers to obtain session IDs and hijack sessions via HTTP referrer fields or sniffing. allaire-jrun-jsessionid-appended(7679) http://www.macromedia.com/v1/handlers/index.cfm?ID=22291&Method=Full 3665 Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passwords from the pwhc.ini file. pathways-homecare-weak-encryption(7682) 3653 Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email attachments from forwarded messages, which could allow remote attackers to execute arbitrary code. oe-blocked-attachment-forward(7670) ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters. 20011205 Flawed outbound packet filtering in various personal firewalls 20011206 Re: Flawed outbound packet filtering in various personal firewalls zonealarm-tiny-bypass-filter(7671) 3647 Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters. 20011205 Flawed outbound packet filtering in various personal firewalls zonealarm-tiny-bypass-filter(7671) 3647 CentraOne 5.2 and Centra ASP with basic authentication enabled creates world-writable base64 encoded log files, which allows local users to obtain cleartext passwords from decoded log files and impersonate users. 20011226 Dangerous information in CentraOne log files - VENDOR RESPONSE 20011217 Dangerous information in CentraOne Log files, possible user impersonation 3704 centraone-log-file-info(7820) Linux kernel 2.2.19 enables CAP_SYS_RESOURCE for setuid processes, which allows local users to exceed disk quota restrictions during execution of setuid programs. 20011022 Overriding qouta limits in Linux kernel ssdpsrv.exe in Windows ME allows remote attackers to cause a denial of service by sending multiple newlines in a Simple Service Discovery Protocol (SSDP) message. NOTE: multiple replies to the original post state that the problem could not be reproduced. 20011017 Ssdpsrv.exe in WindowsME winme-ssdp-dos(7318) 3442 Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code via long command line options (1) socks_server, (2) socks_user, and (3) socks_passwd. NOTE: since the default configuration of setiathome is not setuid, perhaps this issue should not be included in CVE. 20011202 Vulnerability in SETI@home IBM AIX 430 does not properly unlock IPPMTU_LOCK, which allows remote attackers to cause a denial of service (hang) via Path Maximum Transmit Unit (PMTU) IP packets. IY25096 pt_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write to other users' terminals by modifying the ACL of a TTY. 1002732 1004035 43929 3522 The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep. 20011024 Hidden requests to Apache http://httpd.apache.org/docs/logs.html apache-hidden-http-request(7363) Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges. IY20486 IY23674 Unknown vulnerability in IP defragmenter (frag2) in Snort before 1.8.3 allows attackers to cause a denial of service (crash). [Snort-announce] 20011129 Snort 1.8.3 Released The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference. 20011202 OpenBSD local DoS [OpenBSD] 20011202 Code that crashes kernel at will + proposed patch openbsd-retval-null-dos(7690) Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by calling the ShowWindow function after receiving a WM_NCCREATE message. 20011027 A GDI bug. win-gid-dos(7409) 3481 Buffer overflow in Xvt 2.1 in Debian Linux 2.2 allows local users to execute arbitrary code via long (1) -name and (2) -T arguments. 20010702 Xvt 2.1 vulnerability DSA-082 xvt-command-line-bo(6781) 2955 2964 Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename. SuSE-SA:2001:040 DSA-085 nvi-format-string(7317) 3456 Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers. HPSBTL0112-004 tomcat-unspecified-unauthorized-access(42892) setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or setgid privileges are dropped, which could allow local users to cause a denial of service by exhausting available disk space. HPSBUX0107-156 hpux-setrlimit-dos(6810) 3416 oval:org.mitre.oval:def:5159 Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command. macos-ppp-auth-disclosure(7750) [Macsec] 20011229 MacOSX ppp 3753 Format string vulnerability in libvanessa_logger 0.0.1 in Perdition 0.1.8 allows remote attackers to execute arbitrary code via format string specifiers in the __vanessa_logger_log function. 20011225 GOBBLES #17: perdition/vanessa_logger format string vuln 20011225 Remote Root Hole in FreeBSD Ports 3740 Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly sensitive Notes template files (.ntf) via an HTTP request with a large number of "+" characters before the .nsf file extension, which are converted to spaces by Domino. 20020203 Lotus Domino password bypass 20020204 Re: Lotus Domino password bypass 20020204 Lotus Domino password bypass lotus-domino-auth-bypass(8072) http://www.nextgenss.com/papers/hpldws.pdf 4022 CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack. 20010709 Many WAP gateways do not properly check SSL certificates wap-gateway-ssl-certificates(6814) Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack. wap-gateway-ssl-certificates(6814) 20010709 Many WAP gateways do not properly check SSL certificates Windows XP with fast user switching and account lockout enabled allows local users to deny user account access by setting the fast user switch to the same user (self) multiple times, which causes other accounts to be locked out. 20011220 Windows XP security concerns winxp-fastswitch-account-lockout(7731) 3717 The Remote Desktop client in Windows XP sends the most recent user account name in cleartext, which could allow remote attackers to obtain terminal server user account names via sniffing. 20011220 Windows XP security concerns winxp-remote-desktop-username(7732) 3720 The MAC module in Netfilter in Linux kernel 2.4.1 through 2.4.11, when configured to filter based on MAC addresses, allows remote attackers to bypass packet filters via small packets. 20011008 Bug in Linux 2.4 / iptables MAC match module linux-netfilter-bypass-filter(7267) 3418 Buffer overflow in smtpscan.dll for Trend Micro InterScan VirusWall 3.51 for Windows NT has allows remote attackers to execute arbitrary code via a certain configuration parameter. 20010628 [SNS Advisory No.34] TrendMicro InterScan VirusWall 3.51 smtpscan.dll Buffer Overflow Buffer overflow in (1) HttpSaveCVP.dll and (2) HttpSaveCSP.dll in Trend Micro InterScan VirusWall 3.5.1 allows remote attackers to execute arbitrary code. 20010628 [SNS Advisory No.35] TrendMicro InterScan VirusWall 3.51 HttpSaveC*P.dll Buffer Overflow Apple Personal Web Sharing (PWS) 1.1, 1.5, and 1.5.5, when Web Sharing authentication is enabled, allows remote attackers to cause a denial of service via a long password, possibly due to a buffer overflow. 20010628 MacOS Personal Wed Sharing DoS 2945 macos-personal-web-sharing-dos(6759) Buffer overflow in cron in Caldera UnixWare 7 allows local users to execute arbitrary code via a command line argument. CSSA-2001-SCO.3 Unknown vulnerability in CDE in Caldera OpenUnix 7.1.0, 7.1.1, and 8.0 allows an xterm session to gain privileges when the session is reused. CSSA-2001-SCO.37 3646 cde-xterm-gain-privileges(7666) Unknown vulnerability in SCO OpenServer 5.0.6 and earlier allows local users to modify critical information such as certain CPU registers and segment descriptors. CSSA-2001-SCO.35 The timed program (in.timed) in UnixWare 7 and OpenUnix 8.0.0 does not properly terminate certain strings with a null, which allows remote attackers to cause a denial of service. CSSA-2001-SCO.39 Directory traversal vulnerability in ScriptEase viewcode.jse for Netware 5.1 before 5.1 SP3 allows remote attackers to read arbitrary files via ".." sequences in the query string. 20011219 IRM Security Advisory 002: Netware Web Server Source Disclosure 20011220 Re: IRM Security Advisory 002: Netware Web Server Source Disclosure 20011220 Re: IRM Security Advisory 002: Netware Web Server Source Disclosure 3715 netware-webserver-directory-traversal(7726) The File Blocker feature in Clearswift MAILsweeper for SMTP 4.2 allows remote attackers to bypass e-mail attachment filtering policies via a modified name in a Content-Type header. http://www.mimesweeper.com/support/technotes/notes/1102.asp mailsweeper-bypass-file-blocker(6801) Buffer overflow in the LDAP naming services library (libsldap) in Sun Solaris 8 allows local users to execute arbitrary code via a long LDAP_OPTIONS environment variable to a privileged program that uses libsldap. 20010705 Solaris 8 libsldap exploit 20010706 Re: Solaris 8 libsldap exploit 20010626 Solaris 8 libsldap buffer overflow http://www.securiteam.com/unixfocus/5IP0O2A4KS.html 2931 lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220. 20010831 Solaris LPD Exploit (fwd) http://metasploit.com/projects/Framework/modules/exploits/solaris_lpd_exec.pm 20010829 solaris lpd, KARMAPOLICE? 3274 solaris-lpd-sendmail-commands(7087) CardBoard 2.4 greeting card CGI by Michael Barretto allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient field. http://www.securiteam.com/unixfocus/5MP0M2K5FC.html 3360 cardboard-recipient-command-execution(7178) SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to bypass authentication as other users by supplying a public key from that user's authorized_keys file. 20010208 Authentication By-Pass Vulnerability in OpenSSH-2.3.1 (devel snapshot) 2356 http://www.openbsd.org/advisories/ssh_bypass.txt openssh-bypass-authentication(6084) Directory traversal vulnerability in SimpleServer:WWW 1.13 and earlier allows remote attackers to execute arbitrary programs via encoded ../ ("%2E%2E%2F%") sequences in a request to the cgi-bin/ directory, a different vulnerability than CVE-2000-0664. 20010727 SimpleServer:WWW Command Execution Vulnerability Exploit Code Released http://www.analogx.com/contents/download/network/sswww.htm http://www.securiteam.com/windowsntfocus/5TP0B1P4UK.html 3112