|
|
|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: PROPOSAL: Cluster 15 - ONEREF (43 candidates)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----Original Message----- From: Steven M. Christey [mailto:coley@LINUS.MITRE.ORG] Sent: Wednesday, July 14, 1999 1:24 AM To: cve-editorial-board-list@lists.mitre.org Subject: PROPOSAL: Cluster 15 - ONEREF (43 candidates) The following ONEREF cluster contains 43 candidates, each of which has one reference to a source, and the reference is not from the vendor. Most of these only include references to the X-Force database. This is a modification of a REFS cluster that I had originally created (the NOREFS cluster appears next). I had treated the REFS cluster as Medium controversy because of the belief that a single reference wasn't a guarantee that the vulnerability was verified and described properly. (No slight to X-Force). Since we are being flexible about references, in hindsight these candidates should have been included in earlier low controversy clusters. Proposed: 7/13 Scheduled Proposed: 7/6 Scheduled Interim Decision: 7/19 Scheduled Final Decision: 7/23 - - Steve Summary of votes to use (in ascending order of "severity"): ACCEPT - member accepts the candidate as proposed NOOP - member has no opinion on the candidate MODIFY - member wants to change some minor detail (e.g. reference/description) REVIEWING - member is reviewing/researching the candidate RECAST - candidate must be significantly modified, e.g. split or merged REJECT - candidate is "not a vulnerability", or a duplicate, etc. Please write your vote on the line that starts with "VOTE: ". If you want to add comments or details, add them to lines after the VOTE: line. ================================= Candidate: CAN-1999-0062 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:openbsd-chpass The chpass command in OpenBSD gives root access when a temporary file it uses is writeable by an attacker, due to an open file descriptor. VOTE: Modify: I believe this is a file leakage problem where the temp password file can be modified and used to overwrite the original password file. The reference source for this is a NAI Security Advisory #28, no longer available from the now defunct old NAI site but is on Bugtraq http://netspace.org/cgi-bin/wa?A2=ind9808B&L=bugtraq&P=R455 ================================= Candidate: CAN-1999-0081 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:ftp-rnfr wu-ftp allows files to be overwritten via the rnfr command. VOTE: NOOP ================================= Candidate: CAN-1999-0082 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:ftp-cwd CWD ~root command in ftp allows root login VOTE: Modify: Dan Farmer and Wietse Venema covered this vulnerability as well in their guide "Improving the Security of Your Site by Breaking Into it" ================================= Candidate: CAN-1999-0083 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:cwdleak getcwd() file descriptor leak in FTP VOTE:noop ================================= Candidate: CAN-1999-0120 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: CERT:CA-94.06.utmp.vulnerability Reference: XF:utmp-write Sun/Solaris utmp file allows local users to gain root access if it is writable by users other than root. VOTE:agree ================================= Candidate: CAN-1999-0156 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:ftp-pwless wu-ftpd FTP daemon allows any user and password combination. VOTE:reviewing, but so far can find no reference to this one ================================= Candidate: CAN-1999-0163 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:smtp-pipe In older versions of Sendmail, an attacker could use a pipe character to execute root commands. VOTE:modify, older vulnerability, but one additional reference is- The Ultimate Sendmail Hole List by Markus Hübner @ bau2.uibk.ac.at/matic/buglist.htm '|PROGRAM ' ================================= Candidate: CAN-1999-0165 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nfs-cache NFS cache poisoning VOTE:noop ================================= Candidate: CAN-1999-0228 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nt-rpc-ver Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT. VOTE:modify, this is a 100% CPU utilization through the rpc port 135 on an NT box. Source is Microsoft Knowledge Base article Q162567 ================================= Candidate: CAN-1999-0252 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:smtp-listserv Buffer overflow in listserv allows arbitrary command execution. VOTE:noop ================================= Candidate: CAN-1999-0294 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nt-wins-snmp2 All records in a WINS database can be deleted through SNMP for a denial of service. VOTE:noop ================================= Candidate: CAN-1999-0295 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:sun-sysdef Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges. VOTE:agree, reference though should be Sun Security Bulletin 00157 ================================= Candidate: CAN-1999-0303 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:bnu-uucpd-bo Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. VOTE:modify, source should be REPSEC Security Advisory RSI.0002.05-18-98.BNU.UUCPD ================================= Candidate: CAN-1999-0305 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:bsd-sourceroute BSD sysctl control does not properly restrict source routing. VOTE:modify reference: OpenBSD Security Advisory February 15, 1998 IP Source Routing Problem ================================= Candidate: CAN-1999-0306 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hp-xlock buffer overflow in HP xlock program. VOTE:modify, This is another of those with multiple affected OSs. Refs: CA-97.13, http://207.237.120.45/linux/xlock-exploit.txt, HPSBUX9711-073, SGI 19970502-02-PX, Sun Bulletin 000150 ================================= Candidate: CAN-1999-0307 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hpux-cstm-bo Buffer overflow in HP-UX cstm program allows local users to gain root privileges. VOTE: noop, only ref I can find is an old SOD exploit on www.outpost9.com ================================= Candidate: CAN-1999-0308 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hpux-gwind-overwrite Reference: CIAC:H-03: HP-UX suid Vulnerabilities HP-UX gwind program allows users to modify arbitrary files. VOTE:modify,add source HP Security Bulletin HPSBUX9410-018 ================================= Candidate: CAN-1999-0310 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:ssh-1225 SSH 1.2.25 on HP-UX allows access to new user accounts. VOTE:agree ================================= Candidate: CAN-1999-0311 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hpux-fpkg2swpk fpkg2swpk in HP-UX allows local users to gain root access. VOTE:modify, add source: HP Security Advisory HPSBUX9612-042 ================================= Candidate: CAN-1999-0312 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nis-ypbind HP ypbind allows attackers with root privileges to modify NIS data. VOTE: modify: Source is an older CERT Bulletin CA-93.1, Revised Hewlett-Packard NIS ypbind Vulnerability ================================= Candidate: CAN-1999-0313 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:sgi-disk-bandwidth IRIX disk_bandwidth program allows local users to gain root access using relative pathnames. VOTE:modify: Source is SGI Security Advisory 19980701-01-P ================================= Candidate: CAN-1999-0314 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:sgi-ioconfig IRIX ioconfig program allows local users to gain root access using relative pathnames. VOTE:modify: Source is SGI Security Advisory 19980701-01-P ================================= Candidate: CAN-1999-0316 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:linux-splitvt Buffer overflow in Linux splitvt command gives root access to local users. VOTE:modify: Source is CIAC Bulletin G-08 ================================= Candidate: CAN-1999-0321 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:sun-kcms-configure-bo Buffer overflow in Solaris kcms_configure command allows local users to gain root access. VOTE:modify: source is CERT Advisory CERT CA-96.15, AusCERT Alert AL 96-02 ================================= Candidate: CAN-1999-0324 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hp-ppllog ppl program in HP-UX allows local users to create root files through symlinks. VOTE:modify: reference CIAC Bulletin H-31, HP Security Bulletin HPSBUX9702-053 ================================= Candidate: CAN-1999-0325 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hp-vhe vhe_u_mnt program in HP-UX allows local users to create root files through symlinks. VOTE:modify reference: HPSBUX9406-013 ================================= Candidate: CAN-1999-0331 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:msie-bo Buffer overflow in Internet Explorer 4.0(1) VOTE:recast, needs to be more specific. ================================= Candidate: CAN-1999-0332 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nt-netmeeting Buffer overflow in NetMeeting allows denial of service and remote command execution. VOTE:modify: reference: www.microsoft.com/windows/ie/security/netmbuff.asp, Knowledgebase Q184346 ================================= Candidate: CAN-1999-0335 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:lpr-bsd-lprbo Buffer overflow in BSD and linux lpr command allows local users to execute commands as root through the classification option. VOTE:modify, reference: AUSCERT Advisory AA-96.12 ================================= Candidate: CAN-1999-0336 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:hpux-mstm-bo Buffer overflow in mstm in HP-UX allows local users to gain root access. VOTE:noop, same as CAN-1999-0307, only ref I can find is an old SOD exploit on www.outpost9.com ================================= Candidate: CAN-1999-0340 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:linux-crond Buffer overflow in Linux Slackware crond program allows local users to gain root access. VOTE:noop, advisory comes from KSRT, KSR[T] Advisory #005 Date: Dec 6, 1997 ================================= Candidate: CAN-1999-0341 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:linux-deliver Buffer overflow in the Linux mail program "deliver" allows local users to gain root access. VOTE:noop, advisory comes from KSRT, Advisory #006 Date: Jan 14, 1998 ================================= Candidate: CAN-1999-0342 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:linux-pam-passwd-tmprace Linux PAM modules allow local users to gain root access using temporary files. VOTE:modify, one source from Bugtraq, another from http://www.redhat.com/corp/support/errata/rh42-errata-general.html#pam ================================= Candidate: CAN-1999-0343 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:palace-execute A malicious Palace server can force a client to execute arbitrary programs. VOTE:noop ================================= Candidate: CAN-1999-0344 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:nt-priv-fix NT users can gain debug-level access on a system process using the Sechole exploit. VOTE:modify, Source: MS Bulletin ms98-009 and Microssoft Knowledge Base article Q190288 ================================= Candidate: CAN-1999-0357 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: BUGTRAQ:Jan25,1999 Denial of service in Windows systems using malformed oshare packets. VOTE:noop ================================= Candidate: CAN-1999-0374 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: BUGTRAQ:Feb16,1999 Debian Linux cfengine package is susceptible to a symlink attack. VOTE: noop ================================= Candidate: CAN-1999-0468 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:ie-scriplet-fileread Reference: BUGTRAQ:Apr9,1999 Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component. VOTE:modify, Source: MS bulletin ms99-012 ================================= Candidate: CAN-1999-0471 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:winroute-config Reference: BUGTRAQ:Apr9,1999 The remote proxy server in Winroute allows a remote attacker to reconfigure the proxy without authentication through the "cancel" button. VOTE:noop ================================= Candidate: CAN-1999-0472 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:netcache-snmp Reference: BUGTRAQ:Apr7,1999 The SNMP default community name "public" is not properly removed in NetApps C630 Netcache, even if the administrator tries to disable it. VOTE:noop ================================= Candidate: CAN-1999-0473 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:rsync-permissions Reference: BUGTRAQ:Apr7,1999 The rsync command before rsync 2.3.1 may inadvertently change the permissions of the client's working directory to the permissions of the directory being transferred. VOTE:modify, Source: Caldera Security Advisory CSSA-1999:010.0 ================================= Candidate: CAN-1999-0474 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:icq-webserver-read Reference: BUGTRAQ:Apr5,1999 The ICQ Webserver allows remote attackers to use .. to access arbitrary files outside of the user's personal directory. VOTE:noop ================================= Candidate: CAN-1999-0475 Published: Final-Decision: Interim-Decision: Modified: Announced: 19990714 Assigned: 19990607 Category: SF Reference: XF:procmail-race Reference: BUGTRAQ:Apr5,1999 A race condition in how procmail handles .procmailrc files allows a local user to read arbitrary files available to the user who is running procmail. VOTE:noop -----BEGIN PGP SIGNATURE----- Version: PGP 6.0.2 iQA/AwUBN6iVEBIUaHPadf5hEQK8HACg0YZQYyf4AvO6MER+O0TU443zktUAoJX7 TdvtFMImSJmOFwul7dKBvsLg =qztC -----END PGP SIGNATURE-----
|
||||
