|
|
|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PROPOSAL] Cluster 44 - RECENT-01 (40 candidates)
This cluster covers recently announced problems from November 24 through December 3. "Recent" clusters will be proposed on a weekly basis for the foreseeable future as we consider issues related to going live with candidate assignment. You are strongly encouraged to ensure that your database is kept up-to-date with respect to RECENT candidates; otherwise, you will face the same amount of effort it's already taken for you to bring your database up to speed with respect to legacy problems. Content decisions such as SF-LOC (multiple bugs in same code), SF-CODEBASE (same bug in multiple codebases), and SF-EXEC (same apparent bug in different executables from the same vendor) contributed to making this a larger number of candidates than one might usually encounter during a 2-week period. These CDs will be revisited and voted on once we've truly gone live with candidate assignment. They were originally scheduled for discussion in August, but we were handling larger questions then :-) See http://cve.mitre.org/archives/msg00366.html for a mostly-up-to-date summary of content decisions. - Steve Proposed: 12/8 Scheduled Proposed: 12/6 Scheduled Interim Decision: 12/20 Scheduled Final Decision: 12/24 Summary of votes to use (in ascending order of "severity"): ACCEPT - voter accepts the candidate as proposed NOOP - voter has no opinion on the candidate MODIFY - voter wants to change some MINOR detail (e.g. reference/description) REVIEWING - voter is reviewing/researching the candidate, or needs more info RECAST - candidate must be significantly modified, e.g. split or merged REJECT - candidate is "not a vulnerability", or a duplicate, etc. 1) Please write your vote on the line that starts with "VOTE: ". If you want to add comments or details, add them to lines after the VOTE: line. 2) If you see any missing references, please mention them so that they can be included. References help greatly during mapping. 3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes. So if you don't have sufficient information for a candidate but you don't want to NOOP, use a REVIEWING. ================================= Candidate: CAN-1999-0818 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 another hole of Solaris7 kcms_configure Reference: BID:831 Buffer overflow in Solaris kcms_configure via a long NETPATH environmental variable. VOTE: ================================= Candidate: CAN-1999-0819 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: NTBUGTRAQ:19991130 NTmail and VRFY Reference: BUGTRAQ:19991130 NTmail and VRFY NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it. VOTE: ================================= Candidate: CAN-1999-0820 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 Several FreeBSD-3.3 vulnerabilities Reference: BID:838 FreeBSD seyon allows users to gain privileges via a modified PATH variable for finding the xterm and seyon-emu commands. VOTE: ================================= Candidate: CAN-1999-0821 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 Several FreeBSD-3.3 vulnerabilities Reference: BID:838 FreeBSD seyon allows local users to gain privileges by providing a malicious program in the -emulator argument. VOTE: ================================= Candidate: CAN-1999-0822 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 serious Qpopper 3.0 vulnerability Reference: BUGTRAQ:19991130 qpop3.0b20 and below - notes and exploit Reference: BID:830 Buffer overflow in Qpopper (qpop) 3.0 allows remote root access via AUTH command. VOTE: ================================= Candidate: CAN-1999-0823 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:839 Reference: BUGTRAQ:19991130 Several FreeBSD-3.3 vulnerabilities Buffer overflow in FreeBSD xmindpath allows local users to gain privileges via -f argument. VOTE: ================================= Candidate: CAN-1999-0824 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:833 Reference: NTBUGTRAQ:19991130 SUBST problem Reference: BUGTRAQ:19991130 Subst.exe carelessness (fwd) A Windows NT user can use SUBST to map a drive letter to a folder, which is not unmapped after the user logs off, potentially allowing that user to modify the location of folders accessed by later users. VOTE: ================================= Candidate: CAN-1999-0825 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: CF Reference: BID:849 Reference: BUGTRAQ:19991203 UnixWare read/modify users' mail The default permissions for UnixWare /var/mail allow local users to read and modify other users' mail. VOTE: ================================= Candidate: CAN-1999-0826 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:840 Reference: BUGTRAQ:19991130 Several FreeBSD-3.3 vulnerabilities Buffer overflow in FreeBSD angband allows local users to gain privileges. VOTE: ================================= Candidate: CAN-1999-0827 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 Default IE 5.0 security settings allow frame spoofing By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing. VOTE: ================================= Candidate: CAN-1999-0828 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: unknown Reference: BUGTRAQ:19991203 UnixWare and the dacread permission Reference: BUGTRAQ:19991204 UnixWare pkg* command exploits UnixWare pkg commands such as pkginfo, pkgcat, and pkgparam allow local users to read arbitrary files via the dacread permission. VOTE: ================================= Candidate: CAN-1999-0829 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991201 HP Secure Web Console HP Secure Web Console uses weak encryption. VOTE: ================================= Candidate: CAN-1999-0830 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991126 [w00giving '99 #6]: UnixWare 7's Xsco Buffer overflow in SCO UnixWare Xsco command via a long argument. VOTE: ================================= Candidate: CAN-1999-0831 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 [david@slackware.com: New Patches for Slackware 4.0 Available] Denial of service in Slackware 4.0 syslogd via a large number of connections. VOTE: ================================= Candidate: CAN-1999-0832 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 [david@slackware.com: New Patches for Slackware 4.0 Available] Buffer overflow in Slackware 7.0 NFS server allows attackers to execute commands via a long pathname. VOTE: ================================= Candidate: CAN-1999-0834 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991201 Security Advisory: Buffer overflow in RSAREF2 Reference: BUGTRAQ:19991202 OpenBSD sslUSA26 advisory (Re: CORE-SDI: Buffer overflow in RSAREF2) Reference: BID:843 Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library. VOTE: ================================= Candidate: CAN-1999-0836 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991202 UnixWare 7 uidadmin exploit + discussion UnixWare uidadmin allows local users to modify arbitrary files via a symlink attack. VOTE: ================================= Candidate: CAN-1999-0838 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991202 Remote DoS Attack in Serv-U FTP-Server v2.5a Vulnerability Buffer overflow in Serv-U FTP 2.5 allows remote users to conduct a denial of service via the SITE command. VOTE: ================================= Candidate: CAN-1999-0840 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:832 Reference: BUGTRAQ:19991129 Solaris7 dtmail/dtmailpr/mailtool Buffer Overflow Buffer overflow in CDE dtmail and dtmailptr programs via the -f option. VOTE: ================================= Candidate: CAN-1999-0841 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:832 Reference: BUGTRAQ:19991129 Solaris7 dtmail/dtmailpr/mailtool Buffer Overflow Buffer overflow in CDE mailtool allows local users to gain root privilege via a long MIME Content-Type. VOTE: ================================= Candidate: CAN-1999-0842 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:827 Reference: NTBUGTRAQ:19991129 Symantec Mail-Gear 1.0 Web interface Server Directory Traversal Vulnerability Reference: BUGTRAQ:19991129 Symantec Mail-Gear 1.0 Web interface Server Directory Traversal Vulnerability Symantec Mail-Gear 1.0 web interface server allows remote users to read arbitrary files via a .. (dot dot) attack. VOTE: ================================= Candidate: CAN-1999-0843 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991104 Cisco NAT DoS (VD#1) Reference: BUGTRAQ:19991128 Re: Cisco NAT DoS (VD#1) Denial of service in Cisco routers running NAT via a PORT command from an FTP client to a Telnet port. VOTE: ================================= Candidate: CAN-1999-0844 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: NTBUGTRAQ:19991124 Remote DoS Attack in WorldClient Server v2.0.0.0 Vulnerability Reference: BUGTRAQ:19991130 Fwd: RE: Multiples Remotes DoS Attacks in MDaemon Server v2.8.5.0 Vulnerability Reference: BID:823 Reference: BID:820 Denial of service in MDaemon WorldClient and WebConfig services via a long URL. VOTE: ================================= Candidate: CAN-1999-0845 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991126 [w00giving '99 #5 and w00news]: UnixWare 7's su Reference: SCO:99.19 Reference: BUGTRAQ:19991128 SCO su patches Buffer overflow in SCO su program allows local users to gain root access via a long username. VOTE: ================================= Candidate: CAN-1999-0846 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991129 MDaemon 2.7 J DoS Reference: BUGTRAQ:19991130 Fwd: RE: Multiples Remotes DoS Attacks in MDaemon Server v2.8.5.0 Vulnerability Denial of service in MDaemon 2.7 via a large number of connection attempts. VOTE: ================================= Candidate: CAN-1999-0847 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991129 FICS buffer overflow Buffer overflow in free internet chess server (FICS) program, xboard. VOTE: ================================= Candidate: CAN-1999-0850 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: CF Reference: BID:845 Reference: BUGTRAQ:19991202 Insecure default permissions for MailMan Professional Edition, version 3.0.18 The default permissions for Endymion MailMan allow local users to read email or modify files. VOTE: ================================= Candidate: CAN-1999-0852 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: CF Reference: BID:844 Reference: BUGTRAQ:19991202 WebSphere protections from installation IBM WebSphere sets permissions that allow a local user to modify a deinstallation script or its data files stored in /usr/bin. VOTE: ================================= Candidate: CAN-1999-0853 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:847 Reference: ISS:Buffer Overflow in Netscape Enterprise and FastTrack Authentication Procedure Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication procedure. VOTE: ================================= Candidate: CAN-1999-0854 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: unknown Reference: BUGTRAQ:19991130 Ultimate Bulletin Board v5.3x? Bug Ultimate Bulletin Board stores data files in the cgi-bin directory, allowing remote attackers to view the data if an error occurs when the HTTP server attempts to execute the file. VOTE: ================================= Candidate: CAN-1999-0855 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:834 Reference: BUGTRAQ:19991130 FreeBSD 3.3 gated-3.1.5 local exploit Buffer overflow in FreeBSD gdc program. VOTE: ================================= Candidate: CAN-1999-0856 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991202 Slackware 7.0 - login bug login in Slackware 7.0 allows remote attackers to identify valid users on the system by reporting an encryption error when an account is locked or does not exist. VOTE: ================================= Candidate: CAN-1999-0857 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 FreeBSD 3.3 gated-3.1.5 local exploit Reference: BID:835 FreeBSD gdc program allows local users to modify files via a symlink attack. VOTE: ================================= Candidate: CAN-1999-0859 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 Solaris 2.x chkperm/arp vulnerabilities Reference: BID:837 Solaris arp allows local users to read files via the -f parameter, which lists lines in the file that do not parse properly. VOTE: ================================= Candidate: CAN-1999-0860 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991130 Solaris 2.x chkperm/arp vulnerabilities Reference: BID:837 Solaris chkperm allows local users to read files owned by bin via the VMSYS environmental variable and a symlink attack. VOTE: ================================= Candidate: CAN-1999-0862 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: CF Reference: BUGTRAQ:19991202 PostgreSQL RPM's permission problems Insecure directory permissions in RPM distribution for PostgreSQL allows local users to gain privileges by reading a plaintext password file. VOTE: ================================= Candidate: CAN-1999-0863 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19970617 Seyon vulnerability - IRIX Reference: BUGTRAQ:19991108 FreeBSD 3.3's seyon vulnerability Reference: BUGTRAQ:19991130 Several FreeBSD-3.3 vulnerabilities Buffer overflow in FreeBSD seyon via HOME environmental variable, -emulator argument, -modems argument, or the GUI. VOTE: ================================= Candidate: CAN-1999-0864 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991202 UnixWare coredumps follow symlinks Reference: BID:851 UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file. VOTE: ================================= Candidate: CAN-1999-0865 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BUGTRAQ:19991203 CommuniGatePro 3.1 for NT DoS Buffer overflow in CommuniGatePro via a long string to the HTTP configuration port. VOTE: ================================= Candidate: CAN-1999-0866 Published: Final-Decision: Interim-Decision: Modified: Proposed: 19991208 Assigned: 19991207 Category: SF Reference: BID:848 Reference: BUGTRAQ:19991203 UnixWare gain root with non-su/gid binaries Buffer overflow in UnixWare xauto program allows local users to gain root privilege. VOTE:
|
||||
