|
|
|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PROPOSAL] Cluster RECENT-15 - 29 candidates
The following cluster contains 29 candidates that were announced between March 26 and April 12, 2000. The candidates are listed in order of priority. Priority 1 and Priority 2 candidates both deal with varying levels of vendor confirmation, so they should be easy to review and it can be trusted that the problems are real. If you discover that any RECENT-XX cluster is incomplete with respect to the problems discovered during the associated time frame, please send that information to me so that candidates can be assigned. - Steve Summary of votes to use (in ascending order of "severity") ---------------------------------------------------------- ACCEPT - voter accepts the candidate as proposed NOOP - voter has no opinion on the candidate MODIFY - voter wants to change some MINOR detail (e.g. reference/description) REVIEWING - voter is reviewing/researching the candidate, or needs more info RECAST - candidate must be significantly modified, e.g. split or merged REJECT - candidate is "not a vulnerability", or a duplicate, etc. 1) Please write your vote on the line that starts with "VOTE: ". If you want to add comments or details, add them to lines after the VOTE: line. 2) If you see any missing references, please mention them so that they can be included. References help greatly during mapping. 3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes. So if you don't have sufficient information for a candidate but you don't want to NOOP, use a REVIEWING. ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ================================= Candidate: CAN-2000-0251 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: HP:HPSBUX0004-112 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0021.html Reference: BID:1090 Reference: URL:http://www.securityfocus.com/bid/1090 HP-UX 11.04 VirtualVault (VVOS) sends data to unprivileged processes via an interface that has multiple aliased IP addresses. ED_PRI CAN-2000-0251 1 VOTE: ================================= Candidate: CAN-2000-0258 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: MS:MS00-023 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-023.asp Reference: BID:1101 Reference: URL:http://www.securityfocus.com/bid/1101 IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability. ED_PRI CAN-2000-0258 1 VOTE: ================================= Candidate: CAN-2000-0277 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: MS:MS00-022 Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS00-022.asp Reference: BID:1087 Reference: URL:http://www.securityfocus.com/bid/1087 Microsoft Excel 97 and 2000 does not warn the user when executing Excel Macro Language (XLM) macros in external text files, which could allow an attacker to execute a macro virus, aka the "XLM Text Macro" vulnerability. ED_PRI CAN-2000-0277 1 VOTE: ================================= Candidate: CAN-2000-0294 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF/CF/MP/SA/AN/unknown Reference: FREEBSD:FreeBSD-SA-00:12 Reference: URL:http://www.securityfocus.com/templates/advisory.html?id=2162 Reference: BID:1107 Reference: URL:http://www.securityfocus.com/bid/1107 Buffer overflow in healthd for FreeBSD allows local users to gain root privileges. ED_PRI CAN-2000-0294 1 VOTE: ================================= Candidate: CAN-2000-0297 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: ALLAIRE:ASB00-06 Reference: URL:http://www2.allaire.com/handlers/index.cfm?ID=15099&Method=Full Reference: BID:1085 Reference: URL:http://www.securityfocus.com/bid/1085 Allaire Forums 2.0.5 allows remote attackers to bypass access restrictions to secure conferences via the rightAccessAllForums or rightModerateAllForums variables. ED_PRI CAN-2000-0297 1 VOTE: ================================= Candidate: CAN-2000-0261 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000415 (no subject) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0073.html Reference: BUGTRAQ:20000418 AVM's Statement Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=383085010.956159226625.JavaMail.root@web305-mc.mail.com Reference: BID:1103 Reference: URL:http://www.securityfocus.com/bid/1103 The AVM KEN! web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. ED_PRI CAN-2000-0261 2 VOTE: ================================= Candidate: CAN-2000-0262 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000415 (no subject) Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0073.html Reference: BUGTRAQ:20000418 AVM's Statement Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=383085010.956159226625.JavaMail.root@web305-mc.mail.com Reference: BID:1103 Reference: URL:http://www.securityfocus.com/bid/1103 The AVM KEN! ISDN Proxy server allows remote attackers to cause a denial of service via a malformed request. ED_PRI CAN-2000-0262 2 VOTE: ================================= Candidate: CAN-2000-0274 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000410 linux trustees 1.5 long path name vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0035.html Reference: MISC:http://www.braysystems.com/linux/trustees.html Reference: BID:1096 Reference: URL:http://www.securityfocus.com/bid/1096 The Linux trustees kernel patch allows attackers to cause a denial of service by accessing a file or directory with a long name. ED_PRI CAN-2000-0274 2 VOTE: ================================= Candidate: CAN-2000-0279 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000407 BeOS Networking DOS Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0029.html Reference: MISC:http://bebugs.be.com/devbugs/detail.php3?oid=2505312 Reference: BID:1100 Reference: URL:http://www.securityfocus.com/bid/1100 BeOS allows remote attackers to cause a denial of service via malformed packets whose length field is less than the length of the headers. ED_PRI CAN-2000-0279 2 VOTE: ================================= Candidate: CAN-2000-0255 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000405 SilverBack Security Advisory: Nbase-Xyplex DoS Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0022.html Reference: BID:1091 Reference: URL:http://www.securityfocus.com/bid/1091 The Nbase-Xyplex EdgeBlaster router allows remote attackers to cause a denial of service via a scan for the FormMail CGI program. ED_PRI CAN-2000-0255 3 VOTE: ================================= Candidate: CAN-2000-0259 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: CF Reference: MS:MS00-024 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-024.asp Reference: BID:1105 Reference: URL:http://www.securityfocus.com/bid/1105 The default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromise the cryptographic keys of other users. ED_PRI CAN-2000-0259 3 VOTE: ================================= Candidate: CAN-2000-0273 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000409 A funny way to DOS pcANYWHERE8.0 and 9.0 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0031.html Reference: BID:1095 Reference: URL:http://www.securityfocus.com/bid/1095 PCAnywhere allows remote attackers to cause a denial of service by terminating the connection before PCAnywhere provides a login prompt. ED_PRI CAN-2000-0273 3 VOTE: ================================= Candidate: CAN-2000-0275 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: L0PHT:20000410 CRYPTOCard PalmToken PIN Extraction Reference: URL:http://www.l0pht.com/advisories/cc-pinextract.txt Reference: BUGTRAQ:20000410 CRYPTOAdmin 4.1 server with PalmPilot PT-1 token 1.04 PIN Extract ion Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0033.html Reference: BID:1097 Reference: URL:http://www.securityfocus.com/bid/1097 CRYPTOCard CryptoAdmin for PalmOS uses weak encryption to store a user's PIN number, which allows an attacker with access to the .PDB file to generate valid PT-1 tokens after cracking the PIN. ED_PRI CAN-2000-0275 3 VOTE: ================================= Candidate: CAN-2000-0276 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000410 BeOS syscall bug Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000410131628.659.qmail@securityfocus.com Reference: BID:1098 Reference: URL:http://www.securityfocus.com/bid/1098 BeOS 4.5 and 5.0 allow local users to cause a denial of service via malformed direct system calls using interrupt 37. ED_PRI CAN-2000-0276 3 VOTE: ================================= Candidate: CAN-2000-0278 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000331 SalesLogix Eviewer Web App Bug: URL request crashes eviewer web application Reference: URL:http://archives.neohapsis.com/archives/bugtraq/current/0006.html Reference: BID:1089 Reference: URL:http://www.securityfocus.com/bid/1089 The SalesLogix Eviewer allows remote attackers to cause a denial of service by accessing the URL for the slxweb.dll administration program, which does not authenticate the user. ED_PRI CAN-2000-0278 3 VOTE: ================================= Candidate: CAN-2000-0280 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000403 Win32 RealPlayer 6/7 Buffer Overflow Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0018.html Reference: BID:1088 Reference: URL:http://www.securityfocus.com/bid/1088 Buffer overflow in the RealNetworks RealPlayer client versions 6 and 7 allows remote attackers to cause a denial of service via a long Location URL. ED_PRI CAN-2000-0280 3 VOTE: ================================= Candidate: CAN-2000-0281 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF/CF/MP/SA/AN/unknown Reference: BUGTRAQ:20000326 neat little napster bug Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-03/0277.html Reference: BUGTRAQ:20000330 Napster, Inc. response to Colten Edwards Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-03/0299.html Buffer overflow in the Napster client beta 5 allows remote attackers to cause a denial of service via a long message. ED_PRI CAN-2000-0281 3 VOTE: ================================= Candidate: CAN-2000-0282 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000412 TalentSoft Web+ Input Validation Bug Vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0050.html Reference: BID:1102 Reference: URL:http://www.securityfocus.com/bid/1102 TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. (dot dot) attack on the webplus CGI program. ED_PRI CAN-2000-0282 3 VOTE: ================================= Candidate: CAN-2000-0283 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: CF Reference: BUGTRAQ:20000412 Performance Copilot for IRIX 6.5 Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0056.html Reference: BID:1106 Reference: URL:http://www.securityfocus.com/bid/1106 The default installation of IRIX Performance Copilot allows remote attackers to access sensitive system information via the pmcd daemon. ED_PRI CAN-2000-0283 3 VOTE: ================================= Candidate: CAN-2000-0287 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000412 BizDB Search Script Enables Shell Command Execution at the Server Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0058.html Reference: BID:1104 Reference: URL:http://www.securityfocus.com/bid/1104 The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter. ED_PRI CAN-2000-0287 3 VOTE: ================================= Candidate: CAN-2000-0288 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000412 Infonautic's getdoc.cgi may allow unauthorized access to documents Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0049.html Infonautics getdoc.cgi allows remote attackers to bypass the payment phase for accessing documents via a modified form variable. ED_PRI CAN-2000-0288 3 VOTE: ================================= Candidate: CAN-2000-0289 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000327 Security Problems with Linux 2.2.x IP Masquerading Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-03/0284.html Reference: BID:1078 Reference: URL:http://www.securityfocus.com/bid/1078 IP masquerading in Linux 2.2.x allows remote attackers to route UDP packets through the internal interface by modifying the external source IP address and port number to match those of an established connection. ED_PRI CAN-2000-0289 3 VOTE: ================================= Candidate: CAN-2000-0290 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF/CF/MP/SA/AN/unknown Reference: BUGTRAQ:20000331 Webstar 4.0 Buffer overflow vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0005.html Buffer overflow in Webstar HTTP server allows remote attackers to cause a denial of service via a long GET request. ED_PRI CAN-2000-0290 3 VOTE: ================================= Candidate: CAN-2000-0296 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000331 fcheck v.2.7.45 and insecure use of Perl's system() Reference: URL:http://archives.neohapsis.com/archives/bugtraq/current/0011.html Reference: BID:1086 Reference: URL:http://www.securityfocus.com/bid/1086 fcheck allows local users to gain privileges by embedding shell metacharacters into file names that are processed by fcheck. ED_PRI CAN-2000-0296 3 VOTE: ================================= Candidate: CAN-2000-0298 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: CF Reference: NTBUGTRAQ:20000407 All Users startup folder left open if unattended install and OEMP reinstall=1 Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0027.html The unattended installation of Windows 2000 with the OEMPreinstall option sets insecure permissions for the All Users and Default Users directories. ED_PRI CAN-2000-0298 3 VOTE: ================================= Candidate: CAN-2000-0299 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000404 WebObjects DoS Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0020.html Buffer overflow in WebObjects.exe in the WebObjects Developer 4.5 package allows remote attackers to cause a denial of service via an HTTP request with long headers such as Accept. ED_PRI CAN-2000-0299 3 VOTE: ================================= Candidate: CAN-2000-0300 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000405 PcAnywhere weak password encryption Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000406030958.23902.qmail@securityfocus.com Reference: BID:1093 Reference: URL:http://www.securityfocus.com/bid/1093 The default encryption method of PcAnywhere 9.x uses weak encryption, which allows remote attackers to sniff and decrypt PcAnywhere or NT domain accounts. ED_PRI CAN-2000-0300 3 VOTE: ================================= Candidate: CAN-2000-0301 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000405 Re: IMAIL (Ipswitch) DoS with Eudora (Qualcomm) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95505800117143&w=2 Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95507019226096&w=2 Reference: BID:1094 Reference: URL:http://www.securityfocus.com/bid/1094 Ipswitch IMAIL server 6.02 and earlier allows remote attackers to cause a denial of service via the AUTH CRAM-MD5 command. ED_PRI CAN-2000-0301 3 VOTE: ================================= Candidate: CAN-2000-0302 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000426 Assigned: 20000426 Category: SF Reference: BUGTRAQ:20000331 Alert: MS Index Server (CISADV000330) Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95453598317340&w=2 Reference: MS:MS00-006 Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-006.asp Reference: BID:1084 Reference: URL:http://www.securityfocus.com/bid/1084 Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL. ED_PRI CAN-2000-0302 3 VOTE:
|
||||
