CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 646 | CVE-1999-0664 | Candidate | An application-critical Windows NT registry key has inappropriate permissions. | Proposed (19990803) | ACCEPT(1) Wall | NOOP(1) Baker | RECAST(2) Christey, Northcutt | Northcutt> I think we can define appropriate, take a look at the nt security .pdf | and see if you can"t see a way to phrase specific keys in a way that | defines inappropriate. | Christey> Upon further reflection, this is too high-level for CVE. | Specific registry keys with bad permissions is roughly | equivalent to Unix configuration files that have bad | permissions; those permission problems can be created by | any vendor, not just a specific one. Therefore this | candidate should be RECAST into each separate registry | key that has this problem. | View |
| 647 | CVE-1999-0665 | Candidate | An application-critical Windows NT registry key has an inappropriate value. | Proposed (19990803) | ACCEPT(1) Wall | NOOP(1) Baker | RECAST(1) Northcutt | Northcutt> I think we can define appropriate, take a look at the nt security .pdf | and see if you can"t see a way to phrase specific keys in a way that | defines inappropriate. | Baker> very vague | View |
| 648 | CVE-1999-0667 | Candidate | The ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service. | Proposed (19991222) | ACCEPT(2) Blake, Cole | MODIFY(1) Stracener | NOOP(2) Baker, Christey | REJECT(1) Frech | Stracener> Add Ref: BUGTRAQ:19970919 Playing redir games with ARP and ICMP | Frech> Cannot proceed without a reference. Too vague, and resembles XF:netbsd-arp: | CVE-1999-0763: NetBSD on a multi-homed host allows ARP packets on one | network to modify ARP entries on another connected network. | CVE-1999-0764: NetBSD allows ARP packets to overwrite static ARP entries. | Will reconsider if reference provides enough information to render a | distinction. | Christey> This particular vulnerability was exploited by an attacker | during the ID"Net IDS test network exercise at the SANS | Network Security "99 conference. The attacker adapted a | publicly available program that was able to spoof another | machine on the same physical network. | | See http://marc.theaimsgroup.com/?l=bugtraq&m=87602880019797&w=2 | for the Bugtraq reference that Tom Stracener suggested. | This generated a long thread on Bugtraq in 1997. | Blake> I"ll second Tom"s request to add the reference, it"s a very | posting good and the vulnerability is clearly derivative of | the work. | | (I do recall talking to the guy and drafting a description.) | View |
| 649 | CVE-1999-0668 | Entry | The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy. | View | |||
| 650 | CVE-1999-0669 | Candidate | The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy. | Interim (19991229) | ACCEPT(5) Baker, Cole, Ozancin, Prosser, Wall | MODIFY(2) Frech, Stracener | REVIEWING(1) Christey | Frech> XF:ms-scriptlet-eyedog-unsafe | Stracener> Add Ref: MSKB Q240308 | Christey> Should CVE-1999-0669 and 668 be merged? If not, then this is | a reason for not merging CVE-1999-0988 and CVE-1999-0828. | View |
Page 130 of 20943, showing 5 records out of 104715 total, starting on record 646, ending on 650
