CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4584 | CVE-2002-0192 | Candidate | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2002-0193, CVE-2002-1564. Reason: This candidate was published with a description that identified a different vulnerability than what was identified in the original authoritative reference. Notes: Consult CVE-2002-0193 or CVE-2002-1564 to find the identifier for the proper issue. | Modified (20050204) | ACCEPT(5) Armstrong, Baker, Cole, Foat, Wall | MODIFY(1) Frech | NOOP(1) Cox | REJECT(1) Christey | Frech> XF:ie-content-disposition-variant(9085) | Christey> Hrmmm... the MS advisory says this is the "Script within | Cookies Reading Cookies" vulnerability... This description | was also used for CVE-2002-0193. | CHANGE> [Christey changed vote from NOOP to REJECT] | Christey> This CAN had the wrong description added to it, which made | it look like a different vulnerability than the one identified | by Microsoft in MS:MS02-023. Therefore this CAN should be | REJECTed. | View |
| 1899 | CVE-2000-0321 | Candidate | Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name. | Proposed (20000518) | ACCEPT(1) Levy | MODIFY(1) Frech | NOOP(4) Baker, Cole, LeBlanc, Wall | REJECT(1) Christey | Frech> XF:icradius-username-bo | Every reference I pull up shows the product"s name as ICRADIUS. See | http://mysql.eunet.fi/Downloads/Contrib/icradius.README | Christey> In a followup, Alan DeKok (aland@FREERADIUS.ORG) says that | this could occur in other RADIUS servers also; however, the | bug could only be exploited if someone has altered the | configuration file, which shouldn"t normally be modifiable | by anyone else. | | So, this should be REJECTed since the bug doesn"t directly give | anyone else any additional privileges or access. | Christey> Alan DeKok <aland@FREERADIUS.ORG> says it applies to other RADIUS | programs also, *however* since it needs a valid username, only | the RADIUS owner can exploit it by changing the config file. But | if the config file can be written by others - well, that"s still | a potential risk, but you"ve probably got bigger problems then. | - http://marc.theaimsgroup.com/?l=bugtraq&m=95671883515060&w=2 | Look at ChangeLog at ftp://ftp.cheapnet.net/pub/icradius/ChangeLog | | Possible confirmation in 0.15: "sql_getvpdata now dynamically | allocates buffer sizes for sql queries to avoid over runs" | | But that"s a bit general. | | Alan Kok said that Cistron and other RADIUS servers were affected; the | ICRADIUS changelog says to check the Cistron logs for other possible | bug fixes, since ICRADIUS uses Cistron codebase. Go back to | freeradius.org and find link to Cistron at | http://www.miquels.cistron.nl/radius/ | | Cistron changelog at http://www.miquels.cistron.nl/radius/ChangeLog It | has different version numbers - go back to ICRADIUS changelog to find | rought equivalents. ICRADIUS 0.15 uses Cistron 1.6.3 patches, so | start from there. | | No apparent problems in 1.6.3 or 1.6.4, but 1.6.1 says: "Fix all | strcpy(), strcat(), sprintf() and sccanf() calls for buffer | overflows." So perhaps the problem was fixed then? Or maybe the | vulnerable sscanf() call was missed and/or disregarded because it was | believed that the hostname could be trusted since it came from a | well-controlled configuration file? | View |
| 3185 | CVE-2001-0367 | Candidate | Mirabilis ICQ WebFront Plug-in ICQ2000b Build 3278 allows a remote attacker to create a denial of service via HTTP URL requests containing a large number of % characters. | Proposed (20010524) | ACCEPT(2) Baker, Cole | MODIFY(1) Frech | NOOP(3) Oliver, Wall, Ziese | REVIEWING(1) Williams | Frech> XF:icq-webfront-dos(6474) | In description, product name is spelled "Web Front" (2 | words). See http://www.icq.com/hpf/ | View |
| 1420 | CVE-1999-1440 | Candidate | Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is safe to open from the client. | Proposed (20010912) | ACCEPT(1) Cole | MODIFY(1) Frech | NOOP(2) Foat, Wall | Frech> XF:icq-long-filename(7564) | View |
| 4646 | CVE-2002-0254 | Candidate | ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and width values, which causes the crash when viewed in Userdetails. | Proposed (20020502) | MODIFY(1) Frech | NOOP(5) Armstrong, Cole, Cox, Foat, Wall | Frech> XF:icq-large-jpg-bo(8159) | View |
Page 159 of 20943, showing 5 records out of 104715 total, starting on record 791, ending on 795
