CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 221 | CVE-1999-0222 | Candidate | Denial of service in Cisco IOS web server allows attackers to reboot the router using a long URL. | Proposed (19990714) | ACCEPT(1) Baker | MODIFY(3) Frech, Levy, Shostack | NOOP(3) Balinsky, Northcutt, Wall | RECAST(1) Ziese | REJECT(1) Christey | Shostack> I follow cisco announcements and problems pretty closely, and haven"t | seen this. Source? | Frech> XF:cisco-web-crash | Christey> XF:cisco-web-crash has no additional references. I can"t find | any references in Bugtraq or Cisco either. This bug is | supposedly tested by at least one security product, but that | product"s database doesn"t have any references either. So | a question becomes, how did it make it into at least two | security companies" databases? | Levy> BUGTGRAQ: http://www.securityfocus.com/archive/1/60159 | BID 1154 | Ziese> The vulnerability is addressed by a vendor acknowledgement. This one, if | recast to reflect that "...after using a long url..." should be replaced | with | "...A defect in multiple releases of Cisco IOS software will cause a Cisco | router or switch to halt and reload if the IOS HTTP service is enabled, | browsing to "http://router-ip/anytext?/" is attempted, and the enable | password is supplied when requested. This defect can be exploited to produce | a denial of service (DoS) attack." | Then I can accept this and mark it as "Verfied by my Company". If it can"t | be recast because this (long uri) is diffferent then our release (special | url construction). | CHANGE> [Christey changed vote from REVIEWING to REJECT] | Christey> Elias Levy"s suggested reference is CVE-2000-0380. | I don"t think that Kevin"s description is really addressing | this either. The lack of references and a specific | description make this candidate unusable, so it should be | rejected. | View |
| 242 | CVE-1999-0243 | Candidate | Linux cfingerd could be exploited to gain root access. | Proposed (19990714) | ACCEPT(1) Shostack | NOOP(4) Baker, Levy, Northcutt, Wall | REJECT(2) Christey, Frech | Christey> This has no sources; neither does the original database that | this entry came from. It"s a likely duplicate of | CVE-1999-0813. | Frech> I disagree on the dupe; see Linux-Security Mailing List, | "[linux-security] Cfinger (Yet more :)" at | http://www.geocrawler.com/archives/3/92/1996/9/0/2217716/. Seems as | if v1.2.3 is vulnerable, perhaps 1.3.0 also. CVE-1999-0813 pertains | to 1.4.x and below and shows up two years later. | CHANGE> [Frech changed vote from REVIEWING to REJECT] | Frech> If the reference I previously supplied is correct, then | it appears as if the poster modified the source using authorized | access to make it vulnerable. Modifying the source in this manner | does not qualify as being listed a vulnerability. | I disagree on the dupe; see Linux-Security Mailing List, | "[linux-security] Cfinger (Yet more :)" at | http://www.geocrawler.com/archives/3/92/1996/9/0/2217716/. Seems as | if v1.2.3 is vulnerable, perhaps 1.3.0 also. CVE-1999-0813 pertains | to 1.4.x and below and shows up two years later. | View |
| 498 | CVE-1999-0501 | Candidate | A Unix account has a guessable password. | Proposed (19990714) | ACCEPT(3) Baker, Northcutt, Shostack | RECAST(2) Frech, Meunier | REVIEWING(1) Christey | Frech> Guessable falls into the class of CVE-1999-0502, since I can guess a | default, null, etc. password. | Suggest changing to something like "has an existing non-default password | that can be guessed." | I"m also including default passwords in this entry. | In that vein, we show the following references: | XF:user-password | XF:passwd-username | XF:default-unix-sync | XF:default-unix-4dgifts | XF:default-unix-bin | XF:default-unix-daemon | XF:default-unix-lp | XF:default-unix-me | XF:default-unix-nuucp | XF:default-unix-root | XF:default-unix-toor | XF:default-unix-tour | XF:default-unix-tty | XF:default-unix-uucp | Christey> This candidate is affected by the CD:CF-PASS content decision, | which determines the appropriate level of abstraction to | use for password problems. CD:CF-PASS needs to be accepted | by the Editorial Board before this candidate can be | converted into a CVE entry; the final version of CD:CF-PASS | may require using a different LOA than this candidate is | currently using. | CHANGE> [Meunier changed vote from ACCEPT to RECAST] | Meunier> This relates only to account password technology, so this candidate is | independent of the operating system, application, web site or other | application of this technology. The appropriate (natural) level of | abstraction is therefore without specifying that it is for UNIX. | Change the description to "An account has a guessable password other | than default, null, blank." This should satisfy Andre"s objection. | | This Candidate should be merged with any candidate relating to | account password technology where "Unix" in the original description | can be replaced by something else. | View |
| 499 | CVE-1999-0502 | Candidate | A Unix account has a default, null, blank, or missing password. | Proposed (19990714) | ACCEPT(4) Baker, Meunier, Northcutt, Shostack | MODIFY(1) Frech | REVIEWING(1) Christey | Frech> XF:passwd-blank | XF:no-pass | XF:dict | XF:sgi-accounts | XF:linux-caldera-lisa | Christey> This candidate is affected by the CD:CF-PASS content decision, | which determines the appropriate level of abstraction to | use for password problems. CD:CF-PASS needs to be accepted | by the Editorial Board before this candidate can be | converted into a CVE entry; the final version of CD:CF-PASS | may require using a different LOA than this candidate is | currently using. | View |
| 500 | CVE-1999-0503 | Candidate | A Windows NT local user or administrator account has a guessable password. | Proposed (19990714) | ACCEPT(4) Baker, Meunier, Northcutt, Shostack | MODIFY(1) Frech | REVIEWING(1) Christey | Frech> Note: I am assuming that this entry includes Windows 2000 accounts and | machine/service accounts listed in User Manager. | XF:nt-guess-admin | XF:nt-guess-user | XF:nt-guess-guest | XF:nt-guessed-operpwd | XF:nt-guessed-powerwd | XF:nt-guessed-disabled | XF:nt-guessed-backup | XF:nt-guessed-acctoper-pwd | XF:nt-adminuserpw | XF:nt-guestuserpw | XF:nt-accountuserpw | XF:nt-operator-userpw | XF:nt-service-user-pwd | XF:nt-server-oper-user-pwd | XF:nt-power-user-pwd | XF:nt-backup-operator-userpwd | XF:nt-disabled-account-userpwd | Christey> This candidate is affected by the CD:CF-PASS content decision, | which determines the appropriate level of abstraction to | use for password problems. CD:CF-PASS needs to be accepted | by the Editorial Board before this candidate can be | converted into a CVE entry; the final version of CD:CF-PASS | may require using a different LOA than this candidate is | currently using. | View |
Page 20523 of 20943, showing 5 records out of 104715 total, starting on record 102611, ending on 102615
