CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 505 | CVE-1999-0508 | Candidate | An account on a router, firewall, or other network device has a default, null, blank, or missing password. | Proposed (19990714) | ACCEPT(4) Baker, Meunier, Northcutt, Shostack | MODIFY(1) Frech | NOOP(1) Christey | Frech> Note: Because the distinction between network hardware and software is not | distinct, | the term "network device" was liberally interpreted. Feel free to reject any | of the | below terms. | XF:default-netranger | XF:cayman-gatorbox | XF:breezecom-default-passwords | XF:default-portmaster | XF:wingate-unpassworded | XF:netopia-unpassworded | XF:default-bay-switches | XF:motorola-cable-default-pass | XF:default-flowpoint | XF:qms-2060-no-root-password | XF:avirt-ras-password | XF:webtrends-rtp-serv-install-password | XF:cisco-bruteforce | XF:cisco-bruteadmin | XF:sambar-server-defaults | XF:management-pfcuser | XF:http-cgi-wwwboard-default | Christey> DELREF XF:avirt-ras-password - does not fit CVE-1999-0508. | View |
| 531 | CVE-1999-0534 | Candidate | A Windows NT user has inappropriate rights or privileges, e.g. Act as System, Add Workstation, Backup, Change System Time, Create Pagefile, Create Permanent Object, Create Token Name, Debug, Generate Security Audit, Increase Priority, Increase Quota, Load Driver, Lock Memory, Profile Single Process, Remote Shutdown, Replace Process Token, Restore, System Environment, Take Ownership, or Unsolicited Input. | Proposed (19990721) | ACCEPT(5) Baker, Christey, Ozancin, Shostack, Wall | MODIFY(2) Frech, Northcutt | Northcutt> If we are going to write a laundry list put access to the scheduler in it. | Christey> The list of privileges is very useful for lookup. | Frech> XF:nt-create-token | XF:nt-replace-token | XF:nt-lock-memory | XF:nt-increase-quota | XF:nt-unsol-input | XF:nt-act-system | XF:nt-create-object | XF:nt-sec-audit | XF:nt-add-workstation | XF:nt-manage-log | XF:nt-take-owner | XF:nt-load-driver | XF:nt-profile-system | XF:nt-system-time | XF:nt-single-process | XF:nt-increase-priority | XF:nt-create-pagefile | XF:nt-backup | XF:nt-restore | XF:nt-debug | XF:nt-system-env | XF:nt-remote-shutdown | View |
| 532 | CVE-1999-0535 | Candidate | A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness. | Proposed (19990721) | ACCEPT(2) Shostack, Wall | MODIFY(2) Baker, Frech | RECAST(2) Northcutt, Ozancin | Northcutt> inappropriate implies there is appropriate. As a guy who has been | monitoring | networks for years I have deep reservations about justiying the existance | of any fixed cleartext password. For appropriate to exist, some "we" would | have to establish some criteria for appropriate passwords. | Baker> Perhaps this could be re-worded a bit. The CVE CVE-1999-00582 | specifies "...settings for lockouts". To remain consistent with the | other, maybe it should specify "...settings for passwords" I think | most people would agree that passwords should be at least 8 | characters; contain letters (upper and lowercase), numbers and at | least one non-alphanumeric; should only be good a limited time 30-90 | days; and should not contain character combinations from user"s prior | 2 or 3 passwords. | Suggested rewrite - | A Windows NT account policy does not enforce reasonable minimum | security-critical settings for passwords, e.g. passwords of sufficient | length, periodic required password changes, or new password uniqueness | Ozancin> What is appropriate? | Frech> XF:nt-autologonpwd | XF:nt-pwlen | XF:nt-maxage | XF:nt-minage | XF:nt-pw-history | XF:nt-user-pwnoexpire | XF:nt-unknown-pwdfilter | XF:nt-pwd-never-expire | XF:nt-pwd-nochange | XF:nt-pwdcache-enable | XF:nt-guest-change-passwords | View |
| 536 | CVE-1999-0546 | Candidate | The Windows NT guest account is enabled. | Proposed (19990721) | ACCEPT(5) Baker, Northcutt, Ozancin, Shostack, Wall | MODIFY(1) Frech | Frech> XF:nt-guest-account | View |
| 557 | CVE-1999-0575 | Candidate | A Windows NT system"s user audit policy does not log an event success or failure, e.g. for Logon and Logoff, File and Object Access, Use of User Rights, User and Group Management, Security Policy Changes, Restart, Shutdown, and System, and Process Tracking. | Proposed (19990721) | ACCEPT(4) Christey, Ozancin, Shostack, Wall | MODIFY(1) Frech | RECAST(2) Baker, Northcutt | Northcutt> It isn"t a great truth that you should enable all or the above, if you | do you potentially introduce a vulnerbility of filling up the file | system with stuff you will never look at. | Ozancin> It is far less interesting what a user does successfully that what they | attempt and fail at. | Christey> The list of event types is very useful for lookup. | Frech> XF:nt-system-audit | XF:nt-logon-audit | XF:nt-object-audit | XF:nt-privil-audit | XF:nt-process-audit | XF:nt-policy-audit | XF:nt-account-audit | CHANGE> [Baker changed vote from REVIEWING to RECAST] | View |
Page 20525 of 20943, showing 5 records out of 104715 total, starting on record 102621, ending on 102625
