CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1877 | CVE-2000-0299 | Candidate | Buffer overflow in WebObjects.exe in the WebObjects Developer 4.5 package allows remote attackers to cause a denial of service via an HTTP request with long headers such as Accept. | Proposed (20000426) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Cole, Wall, Williams | REVIEWING(1) Levy | Christey> ADDREF XF:webobjects-post-dos | Frech> XF:webobjects-post-dos | Christey> See http://til.info.apple.com/techinfo.nsf/artnum/n75087 | Document says: | "A request with a large, malformed http header can crash a WOApp" | (Apple reference #2470254) appears to be the acknowledgement needed. | | Is this sufficient acknowledgement? This is dated AUgust 24, | but the initial disclosure occurred on April 4. | Christey> BID:1896 | View |
| 1878 | CVE-2000-0300 | Candidate | The default encryption method of PcAnywhere 9.x uses weak encryption, which allows remote attackers to sniff and decrypt PcAnywhere or NT domain accounts. | Proposed (20000426) | ACCEPT(4) Baker, Cole, Levy, Prosser | MODIFY(1) Frech | REVIEWING(1) Wall | Frech> XF:pcanywhere-weak-encryption | Prosser> http://service2.symantec.com/SUPPORT/pca.nsf/pfdocs/1999022312571812 | Upgraded in pcA 10 | View |
| 1895 | CVE-2000-0317 | Candidate | Buffer overflow in Solaris 7 lpset allows local users to gain root privileges via a long -r option. | Proposed (20000518) | ACCEPT(3) Baker, Cole, Levy | MODIFY(1) Frech | NOOP(3) Christey, LeBlanc, Wall | RECAST(1) Dik | Dik> there"s a lot of confusion in this one. | These point to buffer overflows: | Reference: BUGTRAQ:20000424 Solaris 7 x86 lpset exploit. | Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0192.html | Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0236.html | But these point to dlopen() in libprint that doesnt" check pathnames: | Reference: BUGTRAQ:20000427 Re: Solaris/SPARC 2.7 lpset exploit (well not likely !) | Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95729763119559&w=2 | Reference: SUNBUG:4334568 | And this is a bufferoverflow again: | Reference: BID:1138 | Reference: URL:http://www.securityfocus.com/bid/1138 | Frech> XF:solaris-lpset-bo | Christey> ADDREF SUN:00195? Need to check with Casper. | View |
| 1899 | CVE-2000-0321 | Candidate | Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name. | Proposed (20000518) | ACCEPT(1) Levy | MODIFY(1) Frech | NOOP(4) Baker, Cole, LeBlanc, Wall | REJECT(1) Christey | Frech> XF:icradius-username-bo | Every reference I pull up shows the product"s name as ICRADIUS. See | http://mysql.eunet.fi/Downloads/Contrib/icradius.README | Christey> In a followup, Alan DeKok (aland@FREERADIUS.ORG) says that | this could occur in other RADIUS servers also; however, the | bug could only be exploited if someone has altered the | configuration file, which shouldn"t normally be modifiable | by anyone else. | | So, this should be REJECTed since the bug doesn"t directly give | anyone else any additional privileges or access. | Christey> Alan DeKok <aland@FREERADIUS.ORG> says it applies to other RADIUS | programs also, *however* since it needs a valid username, only | the RADIUS owner can exploit it by changing the config file. But | if the config file can be written by others - well, that"s still | a potential risk, but you"ve probably got bigger problems then. | - http://marc.theaimsgroup.com/?l=bugtraq&m=95671883515060&w=2 | Look at ChangeLog at ftp://ftp.cheapnet.net/pub/icradius/ChangeLog | | Possible confirmation in 0.15: "sql_getvpdata now dynamically | allocates buffer sizes for sql queries to avoid over runs" | | But that"s a bit general. | | Alan Kok said that Cistron and other RADIUS servers were affected; the | ICRADIUS changelog says to check the Cistron logs for other possible | bug fixes, since ICRADIUS uses Cistron codebase. Go back to | freeradius.org and find link to Cistron at | http://www.miquels.cistron.nl/radius/ | | Cistron changelog at http://www.miquels.cistron.nl/radius/ChangeLog It | has different version numbers - go back to ICRADIUS changelog to find | rought equivalents. ICRADIUS 0.15 uses Cistron 1.6.3 patches, so | start from there. | | No apparent problems in 1.6.3 or 1.6.4, but 1.6.1 says: "Fix all | strcpy(), strcat(), sprintf() and sccanf() calls for buffer | overflows." So perhaps the problem was fixed then? Or maybe the | vulnerable sscanf() call was missed and/or disregarded because it was | believed that the hostname could be trusted since it came from a | well-controlled configuration file? | View |
| 1904 | CVE-2000-0326 | Candidate | Meeting Maker uses weak encryption (a polyalphabetic substitution cipher) for passwords, which allows remote attackers to sniff and decrypt passwords for Meeting Maker accounts. | Proposed (20000518) | ACCEPT(2) Baker, Levy | MODIFY(1) Frech | NOOP(4) Christey, Cole, LeBlanc, Wall | Frech> XF:meetingmaker-weak-encryption | Christey> Add original Bugtraq reference at: | http://archives.neohapsis.com/archives/bugtraq/2000-04/0223.html | Also ADDREF XF:meetingmaker-weak-encryption | View |
Page 20577 of 20943, showing 5 records out of 104715 total, starting on record 102881, ending on 102885
