CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 2669 | CVE-2000-1102 | Candidate | PTlink IRCD 3.5.3 and PTlink Services 1.8.1 allow remote attackers to cause a denial of service (server crash) via "mode +owgscfxeb" and "oper" commands. | Proposed (20001219) | ACCEPT(2) Baker, Cole | MODIFY(1) Frech | NOOP(1) Wall | Frech> XF:ptlink-ircd-mode-dos(5589) | View |
| 358 | CVE-1999-0359 | Candidate | ptylogin in Unix systems allows users to perform a denial of service by locking out modems, dial out with that modem, or obtain passwords. | Proposed (20010214) | ACCEPT(2) Cole, Frech | MODIFY(1) Baker | Frech> XF:ptylogin-dos | Baker> Should say "... lock out a modem, ..." rather than "... locking out modems..." | View |
| 249 | CVE-1999-0250 | Candidate | Denial of service in Qmail through long SMTP commands. | Modified (20010301-01) | ACCEPT(2) Hill, Meunier | MODIFY(1) Frech | REJECT(1) Baker | REVIEWING(1) Christey | Frech> XF:qmail-rcpt | Christey> DUPE CVE-1999-0418 and CVE-1999-0144? | Christey> Dan Bernstein, author of Qmail, says that this is not a | vulnerability in qmail because Unix has built-in resource | limits that can restrict the size of a qmail process; other | limits can be specified by the administrator. See | http://cr.yp.to/qmail/venema.html | | Significant discussion of this issue took place on the qmail | list. The fundamental question appears to be whether | application software should set its own limits, or rely | on limits set by the parent operating system (in this case, | UNIX). Also, some people said that the only problem was that | the suggested configuration was not well documented, but this | was refuted by others. | | See the following threads at | http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/threads.html | "Denial of service (qmail-smtpd)" | "qmail-dos-2.c, another denial of service" | "[PATCH] denial of service" | "just another qmail denial-of-service" | "the UNIX way" | "Time for a reality check" | | Also see Bugtraq threads on a different vulnerability that | is related to this topic: | BUGTRAQ:19990903 Web servers / possible DOS Attack / mime header flooding | http://archives.neohapsis.com/archives/bugtraq/1998_3/0742.html | Baker> This appears to be the same vulnerability listed in CAN 1999-0144. In reading | through both bugtraq postings, the one that is referenced by 0144 is | based on a shell code exploit to cause memory exhaustion. The bugtraq | posting referenced by this entry refers explicitly to the prior | posting for 0144, and states that the same effect could be | accomplished by a perl exploit, which was then attached. | Baker> http://www.securityfocus.com/archive/1/6969 CVE-1999-0144 | http://www.securityfocus.com/archive/1/6970 CVE-1999-0250 | | Both references should be added to CVE-1999-0144, and CVE-1999-0250 | should likely be rejected. | CHANGE> [Baker changed vote from REVIEWING to REJECT] | Christey> XF:qmail-leng no longer exists; check with Andre to see if they | regarded it as a duplicate as well. | | qmail-dos-1.c, as published by Wietse Venema (CVE-1999-0250) | in "BUGTRAQ:19970612 Denial of service (qmail-smtpd)", does not | use any RCPT commands. Instead, it sends long strings | of "X" characters. A followup by "super@UFO.ORG" includes | an exploit that claims to do the same thing; however, that | exploit does not send long strings of X characters - it sends | a large number of RCPT commands. It appears that super@ufo.org | followed up to the wrong message. | | qmail-dos-2.c, as published by Wietse Venema (CVE-1999-0144) | in "BUGTRAQ:19970612 qmail-dos-2.c, another denial of service attack" | sends a large number of RCPT commands. | | ADDREF BUGTRAQ:19970612 Denial of service (qmail-smtpd) | ADDREF BUGTRAQ:19970612 qmail-dos-2.c, another denial of service attack | | Also see a related thread: | BUGTRAQ:19990308 SMTP server account probing | http://marc.theaimsgroup.com/?l=bugtraq&m=92100018214316&w=2 | | This also describes a problem with mail servers not being able | to handle too many "RCPT TO" requests. A followup message | notes that application-level protection is used in Sendmail | to prevent this: | BUGTRAQ:19990309 Re: SMTP server account probing | http://marc.theaimsgroup.com/?l=bugtraq&m=92101584629263&w=2 | The person further says, "This attack can easily be | prevented with configuration methods." | View |
| 3146 | CVE-2001-0325 | Candidate | Buffer overflow in QNX RTP 5.60 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large number of arguments to the stat command. | Proposed (20010404) | MODIFY(1) Frech | NOOP(3) Cole, Wall, Ziese | REVIEWING(1) Bishop | Frech> XF:qnx-rtp-ftpd-bo(6442) | View |
| 1828 | CVE-2000-0250 | Candidate | The crypt function in QNX uses weak encryption, which allows local users to decrypt passwords. | Proposed (20000426) | ACCEPT(2) Baker, Levy | MODIFY(1) Frech | NOOP(2) Cole, Wall | Frech> XF:qnx-weak-encryption(4866) | View |
Page 20843 of 20943, showing 5 records out of 104715 total, starting on record 104211, ending on 104215
