CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 245 | CVE-1999-0246 | Candidate | HP Remote Watch allows a remote user to gain root access. | Proposed (19990630) | ACCEPT(4) Frech, Hill, Northcutt, Prosser | NOOP(1) Baker | RECAST(1) Christey | Frech> Comment: Determine if it"s RemoteWatch or Remote Watch. | Christey> HP:HPSBUX9610-039 alludes to multiple vulnerabilities in | Remote Watch (the advisory uses two words, not one, for the | "Remote Watch" name) | | ADDREF BUGTRAQ:19961015 HP/UX Remote Watch (was Re: BoS: SOD remote exploit) | URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=199610151351.JAA18241@grymoire.crd.ge.com | Prosser> agree that the advisory mentions two vulnerabilities in Remote | Watch, one being a socket connection and other with the showdisk utility | which seems to be a suid vulnerability. Never get much details on this | anywhere since the recommendation is to remove the program since it is | obsolete and superceded by later tools. Believe the biggest concern here is | to just not run the tool at all. | Christey> CIAC:H-16 | Also, http://www.cert.org/vendor_bulletins/VB-96.20.hp | And possibly AUSCERT:AA-96.07 at | ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-96.07.HP-UX.Remote.Watch.vul | Christey> Also BUGTRAQ:19961013 BoS: SOD remote exploit | http://marc.theaimsgroup.com/?l=bugtraq&m=87602167419969&w=2 | Include "remwatch" in the description to facilitate search. | View |
| 244 | CVE-1999-0245 | Entry | Some configurations of NIS+ in Linux allowed attackers to log in as the user "+". | View | |||
| 243 | CVE-1999-0244 | Entry | Livingston RADIUS code has a buffer overflow which can allow remote execution of commands as root. | View | |||
| 242 | CVE-1999-0243 | Candidate | Linux cfingerd could be exploited to gain root access. | Proposed (19990714) | ACCEPT(1) Shostack | NOOP(4) Baker, Levy, Northcutt, Wall | REJECT(2) Christey, Frech | Christey> This has no sources; neither does the original database that | this entry came from. It"s a likely duplicate of | CVE-1999-0813. | Frech> I disagree on the dupe; see Linux-Security Mailing List, | "[linux-security] Cfinger (Yet more :)" at | http://www.geocrawler.com/archives/3/92/1996/9/0/2217716/. Seems as | if v1.2.3 is vulnerable, perhaps 1.3.0 also. CVE-1999-0813 pertains | to 1.4.x and below and shows up two years later. | CHANGE> [Frech changed vote from REVIEWING to REJECT] | Frech> If the reference I previously supplied is correct, then | it appears as if the poster modified the source using authorized | access to make it vulnerable. Modifying the source in this manner | does not qualify as being listed a vulnerability. | I disagree on the dupe; see Linux-Security Mailing List, | "[linux-security] Cfinger (Yet more :)" at | http://www.geocrawler.com/archives/3/92/1996/9/0/2217716/. Seems as | if v1.2.3 is vulnerable, perhaps 1.3.0 also. CVE-1999-0813 pertains | to 1.4.x and below and shows up two years later. | View |
| 241 | CVE-1999-0242 | Candidate | Remote attackers can access mail files via POP3 in some Linux systems that are using shadow passwords. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(4) Christey, Northcutt, Shostack, Wall | REVIEWING(1) Levy | Frech> Ambiguous description: need more detail. Possibly: | XF:linux-pop3d (mktemp() leads to reading e-mail) | Christey> At first glance this might look like CVE-1999-0123 or | CVE-1999-0125, however this particular candidate arises out | of a brief mention of the problem in a larger posting which | discusses CVE-1999-0123 (which may be the same bug as | CVE-1999-0125). See the following phrase in the Bugtraq | post: "one such example of this is in.pop3d" | | However, the original source of this candidate"s description | explicitly mentions shadowed passwords, though it has no | references to help out here. | View |
Page 20895 of 20943, showing 5 records out of 104715 total, starting on record 104471, ending on 104475
