CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 215 | CVE-1999-0216 | Candidate | Denial of service of inetd on Linux through SYN and RST packets. | Modified (19991203-01) | ACCEPT(1) Hill | MODIFY(2) Baker, Frech | RECAST(1) Meunier | Meunier> The location of the vulnerability, whether in the Linux kernel or the | application, is debatable. Any program making the same (reasonnable) | assumption is vulnerable, i.e., implements the same vulnerability: | "Assumption that TCP-three-way handshake is complete after calling Linux | kernel function accept(), which returns socket after getting SYN. Result | is process death by SIGPIPE" | Moreover, whether it results in DOS (to third parties) depends on the | process that made the assumption. | I think that the present entry should be split, one entry for every | application that implements the vulnerability (really describing threat | instances, which is what other people think about when we talk about | vulnerabilities), and one entry for the Linux kernel that allows the | vulnerability to happen. | Frech> XF:hp-inetd | XF:linux-inetd-dos | Baker> Since we have an hpux bulletin, the description should not specifically say Linux, should it? It applies to mulitple OS and should be likely either modified, or in extreme case, recast | View |
| 214 | CVE-1999-0215 | Entry | Routed allows attackers to append data to files. | View | |||
| 213 | CVE-1999-0214 | Entry | Denial of service by sending forged ICMP unreachable packets. | View | |||
| 212 | CVE-1999-0213 | Candidate | libnsl in Solaris allowed an attacker to perform a denial of service of rpcbind. | Modified (20001009-01) | ACCEPT(6) Blake, Cole, Dik, Hill, Landfield, Ozancin | MODIFY(3) Baker, Frech, Levy | NOOP(4) Armstrong, Bishop, Meunier, Wall | REVIEWING(1) Christey | Frech> XF:sun-libnsl | Dik> Sun bug #4305859 | Baker> http://xforce.iss.net/static/1204.php Misc Defensive Info | http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/172&type=0&nav=sec.sba Vendor Info | http://www-1.ibm.com/services/continuity/recover1.nsf/advisories/A1050E354364BF498525680F0077E414/$file/ERS-OAR-E01-1998_074_1.txt Vendor Info | http://www.securityfocus.com/archive/1/9749 Misc Defensive Info | Christey> I don"t think this is the bug that everyone thinks it is. | This candidate came from CyberCop Scanner 2.4/2.5, which | only reports this as a DoS problem. If SUN:00172 is an | advisory for this, then it may be a duplicate of | CVE-1999-0055. There appears to be overlap with other | references as well. HOWEVER, this particular one deals with a | DoS in rpcbind - which isn"t mentioned in the sources for | CVE-1999-0055. | Levy> BID 148 | View |
| 211 | CVE-1999-0212 | Entry | Solaris rpc.mountd generates error messages that allow a remote attacker to determine what files are on the server. | View |
Page 20901 of 20943, showing 5 records out of 104715 total, starting on record 104501, ending on 104505
