CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 517 | CVE-1999-0520 | Candidate | A system-critical NETBIOS/SMB share has inappropriate access control. | Proposed (19990803) | ACCEPT(1) Wall | MODIFY(1) Frech | NOOP(1) Baker | RECAST(1) Northcutt | REJECT(1) LeBlanc | REVIEWING(1) Christey | Northcutt> I think we need to enumerate the shares and or the access control | Christey> One question is, what is "inappropriate"? It"s probably | very dependent on the policy of the enterprise on which | this is found. And should writable shares be different | from readable shares? (Or file systems, mail spools, etc.) | Yes, the impact may be different, but we could have a | large number of entries for each possible type of access. | A content decision (CD:CF-DATA) needs to be reviewed | and accepted by the Editorial Board in order to resolve | this question. | LeBlanc> Unacceptably vague - agree with Christey"s comments. | Frech> associated to: | XF:nt-netbios-everyoneaccess(1) | XF:nt-netbios-guestaccess(2) | XF:nt-netbios-allaccess(3) | XF:nt-netbios-open(15) | XF:nt-netbios-write(19) | XF:nt-netbios-shareguest(20) | XF:nt-writable-netbios(26) | XF:nb-rootshare(393) | XF:decod-smb-password-empty(2358) | View |
| 546 | CVE-1999-0560 | Candidate | A system-critical Windows NT file or directory has inappropriate permissions. | Proposed (19990803) | ACCEPT(2) Baker, Wall | RECAST(1) Northcutt | Northcutt> I think we should specify these | View |
| 570 | CVE-1999-0588 | Candidate | A filter in a router or firewall allows unusual fragmented packets. | Proposed (19990726) | MODIFY(2) Baker, Frech | REJECT(1) Northcutt | Northcutt> I want to vote to accept this one, but unusual is a shade broad. | Frech> XF:nt-rras | XF:cisco-fragmented-attacks | XF:ip-frag | Baker> Perhaps we should use the word abnormally fragmented or some other descriptor. | View |
| 531 | CVE-1999-0534 | Candidate | A Windows NT user has inappropriate rights or privileges, e.g. Act as System, Add Workstation, Backup, Change System Time, Create Pagefile, Create Permanent Object, Create Token Name, Debug, Generate Security Audit, Increase Priority, Increase Quota, Load Driver, Lock Memory, Profile Single Process, Remote Shutdown, Replace Process Token, Restore, System Environment, Take Ownership, or Unsolicited Input. | Proposed (19990721) | ACCEPT(5) Baker, Christey, Ozancin, Shostack, Wall | MODIFY(2) Frech, Northcutt | Northcutt> If we are going to write a laundry list put access to the scheduler in it. | Christey> The list of privileges is very useful for lookup. | Frech> XF:nt-create-token | XF:nt-replace-token | XF:nt-lock-memory | XF:nt-increase-quota | XF:nt-unsol-input | XF:nt-act-system | XF:nt-create-object | XF:nt-sec-audit | XF:nt-add-workstation | XF:nt-manage-log | XF:nt-take-owner | XF:nt-load-driver | XF:nt-profile-system | XF:nt-system-time | XF:nt-single-process | XF:nt-increase-priority | XF:nt-create-pagefile | XF:nt-backup | XF:nt-restore | XF:nt-debug | XF:nt-system-env | XF:nt-remote-shutdown | View |
| 532 | CVE-1999-0535 | Candidate | A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness. | Proposed (19990721) | ACCEPT(2) Shostack, Wall | MODIFY(2) Baker, Frech | RECAST(2) Northcutt, Ozancin | Northcutt> inappropriate implies there is appropriate. As a guy who has been | monitoring | networks for years I have deep reservations about justiying the existance | of any fixed cleartext password. For appropriate to exist, some "we" would | have to establish some criteria for appropriate passwords. | Baker> Perhaps this could be re-worded a bit. The CVE CVE-1999-00582 | specifies "...settings for lockouts". To remain consistent with the | other, maybe it should specify "...settings for passwords" I think | most people would agree that passwords should be at least 8 | characters; contain letters (upper and lowercase), numbers and at | least one non-alphanumeric; should only be good a limited time 30-90 | days; and should not contain character combinations from user"s prior | 2 or 3 passwords. | Suggested rewrite - | A Windows NT account policy does not enforce reasonable minimum | security-critical settings for passwords, e.g. passwords of sufficient | length, periodic required password changes, or new password uniqueness | Ozancin> What is appropriate? | Frech> XF:nt-autologonpwd | XF:nt-pwlen | XF:nt-maxage | XF:nt-minage | XF:nt-pw-history | XF:nt-user-pwnoexpire | XF:nt-unknown-pwdfilter | XF:nt-pwd-never-expire | XF:nt-pwd-nochange | XF:nt-pwdcache-enable | XF:nt-guest-change-passwords | View |
Page 20919 of 20943, showing 5 records out of 104715 total, starting on record 104591, ending on 104595
