CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 552 | CVE-1999-0568 | Candidate | rpc.admind in Solaris is not running in a secure mode. | Proposed (19990728) | ACCEPT(1) Northcutt | NOOP(2) Baker, Christey | RECAST(2) Dik, Shostack | Shostack> are there secure modes? | Dik> Several: | 1) there is no "rpc.admind" daemon. | there used to be a "admind" RPC daemon (100087/10) | and there"s now an "sadmind" daemon (100232/10) | The switch over was somewhere around Solaris 2.4. | 2) Neither defaults to "secure mode" | 3) secure mode is "using secure RPC" which does | proper over the wire authentication by specifying | the "-S 2" option in inetd.conf | (security level 2) | Christey> XF:rpc-admind(626) | http://xforce.iss.net/static/626.php | MISC:http://pulhas.org/xploitsdb/mUNIXes/admind.html | View |
| 198 | CVE-1999-0198 | Candidate | finger .@host on some systems may print information on some user accounts. | Proposed (19990726) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | REJECT(1) Northcutt | Shostack> as above | Frech> Need more reference to establish this "exposure". | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:finger-unused-accounts(8378) | We"re entering it into our database solely to track | competition. The only references seem to be product listings: | http://hq.mcafeeasap.com/vulnerabilities/vuln_data/1000.asp (1004 | Finger .@target-host check) | http://www.ipnsa.com/ipnsa_vuln.htm?step=1000 (Finger .@target-host | check ) | http://cgi.nessus.org/plugins/dump.php3?id=10072 (Finger dot at host | feature) | View |
| 171 | CVE-1999-0171 | Candidate | Denial of service in syslog by sending it a large number of superfluous messages. | Proposed (19990714) | ACCEPT(2) Frech, Northcutt | NOOP(1) Baker | REJECT(2) Christey, Shostack | Shostack> design issue, not a vulnerability. Alternately, add: | DOS on server by opening a large number of telnet sessions.. | Christey> Duplicate of CVE-1999-0566 | View |
| 105 | CVE-1999-0105 | Candidate | finger allows recursive searches by using a long string of @ symbols. | Proposed (19990726) | MODIFY(3) Baker, Frech, Shostack | NOOP(1) Christey | REJECT(1) Northcutt | Shostack> fingerD | Frech> XF:finger-bomb | Christey> aka redirection or forwarding requests? (but then might | overlap CVE-1999-0106) | Baker> should change description to indicate the recursive searching can consume enough system resources to cause a DoS. | View |
| 106 | CVE-1999-0106 | Candidate | Finger redirection allows finger bombs. | Proposed (19990726) | ACCEPT(1) Northcutt | MODIFY(2) Frech, Shostack | RECAST(1) Baker | REVIEWING(1) Christey | Shostack> fingerd allows redirection | This is a larger modification, since there are two applications of the | vulnerability, one that I can finger anonymously, and the other that I | can finger bomb anonymously. | Frech> XF:finger-bomb | Christey> need more refs | Baker> This should be merged with 1999-0105 | View |
Page 20928 of 20943, showing 5 records out of 104715 total, starting on record 104636, ending on 104640
