CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 747 | CVE-1999-0767 | Candidate | Buffer overflow in Solaris libc, ufsrestore, and rcp via LC_MESSAGES environmental variable. | Proposed (19991214) | ACCEPT(4) Baker, Blake, Cole, Dik | MODIFY(2) Frech, Stracener | REVIEWING(2) Christey, Prosser | Stracener> Add Ref: CIAC: J-069 | Frech> XF:sun-libc-lcmessages | Prosser> BID 268 is an additional reference for this one as it has info on the Sun | vulnerability. However, BID 268 also includes AIX in this vulnerability and | refs APARS issued to fix a vulnerability in various "nixs with the Natural | Language Service environmental variables NSLPATH and PATH_LOCALE depending | on the "nix, ref CERT CA-97.10, CVE-1999-0041. However, Georgi Guninski | reported a BO in AIX with LC_MESSAGES + mount, also refed in BID 268, so it | is possible the AIX APARs fix an earlier, similar vulnerability to the Sun | BO in LC_MESSAGES. This should probably be considered under a different | CAN. Any ideas? | Christey> Given that the buffer overflows in CVE-1999-0041 are NLSPATH | and PATH_LOCALE, I"d say that"s good evidence that this is not | the same problem. But a buffer overflow in libc in | LC_MESSAGES... We must ask if these are basically the same | codebase. | | ADDREF CIAC:J-069 | Christey> While the description indicates multiple programs, CD:SF-EXEC | does not apply because the vulnerability was in libc, and | rcp and ufsrestore were both statically linked against libc. | Thus CD:SF-LOC applies, and a single candidate is maintained | because the problem occurred in a library. | Dik> Sun bug 4240566 | Christey> I"m consulting with Casper Dik and Troy Bollinger to see if | this should be combined with the AIX buffer overflows for | LC_MESSAGES; current indications are that they should be | split. | Christey> For further consultation, consider this post, though it"s | associated with CVE-1999-0041: | BUGTRAQ:19970213 Linux NLSPATH buffer overflow | http://www.securityfocus.com/archive/1/6296 | Also add "NLSPATH" and "PATH_LOCALE" to the description to | facilitate search. | View |
| 654 | CVE-1999-0673 | Candidate | Buffer overflow in ALMail32 POP3 client via From: or To: headers. | Proposed (19991222) | ACCEPT(6) Baker, Blake, Cole, Collins, Levy, Wall | MODIFY(2) Frech, Stracener | NOOP(3) Armstrong, Landfield, Oliver | REVIEWING(1) Ozancin | Stracener> AddRef: ShadowPenguinSecurity:PenguinToolbox,No.037 | Frech> XF:almail-bo | CHANGE> [Cole changed vote from NOOP to ACCEPT] | View |
| 772 | CVE-1999-0792 | Candidate | ROUTERmate has a default SNMP community name which allows remote attackers to modify its configuration. | Modified (20000827) | ACCEPT(1) Baker | MODIFY(2) Frech, Stracener | NOOP(1) Christey | REVIEWING(1) Levy | Stracener> Change the Ref to read: ROOTSHELL: Osicom Technologies ROUTERmate | Security | Advisory | Frech> XF:routermate-snmp-community | Christey> BUGTRAQ:19980914 [rootshell] Security Bulletin #23 | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=90581019105693&w=2 | View |
| 3516 | CVE-2001-0708 | Candidate | Denicomp REXECD 1.05 and earlier allows a remote attacker to cause a denial of service (crash) via a long string. | Proposed (20010829) | ACCEPT(5) Baker, Cole, Frech, Stracener, Ziese | NOOP(2) Foat, Wall | Stracener> CONFIRM: http://www.denicomp.com/rexecdnt.htm | View |
| 679 | CVE-1999-0698 | Candidate | Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux. | Proposed (19991222) | ACCEPT(6) Armstrong, Baker, Blake, Cole, Collins, Ozancin | MODIFY(1) Frech | NOOP(4) Landfield, Levy, Stracener, Wall | REJECT(1) Christey | Stracener> Is the candidate referring to the denial of service problem mentioned in | the | changelogs for versions previous to 1.4.3-1 or does it pertain to some | problem with or | 1.4.8-1? | Frech> Depending on the version, this could be any number of DoSes | related to ippl. | From http://www.larve.net/ippl/: | 9 April 1999: version 1.4.3 released, correctly fixing a | potential denial of service attack. | 7 April 1999: version 1.4.2 released, fixing a potential | denial of service attack. | XF:linux-ippl-dos | Christey> Changelog: http://pltplp.net/ippl/docs/HISTORY | | See comments for version 1.4.2 and 1.4.3 | Another source: http://freshmeat.net/news/1999/04/08/923586598.html | CHANGE> [Stracener changed vote from REVIEWING to NOOP] | CHANGE> [Christey changed vote from NOOP to REJECT] | Christey> As mentioned by others, this could apply to several different | versions. Since the description is too vague, this CAN should | be REJECTED and recast into other candidates. | View |
Page 20932 of 20943, showing 5 records out of 104715 total, starting on record 104656, ending on 104660
