CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 574 | CVE-1999-0592 | Candidate | The Logon box of a Windows NT system displays the name of the last user who logged in. | Proposed (19990728) | MODIFY(1) Frech | NOOP(2) Baker, Christey | REJECT(2) Northcutt, Wall | Wall> Information gathering, not vulnerability | Northcutt> Ah a C2 weenie must have snuck this in, this can be a good thing | not just vulnerability | Frech> XF:nt-display-last-username(1353) | Use it if you will. :-) If not, let us know so I can remove the CAN | reference from our database. | Christey> MSKB:Q114463 | http://support.microsoft.com/support/kb/articles/q114/4/63.asp | View |
| 344 | CVE-1999-0345 | Candidate | Jolt ICMP attack causes a denial of service in Windows 95 and Windows NT systems. | Proposed (19990728) | ACCEPT(2) Blake, Cole | MODIFY(2) Frech, Wall | NOOP(4) Bishop, Landfield, Northcutt, Ozancin | RECAST(1) Meunier | REJECT(4) Armstrong, Baker, LeBlanc, Levy | REVIEWING(1) Christey | Wall> Invalid ICMP datagram fragments causes a denial of service in Windows 95 and | Windows NT systems. | Reference: Q154174. | Jolt is also known as sPING, ICMP bug, Icenewk, and Ping of Death. | It is a modified teardrop 2 attack. | Frech> XF:nt-ssping | ADDREF XF:ping-death | ADDREF XF:teardrop-mod | ADDREF XF:mpeix-echo-request-dos | Christey> I can"t tell whether the Jolt exploit at: | | http://www.securityfocus.com/templates/archive.pike?list=1&date=1997-06-28&msg=Pine.BSF.3.95q.970629163422.3264A-200000@apollo.tomco.net | | is exploiting any different flaw than teardrop does. | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Baker> Jolt (original) is basically just a fragmented oversized ICMP that | kills Win boxes ala Ping of Death. | Teardrop is altering the offset in fragmented tcp packets so that the | end of subsequent fragments is inside first packet... | Teardrop 2 is UDP packets, if I remember right. | Seems like Jolt (original, not jolt 2) is just exploit code that | creates a ping of death (CVE 1999-0128) | Levy> I tend to agree with Baker. | CHANGE> [Armstrong changed vote from REVIEWING to REJECT] | Armstrong> This code does not use fragment overlap. It is simply a large ICMP echo request. | Christey> See the SCO advisory at: | http://www.securityfocus.com/templates/advisory.html?id=1411 | which may further clarify the issue. | LeBlanc> This is a hodge-podge of DoS attacks. Jolt isn"t the same | thing as ping of death - POD was an oversized ICMP packet, Jolt froze | Linux and Solaris (and I think not NT), IIRC Jolt2 did get NT boxes. | Teardrop and teardrop2 were related attacks (usually ICMP frag attacks), | but each of these is a distinct vulnerability, affected a discrete group | of systems, and should have distinct CVE numbers. CVE entries should be | precise as to what the problem is. | Meunier> I agree with Leblanc in that Jolt is multi-faceted. Jolt has | characteristics of Ping of Death AND teardrop, but it doesn"t do | either exactly. Moreover, it sends a truncated IP fragment. I | disagree with Armstrong; jolt uses overlapping fragments. It"s not a | simple ping of death either. It may be that the author"s intent was | to construct a "super attack" somehow combining elements of other | vulnerabilities to try to make it more potent. In any case it | succeeded in confusing the CVE board :-). | | I notice that Jolt uses echo replies (type 0) instead of echo | requests (to get past firewalls?). Jolt is peculiar in that it also | sends numerous overlapping fragments. The "Pascal Simulator" :-) says | it sends: | | - 172 fragments of length 400 with offset starting at 5120 and | increasing by about 47 (odd arithmetic of 5120 OR ((n* 380) >> 3)), | which eventually results in sending fragments inside an already | covered area once ((n* 380) >> 3) is greater than 5120, which occurs | when n is reaches 108. This would look a bit like TearDrop if | fragments were reassembled on-the-fly. | | - 1 fragment such that the total length of all the fragments | is greater than 65535 (my calculation is 172*380 + 418 = 65778; the | comment about 65538 must be wrong). The last packet is size 418 | according to the IP header but the buffer is of size 400. The sendto | takes as argument the size of the buffer so a truncated packet is | sent. | | So, I am not sure if the problem is because the last packet | doesn"t extend to the payload it says it has or because the total size | of all fragments is greater than 65535. The author says it may take | more than one sending, so perhaps this has to do with an incorrect | error handling and recovery. One would need to experiment and isolate | each of those characteristics and test them independently. Inasmuch | as each of those things is likely a different vulnerability, then I | agree with Leblanc that this entry should be split. I"ll try that if | I ever get bored. Jolt 2 should also have a different entry (see | below). | | Jolt 2 runs in an infinite loop, sending the same fragmented | IP packet, which can pretend to be "ICMP" or "UDP" data; however this | is meaningless, as it"s just a late fragment of an IP packet. The | attack works only as long as packets are sent. According to | http://www.securityfocus.com/archive/1/62170 the packets are | truncated, and would overflow over the 65535 byte limit, which is | similar to Jolt. Note that Jolt does send that much data whereas | jolt2 doesn"t. Since jolt2 is simpler and narrower than jolt, and it | has weaker consequences, I believe that it"s a different | vulnerability. | | "Jolt 2 vulnerability causes a temporary denial-of-service in | Windows-type OSes" would be a title for it. | View |
| 2647 | CVE-2000-1079 | Candidate | Interactions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram. | Modified (20061101) | ACCEPT(3) Baker, Mell, Wall | NOOP(1) Cole | REVIEWING(1) Christey | Wall> No known exploit or patch yet. | Christey> This was a little controversial, if I recall correctly. | View |
| 566 | CVE-1999-0584 | Candidate | A Windows NT file system is not NTFS. | Proposed (19990728) | ACCEPT(2) Northcutt, Wall | MODIFY(1) Frech | NOOP(2) Baker, Christey | Wall> NTFS partition provides the security. This could be re-worded | to "A Windows NT file system is FAT" since it is either NTFS or FAT | and FAT is less secure. | Frech> XF:nt-filesys(195) | Christey> MSKB:Q214579 | MSKB:Q214579 | http://support.microsoft.com/support/kb/articles/Q100/1/08.ASP | View |
| 576 | CVE-1999-0594 | Candidate | A Windows NT system does not restrict access to removable media drives such as a floppy disk drive or CDROM drive. | Proposed (19990728) | ACCEPT(1) Wall | MODIFY(1) Frech | NOOP(2) Baker, Christey | REJECT(1) Northcutt | Wall> Perhaps it can be re-worded to "removable media drives | such as a floppy disk drive or CDROM drive can be accessed (shared) in a | Windows NT system." | Northcutt> - what good is my NT w/o its floppy | Frech> XF:nt-allocate-cdroms(1294) | XF:nt-allocate-floppy(1318) | Christey> MSKB:Q172520 | URL:http://support.microsoft.com/support/kb/articles/q172/5/20.asp | View |
Page 20935 of 20943, showing 5 records out of 104715 total, starting on record 104671, ending on 104675
