CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 4672 | CVE-2002-0280 | Candidate | Buffer overflow in CodeBlue 4 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via a long string in an SMTP reply. | Proposed (20020502) | MODIFY(1) Frech | NOOP(5) Armstrong, Cole, Cox, Foat, Wall | Frech> May have been "rediscovered" by VulnWatch Mailing List, Wed | Jul 24 2002 - 11:05:00 CDT, "Remote hole in Codeblue log scanner" at | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0037.html. | If these are the same issue, then v5 also contains this security | issue. | View |
| 1454 | CVE-1999-1474 | Candidate | PowerPoint 95 and 97 allows remote attackers to cause an application to be run automatically without prompting the user, possibly through the slide show, when the document is opened in browsers such as Internet Explorer. | Proposed (20010912) | ACCEPT(6) Armstrong, Cole, Foat, Frech, Stracener, Wall | Frech> Looks like CONFIRM URL is too old for Microsoft to keep | (currently cached at | http://www.google.com/search?q=cache:86loHcRhaL4:www.microsoft.com/ie/ | security/powerpoint.htm+%22PowerPoint+Browsing+Security+Issue%22&hl=en | ). Same information is available at BugTraq at | http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=6724 | View |
| 1550 | CVE-1999-1570 | Candidate | Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter. | Proposed (20020830) | ACCEPT(4) Armstrong, Cole, Frech, Green | NOOP(3) Cox, Foat, Wall | REVIEWING(1) Christey | Frech> It seems as if the BID-4089 assignment on this CAN name may be | in error. | BID-4089 (Multiple Vendor SNMP Request Handling Vulnerabilities) is | already assigned to CVE-2002-0013. Also, this CVE issue seems to have | nothing to do with SNMP. | Christey> Agreed, this is the wrong BID. SecurityFocus has assigned | BID:643 to CVE-1999-1570, but there"s a bit of an | inconsistency. BID:643 alludes to Bugtraq posts in 1999 | from Brock Tellier, mentioning overflows in sar via BOTH the | -o and -f parameters. However, they also link this issue to | SCO advisory 99.17, although the advisory itself is too vague | to *really* know what vulns they fixed. And now the link | to a potentially more detailed document (sse037.ltr) | is broken. So we don"t have any independent reason for | knowing whether SCO 99.17 (a) addresses any "sar" | vulnerabilities, and (b) even if it does, whether it addresses | *both* the -o and -f arguments originally claimed by Tellier. | Finally, it seems rather curious that CSSA-2002-SCO.17 | talks about a -o overflow but does not mention -f. | Sounds like an email to the security people at SCO | is in order... | | OK. Having consulted with SCO (who responded quickly), I | looked even further into this issue. There is now sufficient | evidence that the -f overflow was fixed in 1999. This | means that a separate candidate should be created (by | CD:SF-LOC), so the -f overflow is now covered by | CVE-1999-1571. | | Need to DELREF BID:4089 | CHANGE> [Frech changed vote from NOOP to ACCEPT] | CHANGE> [Christey changed vote from NOOP to REVIEWING] | View |
| 1696 | CVE-2000-0118 | Candidate | The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing. | Proposed (20000208) | ACCEPT(3) Baker, Cole, Levy | MODIFY(1) Frech | NOOP(1) Wall | REVIEWING(1) Christey | Frech> Is this the same issue as BugTraq Mailing List, Wed, 9 Jun 1999 14:07:27 | -0700 "vulnerability in su/PAM in redhat" at | http://www.netspace.org/cgi-bin/wa?A2=ind9906b&L=bugtraq&F=&S=&P=5356 and | "Solaris 2.5 /bin/su [was: vulnerability in su/PAM in redhat]" at | http://www.netspace.org/cgi-bin/wa?A2=ind9906b&L=bugtraq&F=&S=&P=6051 | If so, then MODIFY XF:su-brute | Christey> BID:320 | URL:http://www.securityfocus.com/vdb/bottom.html?vid=320 | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:su-brute(2278) | This issue involves more platforms than Red Hat. See BugTraq | Mailing List, Thu Jun 10 1999 12:13:06, "Solaris 2.5 /bin/su [was: | vulnerability in su/PAM in redhat]", | http://www.securityfocus.com/archive/1/14854 | Christey> It does look like this is the same issue as the other Bugtraq | post that explicitly mentions Red Hat and PAM. | CHANGE> [Christey changed vote from NOOP to REVIEWING] | View |
| 2229 | CVE-2000-0653 | Candidate | Microsoft Outlook Express allows remote attackers to monitor a user"s email by creating a persistent browser link to the Outlook Express windows, aka the "Persistent Mail-Browser Link" vulnerability. | Proposed (20000803) | ACCEPT(3) Cole, Levy, Wall | NOOP(1) LeBlanc | REJECT(1) Frech | REVIEWING(1) Christey | Frech> Is this a duplicate of CVE-2000-0105? I can find no differentiating evidence | to show that this issue is unique. | Christey> I need to look through my email logs to recall whether I | resolved this potential duplicate with Microsoft people. | CHANGE> [Frech changed vote from REVIEWING to REJECT] | View |
Page 227 of 20943, showing 5 records out of 104715 total, starting on record 1131, ending on 1135
