CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3077 | CVE-2001-0256 | Candidate | FaSTream FTP++ Server 2.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long username. | Proposed (20010404) | ACCEPT(1) Frech | NOOP(3) Cole, Wall, Ziese | REVIEWING(2) Bishop, Christey | Christey> CVE-2000-0831 and CVE-2001-0256 are probable duplicates, since | they involve the same product and version (Fastream FTP++ | 2.0), vuln type (buffer overflow), and attack vector (username). | View |
| 928 | CVE-1999-0948 | Candidate | Buffer overflow in uum program for Canna input system allows local users to gain root privileges. | Proposed (19991222) | ACCEPT(2) Levy, Stracener | MODIFY(1) Frech | NOOP(2) Baker, Christey | Christey> CVE-1999-0948 and CVE-1999-0949 are extremely similar. | uum (0948) is exploitable through a different set of options | than canuum (0949). If it"s the same generic option parsing | routine used by both programs, then CD:SF-CODEBASE says to | merge them. But if it"s not, then CD:SF-LOC and CD:SF-EXEC | says to split them. However, this is a prime example of | how SF-EXEC might be modified - uum and canuum are clearly | part of the same package, so in the absence of clear | information, maybe we should merge them. | Frech> XF:canna-uum-bo | View |
| 929 | CVE-1999-0949 | Candidate | Buffer overflow in canuum program for Canna input system allows local users to gain root privileges. | Proposed (19991222) | ACCEPT(2) Levy, Stracener | MODIFY(1) Frech | NOOP(2) Baker, Christey | Christey> CVE-1999-0948 and CVE-1999-0949 are extremely similar. | uum (0948) is exploitable through a different set of options | than canuum (0949). If it"s the same generic option parsing | routine used by both programs, then CD:SF-CODEBASE says to | merge them. But if it"s not, then CD:SF-LOC and CD:SF-EXEC | says to split them. However, this is a prime example of | how SF-EXEC might be modified - uum and canuum are clearly | part of the same package, so in the absence of clear | information, maybe we should merge them. | | Also review BID:758 and BID:757 - may need to change the BID | here. | Frech> XF:canna-uum-bo | Christey> CHANGEREF BID:757 BID:758 | Christey> The following page says that canuum is a "Japanese input tty | frontend for Canna using uum," which suggests that it is, at | the least, a different package, so perhaps this should stay SPLIT. | | http://wuarchive.wustl.edu/mirrors/NetBSD/NetBSD-current/pkgsrc/inputmethod/canuum/README.html | View |
| 465 | CVE-1999-0467 | Candidate | The Webcom CGI Guestbook programs wguest.exe and rguest.exe allow a remote attacker to read arbitrary files using the "template" parameter. | Modified (20000106-01) | ACCEPT(4) Blake, Frech, Landfield, Ozancin | NOOP(3) Baker, Christey, Northcutt | Christey> CVE-1999-0287 is probably a duplicate of CVE-1999-0467. In | NTBUGTRAQ:19990409 Webcom"s CGI Guestbook for Win32 web servers | Mnemonix says that he had previously reported on a similar | problem. Let"s refer to the NTBugtraq posting as | CVE-1999-0467. We will refer to the "previous report" as | CVE-1999-0287, which can be found at: | http://oliver.efri.hr/~crv/security/bugs/NT/httpd41.html | | 0287 describes an exploit via the "template" hidden variable. | The exploit describes manually editing the HTML form to | change the filename to read from the template variable. | | The exploit as described in 0467 encodes the template variable | directly into the URL. However, hidden variables are also | encoded into the URL, which would have looked the same to | the web server regardless of the exploit. Therefore 0287 | and 0467 are the same. | Christey> | The CD:SF-EXEC content decision also applies here. We have 2 | programs, wguest.exe and rguest.exe, which appear to have the | same problem. CD:SF-EXEC needs to be accepted by the Editorial | Board before this candidate can be converted into a CVE | entry. When finalized, CD:SF-EXEC will decide whether | this candidate should be split or not. | Christey> BID:2024 | View |
| 8761 | CVE-2004-0333 | Candidate | Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters. | Modified (20050808) | ACCEPT(4) Armstrong, Baker, Cole, Wall | NOOP(2) Christey, Cox | Christey> Consider this Gentoo reference: | BUGTRAQ:20040328 [ GLSA 200403-05 ] UUDeview MIME Buffer Overflow | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=108057738810928&w=2 | | May need to rephrase this description to emphasize UUDeview | over WinZip. | View |
Page 315 of 20943, showing 5 records out of 104715 total, starting on record 1571, ending on 1575
