CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 5133 | CVE-2002-0743 | Candidate | mail and mailx in AIX 4.3.3 core dump when called with a very long argument, an indication of a buffer overflow. | Proposed (20020726) | ACCEPT(3) Baker, Bollinger, Cole | NOOP(4) Armstrong, Cox, Foat, Wall | Bollinger> IY29516 is the AIX 4.3 APAR for a variety of buffer | overflows in mail and mailx found during internal testing. (AIX 5.1 | APAR IY28170 needs to be added to the References.) I don"t know if | this is similar to CVE-2002-0041 or not due to the vague description | in the associated advisory. One of the overflows fixed is similar to | CVE-2001-0565, but CVE-2000-0545 does not apply here. | View |
| 3865 | CVE-2001-1061 | Candidate | Vulnerability in lsmcode in unknown versions of AIX, possibly related to a usage error. | Proposed (20020131) | ACCEPT(4) Armstrong, Baker, Cole, Green | MODIFY(2) Bollinger, Frech | NOOP(2) Foat, Wall | Bollinger> Affects AIX 4.3 with bos.diag.util versions less than | 4.3.3.75 and AIX 5.1 with bos.diag.util versions less than 5.1.0.10. | The 4.3 APAR is IY22255 and the 5.1 APAR is IY22266. | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:aix-lsmcode-usage-error(8714) | View |
| 692 | CVE-1999-0712 | Candidate | A vulnerability in Caldera Open Administration System (COAS) allows the /etc/shadow password file to be made world-readable. | Proposed (19991214) | ACCEPT(4) Baker, Cole, Frech, Stracener | MODIFY(1) Blake | NOOP(1) Armstrong | REVIEWING(1) Christey | Blake> This obscurely-written advisory seems to state that COAS will make the | file world-readable, not that it allows the user to make it so. I hardly | think that allowing the user to turn off security is a vulnerability. | Christey> It"s difficult to write the description based on what"s in | the advisory. If COAS inadvertently changes permissions | without user confirmation, then it should be ACCEPTed with | appropriate modification to the description. | Christey> ADDREF BID:137 | CHANGE> [Armstrong changed vote from REVIEWING to NOOP] | View |
| 1794 | CVE-2000-0216 | Candidate | Microsoft email clients in Outlook, Exchange, and Windows Messaging automatically respond to Read Receipt and Delivery Receipt tags, which could allow an attacker to flood a mail system with responses by forging a Read Receipt request that is redirected to a large distribution list. | Proposed (20000322) | ACCEPT(1) Cole | MODIFY(1) Frech | NOOP(2) Baker, Ozancin | REJECT(3) Blake, LeBlanc, Levy | REVIEWING(1) Wall | Blake> This is a configuration issue. Should the fact that NT can be configured | to accept a blank Admin password have a CVE entry? | LeBlanc> This is documented as bad practice - if you have a wide distribution | mailing list, you should only allow certain users to send mail to it. | I don"t think we want to start listing all possible admin errors as | vulnerabilities. | Frech> XF:microsoft-mail-client-dos(4893) | Levy> I agree with all the above comments. Furthermore the delivery status | notification RFC makes it clear that mailing list software should | strip messages from DSN headers. I assume Microsoft"s products are | using the DSN standard and not something else. | View |
| 728 | CVE-1999-0748 | Candidate | Buffer overflows in Red Hat net-tools package. | Proposed (19991214) | ACCEPT(4) Armstrong, Baker, Cole, Stracener | MODIFY(1) Frech | REJECT(1) Blake | Blake> RHSA-1999:017-01 describes "potential security problem fixed" in the | absence of knowing whether or not the problems actually existed, I don"t | think we have an entry here. | Frech> XF:redhat-net-tool-bo | View |
Page 360 of 20943, showing 5 records out of 104715 total, starting on record 1796, ending on 1800
