CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1942 | CVE-2000-0364 | Candidate | screen and rxvt in Red Hat Linux 6.0 do not properly set the modes of tty devices, which allows local users to write to other ttys. | Proposed (20000524) | ACCEPT(2) Baker, Levy | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:linux-tty-improper-mode | Christey> BUGTRAQ:19990607 Re: RedHat 6.0, /dev/pts permissions bug when using xterm | http://marc.theaimsgroup.com/?l=bugtraq&m=92886008912147&w=2 | BUGTRAQ:19990607 Re: Red Hat 6.0, /dev/pts permissions bug when using xterm | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=92886358415964&w=2 | View |
| 1943 | CVE-2000-0365 | Candidate | Red Hat Linux 6.0 installs the /dev/pts file system with insecure modes, which allows local users to write to other tty devices. | Proposed (20000524) | ACCEPT(2) Baker, Levy | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:linux-dev-insecure-mode | Christey> BUGTRAQ:19990607 Re: RedHat 6.0, /dev/pts permissions bug when using xterm | http://marc.theaimsgroup.com/?l=bugtraq&m=92886008912147&w=2 | BUGTRAQ:19990607 Re: Red Hat 6.0, /dev/pts permissions bug when using xterm | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=92886358415964&w=2 | View |
| 1895 | CVE-2000-0317 | Candidate | Buffer overflow in Solaris 7 lpset allows local users to gain root privileges via a long -r option. | Proposed (20000518) | ACCEPT(3) Baker, Cole, Levy | MODIFY(1) Frech | NOOP(3) Christey, LeBlanc, Wall | RECAST(1) Dik | Dik> there"s a lot of confusion in this one. | These point to buffer overflows: | Reference: BUGTRAQ:20000424 Solaris 7 x86 lpset exploit. | Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0192.html | Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-04/0236.html | But these point to dlopen() in libprint that doesnt" check pathnames: | Reference: BUGTRAQ:20000427 Re: Solaris/SPARC 2.7 lpset exploit (well not likely !) | Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95729763119559&w=2 | Reference: SUNBUG:4334568 | And this is a bufferoverflow again: | Reference: BID:1138 | Reference: URL:http://www.securityfocus.com/bid/1138 | Frech> XF:solaris-lpset-bo | Christey> ADDREF SUN:00195? Need to check with Casper. | View |
| 1899 | CVE-2000-0321 | Candidate | Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name. | Proposed (20000518) | ACCEPT(1) Levy | MODIFY(1) Frech | NOOP(4) Baker, Cole, LeBlanc, Wall | REJECT(1) Christey | Frech> XF:icradius-username-bo | Every reference I pull up shows the product"s name as ICRADIUS. See | http://mysql.eunet.fi/Downloads/Contrib/icradius.README | Christey> In a followup, Alan DeKok (aland@FREERADIUS.ORG) says that | this could occur in other RADIUS servers also; however, the | bug could only be exploited if someone has altered the | configuration file, which shouldn"t normally be modifiable | by anyone else. | | So, this should be REJECTed since the bug doesn"t directly give | anyone else any additional privileges or access. | Christey> Alan DeKok <aland@FREERADIUS.ORG> says it applies to other RADIUS | programs also, *however* since it needs a valid username, only | the RADIUS owner can exploit it by changing the config file. But | if the config file can be written by others - well, that"s still | a potential risk, but you"ve probably got bigger problems then. | - http://marc.theaimsgroup.com/?l=bugtraq&m=95671883515060&w=2 | Look at ChangeLog at ftp://ftp.cheapnet.net/pub/icradius/ChangeLog | | Possible confirmation in 0.15: "sql_getvpdata now dynamically | allocates buffer sizes for sql queries to avoid over runs" | | But that"s a bit general. | | Alan Kok said that Cistron and other RADIUS servers were affected; the | ICRADIUS changelog says to check the Cistron logs for other possible | bug fixes, since ICRADIUS uses Cistron codebase. Go back to | freeradius.org and find link to Cistron at | http://www.miquels.cistron.nl/radius/ | | Cistron changelog at http://www.miquels.cistron.nl/radius/ChangeLog It | has different version numbers - go back to ICRADIUS changelog to find | rought equivalents. ICRADIUS 0.15 uses Cistron 1.6.3 patches, so | start from there. | | No apparent problems in 1.6.3 or 1.6.4, but 1.6.1 says: "Fix all | strcpy(), strcat(), sprintf() and sccanf() calls for buffer | overflows." So perhaps the problem was fixed then? Or maybe the | vulnerable sscanf() call was missed and/or disregarded because it was | believed that the hostname could be trusted since it came from a | well-controlled configuration file? | View |
| 1904 | CVE-2000-0326 | Candidate | Meeting Maker uses weak encryption (a polyalphabetic substitution cipher) for passwords, which allows remote attackers to sniff and decrypt passwords for Meeting Maker accounts. | Proposed (20000518) | ACCEPT(2) Baker, Levy | MODIFY(1) Frech | NOOP(4) Christey, Cole, LeBlanc, Wall | Frech> XF:meetingmaker-weak-encryption | Christey> Add original Bugtraq reference at: | http://archives.neohapsis.com/archives/bugtraq/2000-04/0223.html | Also ADDREF XF:meetingmaker-weak-encryption | View |
Page 366 of 20943, showing 5 records out of 104715 total, starting on record 1826, ending on 1830
