CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 544 | CVE-1999-0556 | Candidate | Two or more Unix accounts have the same UID. | Proposed (19990728) | NOOP(2) Baker, Christey | REJECT(2) Northcutt, Shostack | Christey> XF:duplicate-uid(876) | Christey> Add terms "duplicate" and "user ID" to facilitate search. | ftp://ftp.auscert.org.au/pub/auscert/papers/unix_security_checklist | View |
| 547 | CVE-1999-0561 | Candidate | IIS has the #exec function enabled for Server Side Include (SSI) files. | Proposed (19990728) | NOOP(2) Baker, Northcutt | RECAST(1) Shostack | REJECT(1) LeBlanc | LeBlanc> Does not meet definition of a vulnerability. This function is | just enabled. You can turn it off if you want. if you trust the people | putting up your web pages, this isn"t a problem. If you don"t, this is | just one of many things you need to change. | View |
| 549 | CVE-1999-0564 | Candidate | An attacker can force a printer to print arbitrary documents (e.g. if the printer doesn"t require a password) or to become disabled. | Proposed (19990728) | ACCEPT(2) Baker, Shostack | NOOP(1) Northcutt | View | |
| 550 | CVE-1999-0565 | Candidate | A Sendmail alias allows input to be piped to a program. | Proposed (19990728) | ACCEPT(1) Northcutt | NOOP(1) Baker | RECAST(1) Shostack | REVIEWING(1) Christey | Shostack> Is this a default alias? Is my .procmailrc an instance of this? | Christey> It is not entirely clear whether the simple fact that an alias | pipes into a program should be considered a vulnerability. It | all depends on the behavior of that particular program. This | is one of a number of configuration-related issues from the | "draft" CVE that came from vulnerability scanners. In | general, when we get to general configuration and "policy," | it becomes more difficult to use the current CVE model to | represent them. So at the very least, this candidate (and | similar ones) should be given close consideration and | discussion before being added to the official CVE list. | | Because this candidate is related to general configuration | issues, and we have not completely determined how to handle | such issues in CVE, this candidate cannot be promoted to an | official CVE entry until such issues are resolved. | View |
| 552 | CVE-1999-0568 | Candidate | rpc.admind in Solaris is not running in a secure mode. | Proposed (19990728) | ACCEPT(1) Northcutt | NOOP(2) Baker, Christey | RECAST(2) Dik, Shostack | Shostack> are there secure modes? | Dik> Several: | 1) there is no "rpc.admind" daemon. | there used to be a "admind" RPC daemon (100087/10) | and there"s now an "sadmind" daemon (100232/10) | The switch over was somewhere around Solaris 2.4. | 2) Neither defaults to "secure mode" | 3) secure mode is "using secure RPC" which does | proper over the wire authentication by specifying | the "-S 2" option in inetd.conf | (security level 2) | Christey> XF:rpc-admind(626) | http://xforce.iss.net/static/626.php | MISC:http://pulhas.org/xploitsdb/mUNIXes/admind.html | View |
Page 402 of 20943, showing 5 records out of 104715 total, starting on record 2006, ending on 2010
