CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 493 | CVE-1999-0495 | Candidate | A remote attacker can gain access to a file system using .. (dot dot) when accessing SMB shares. | Proposed (19990728) | ACCEPT(6) Baker, Blake, Cole, Collins, Northcutt, Ozancin | MODIFY(1) Frech | NOOP(4) Armstrong, Bishop, Landfield, Wall | REVIEWING(2) Christey, Levy | Frech> XF:nb-dotdotknown(837) | References would be appreciated. We"ve got no reference for this issue; | confidence rating is consequently low. | Levy> Some refernces: | http://www.securityfocus.com/archive/1/3894 | http://www.securityfocus.com/archive/1/3533 | http://www.securityfocus.com/archive/1/3535 | View |
| 239 | CVE-1999-0240 | Candidate | Some filters or firewalls allow fragmented SYN packets with IP reserved bits in violation of their implemented policy. | Proposed (19990728) | ACCEPT(1) Northcutt | NOOP(1) Baker | REJECT(1) Frech | Frech> Would reconsider if any references were available. | View |
| 256 | CVE-1999-0257 | Candidate | Nestea variation of teardrop IP fragmentation denial of service. | Proposed (19990726) | ACCEPT(1) Wall | MODIFY(1) Frech | REVIEWING(1) Christey | Frech> XF:nestea-linux-dos | Christey> Not sure how many separate "instances" of Teardrop | and its ilk. Also see comments on CVE-1999-0001. | | See: CVE-1999-0015, CVE-1999-0104, CVE-1999-0257, CVE-1999-0258 | | Is CVE-1999-0001 the same as CVE-1999-0052? That one is related | to nestea (CVE-1999-0257) and probably the one described in | BUGTRAQ:19981023 nestea v2 against freebsd 3.0-Release | The patch for nestea is in ip_input.c around line 750. | The patches for CVE-1999-0001 are in lines 388&446. So, | CVE-1999-0001 is different from CVE-1999-0257 and CVE-1999-0052. | The FreeBSD patch for CVE-1999-0052 is in line 750. | So, CVE-1999-0257 and CVE-1999-0052 may be the same, though | CVE-1999-0052 should be RECAST since this bug affects Linux | and other OSes besides FreeBSD. | | Also see BUGTRAQ:19990909 CISCO and nestea. | | Finally, note that there is no fundamental difference between | nestea and nestea2/nestea-v2; they are different ports that | exploit the same problem. | | The original nestea advisory is at | http://www.technotronic.com/rhino9/advisories/06.htm | but notice that the suggested fix is in line 375 of | ip_fragment.c, not ip_input.c. | Christey> See the SCO advisory at: | http://www.securityfocus.com/templates/advisory.html?id=1411 | which may further clarify the issue. | Christey> BUGTRAQ:19980501 nestea does other things | http://marc.theaimsgroup.com/?l=bugtraq&m=90221101925819&w=2 | BUGTRAQ:19980508 nestea2 and HP Jet Direct cards. | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=90221101925870&w=2 | BUGTRAQ:19981027 nestea v2 against freebsd 3.0-Release | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=90951521507669&w=2 | | Nestea source code is in | MISC:http://oliver.efri.hr/~crv/security/bugs/Linux/ipfrag6.html | View |
| 257 | CVE-1999-0258 | Candidate | Bonk variation of teardrop IP fragmentation denial of service. | Proposed (19990726) | MODIFY(2) Frech, Wall | REVIEWING(1) Christey | Wall> Reference Q179129 | Frech> XF:teardrop-mod | Christey> Not sure how many separate "instances" of Teardrop there are. | See: CVE-1999-0015, CVE-1999-0104, CVE-1999-0257, CVE-1999-0258 | Christey> See the SCO advisory at: | http://www.securityfocus.com/templates/advisory.html?id=1411 | which may further clarify the issue. | Christey> BUGTRAQ:19980108 bonk.c | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=88429524325956&w=2 | NTBUGTRAQ:19980108 bonk.c | URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=88433857200304&w=2 | NTBUGTRAQ:19980109 Re: Bonk.c | URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=88441302913269&w=2 | NTBUGTRAQ:19980304 Update on wide-spread NewTear Denial of Service attacks | URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=88901842000424&w=2 | BUGTRAQ:19980304 Update on wide-spread NewTear Denial of Service attacks | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=88903296104349&w=2 | CIAC:I-031a | http://ciac.llnl.gov/ciac/bulletins/i-031a.shtml | | CERT summary CS-98.02 implies that bonk, boink, and newtear | all exploit the same vulnerability. | View |
| 520 | CVE-1999-0523 | Candidate | ICMP echo (ping) is allowed from arbitrary hosts. | Proposed (19990726) | MODIFY(1) Meunier | NOOP(1) Baker | REJECT(2) Frech, Northcutt | Northcutt> (Though I sympathize with this one :) | CHANGE> [Frech changed vote from REVIEWING to REJECT] | Frech> Ping is a utility that can be run on demand; ICMP echo is a | message | type. As currently worded, this candidate seems as if an arbitrary | host | is vulnerable because it is capable of running an arbitrary program | or | function (in this case, ping/ICMP echo). There are many | programs/functions that | "shouldn"t" be on a computer, from a security admin"s perspective. | Even if this | were a vulnerability, it would be impacted by CD-HIGHCARD. | Meunier> Every ICMP message type presents a vulnerability or an | exposure, if access is not controlled. By that I mean not only those | in RFC 792, but also those in RFC 1256, 950, and more. I think that | the description should be changed to "ICMP messages are acted upon | without any access control". ICMP is an error and debugging protocol. | We complain about vendors leaving testing backdoors in their programs. | ICMP is the equivalent for TCP/IP. ICMP should be in the dog house, | unless you are trying to troubleshoot something. MTU discovery is | just a performance tweak -- it"s not necessary. I don"t know of any | ICMP message type that is necessary if the network is functional. | Limited logging of ICMP messages could be useful, but acting upon them | and allowing the modification of routing tables, the behavior of the | TCP/IP stack, etc... without any form of authentication is just crazy. | View |
Page 410 of 20943, showing 5 records out of 104715 total, starting on record 2046, ending on 2050
