CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 197 | CVE-1999-0197 | Candidate | finger 0@host on some systems may print information on some user accounts. | Proposed (19990726) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | REJECT(1) Northcutt | Shostack> fingerd may respond to "finger 0@host" with account info | Frech> Need more reference to establish this "exposure". | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:finger-unused-accounts(8378) | We"re entering it into our database solely to track | competition. The only references seem to be product listings: | http://hq.mcafeeasap.com/vulnerabilities/vuln_data/1000.asp (1002 | Finger 0@host check) | http://www.ipnsa.com/ipnsa_vuln.htm?step=1000 (Finger 0@host check) | http://cgi.nessus.org/plugins/dump.php3?id=10069 (Finger zero at host | feature) | View |
| 198 | CVE-1999-0198 | Candidate | finger .@host on some systems may print information on some user accounts. | Proposed (19990726) | ACCEPT(1) Baker | MODIFY(2) Frech, Shostack | REJECT(1) Northcutt | Shostack> as above | Frech> Need more reference to establish this "exposure". | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:finger-unused-accounts(8378) | We"re entering it into our database solely to track | competition. The only references seem to be product listings: | http://hq.mcafeeasap.com/vulnerabilities/vuln_data/1000.asp (1004 | Finger .@target-host check) | http://www.ipnsa.com/ipnsa_vuln.htm?step=1000 (Finger .@target-host | check ) | http://cgi.nessus.org/plugins/dump.php3?id=10072 (Finger dot at host | feature) | View |
| 458 | CVE-1999-0460 | Candidate | Buffer overflow in Linux autofs module through long directory names allows local users to perform a denial of service. | Proposed (19990726) | ACCEPT(2) Baker, Ozancin | MODIFY(1) Frech | NOOP(1) Wall | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:linux-autofs-bo(8365) | View |
| 490 | CVE-1999-0492 | Candidate | The ffingerd 1.19 allows remote attackers to identify users on the target system based on its responses. | Proposed (19990726) | ACCEPT(3) Armstrong, Collins, Northcutt | MODIFY(4) Baker, Blake, Frech, Shostack | NOOP(4) Christey, Cole, Landfield, Wall | REVIEWING(1) Ozancin | Shostack> isn"t that what finger is supposed to do? | Landfield> Maybe we need a new category of "unsafe system utilities and protocols" | Blake> Ffingerd 1.19 allows remote attackers to differentiate valid and invalid | usernames on the target system based on its responses to finger queries. | Christey> CHANGEREF BUGTRAQ [canonicalize] | BUGTRAQ:19990423 Ffingerd privacy issues | http://marc.theaimsgroup.com/?l=bugtraq&m=92488772121313&w=2 | | Here"s the nature of the problem. | (1) FFingerd allows users to decide not to be fingered, | printing a message "That user does not want to be fingered" | (2) If the fingered user does not exist, then FFingerd"s | intended default is to print that the user does not | want to be fingered; however, the error message has a | period at the end. | Thus, ffingerd can allow someone to determine who valid users | on the server are, *in spite of* the intended functionality of | ffingerd itself. Thus this exposure should be viewed in light | of the intended functionality of the application, as opposed | to the common usage of the finger protocol in general. | | Also, the vendor posted a followup and said that a patch was | available. See: | http://marc.theaimsgroup.com/?l=bugtraq&m=92489375428016&w=2 | Baker> Vulnerability Reference (HTML) Reference Type | http://www.securityfocus.com/archive/1/13422 Misc Defensive Info | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> XF:ffinger-user-info(5393) | View |
| 507 | CVE-1999-0510 | Candidate | A router or firewall allows source routed packets from arbitrary hosts. | Proposed (19990726) | ACCEPT(2) Baker, Northcutt | MODIFY(1) Frech | Frech> XF:source-routing | View |
Page 415 of 20943, showing 5 records out of 104715 total, starting on record 2071, ending on 2075
