CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 521 | CVE-1999-0524 | Candidate | ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts. | Modified (20161206) | MODIFY(3) Baker, Frech, Meunier | REJECT(1) Northcutt | Frech> XF:icmp-timestamp | XF:icmp-netmask | Meunier> If this is not merged with 1999-0523 as I commented for that | CVE, then the description should be changed to "ICMP messages of types | 13 and 14 (timestamp request and reply) and 17 and 18 (netmask request | and reply) are acted upon without any access control". It"s a more | precise and correct language. I believe that this is a valid CVE | entry (it"s a common source of vulnerabilities or exposures) even | though I see that the inferred action was "reject". Knowing the time | of a host also allows attacks against random number generators that | are seeded with the current time. I want to push to have it accepted. | Baker> I agree with the description changes suggested by Pascal | View |
| 6830 | CVE-2003-0001 | Candidate | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. | Modified (20161205) | ACCEPT(3) Baker, Cole, Wall | MODIFY(2) Cox, Frech | NOOP(1) Christey | Christey> ENGARDE:ESA-20030318-009 | URL:http://www.linuxsecurity.com/advisories/engarde_advisory-2976.html | CHANGE> [Cox changed vote from ACCEPT to MODIFY] | Cox> Addref: RHSA-2003:088 | Christey> MANDRAKE:MDKSA-2003:039 | URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:039 | Frech> XF:ethernet-driver-information-leak(10996) | Christey> SGI:20030601-01-A | Christey> DEBIAN:DSA-311 | URL:http://www.debian.org/security/2003/dsa-311 | Christey> MANDRAKE:MDKSA-2003:066 | Christey> DEBIAN:DSA-332 | URL:http://www.debian.org/security/2003/dsa-332 | DEBIAN:DSA-336 | URL:http://www.debian.org/security/2003/dsa-336 | Christey> HP:HPSBUX0305-261 | URL:http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/MSS-OAR-E01-2003.0708.1 | DEBIAN:DSA-312 | URL:http://www.debian.org/security/2003/dsa-312 | BID:6535 | URL:http://www.securityfocus.com/bid/6535 | Christey> MANDRAKE:MDKSA-2003:074 | URL:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:074 | Christey> DEBIAN:DSA-423 | URL:http://www.debian.org/security/2004/dsa-423 | Christey> BUGTRAQ:20040207 [Fwd: zyxel prestige ethernet information leakage] | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=107618991322594&w=2 | Christey> DEBIAN:DSA-442 | URL:http://www.debian.org/security/2004/dsa-442 | Christey> SGI:20030601-01-I | URL:ftp://patches.sgi.com/support/free/security/advisories/20030601-01-A | Cox> Change description to say "in Linux 2.4 prior to 2.4.21" as | this was fixed in Linux 2.4.21 by changesets committed by Alan Cox on | 5th Feb 2003. | View |
| 3149 | CVE-2001-0328 | Candidate | TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one of which may match the expected ISN. | Modified (20161125) | ACCEPT(7) Baker, Cole, Magdych, Renaud, Wall, Williams, Ziese | MODIFY(1) Frech | REVIEWING(1) Christey | Frech> XF:tcp-seq-predict(139) | Christey> It could be argued that this is a "class" of vulnerability in which | several stacks have the problem. | Also need to add references. | Christey> Consider adding BID:2682 | Christey> HP:HPSBUX0207-205 | URL:http://archives.neohapsis.com/archives/hp/2002-q3/0031.html | Christey> COMPAQ:SSRT-547 | URL:http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html | HP:HPSBUX0207-205 | URL:http://archives.neohapsis.com/archives/hp/2002-q3/0031.html | View |
| 4762 | CVE-2002-0370 | Candidate | Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0. | Modified (20150106) | ACCEPT(4) Baker, Cole, Frech, Wall | NOOP(1) Cox | View | |
| 1797 | CVE-2000-0219 | Candidate | Red Hat 6.0 allows local users to gain root access by booting single user and hitting ^C at the password prompt. | Modified (20141101) | ACCEPT(4) Armstrong, Cole, Levy, Ozancin | MODIFY(1) Frech | NOOP(4) Baker, Blake, LeBlanc, Wall | REVIEWING(1) Christey | Ozancin> We need an additional CVE entry for other distributions that simply drop you | into a root shell in single user mode. | Christey> Based on Craig"s comments, need to consider if this is an LOA | issue. | Frech> XF:redhat-single-user-auth(4026) | View |
Page 428 of 20943, showing 5 records out of 104715 total, starting on record 2136, ending on 2140
