CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 968 | CVE-1999-0988 | Candidate | UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack. | Modified (20000121-01) | ACCEPT(3) Baker, Blake, Cole | MODIFY(1) Frech | RECAST(1) Stracener | REVIEWING(1) Christey | Stracener> The pkg* programs pkgtrans, pkginfo, pkgcat, pkginstall, and pkgparam | can be used to mount etc/shadow printing attacks as a result of the | "dacread" permission (cf. /etc/security/tcb/privs). The procedural | differences between the individual exploits for each of these utilities | are therefore inconsequential. CVE-1999-0988 should be merged with | CVE-1999-0828. From the standpoint of maintaining consistency of the | level of abstraction used in CVE, the co-existence of CANS | 1999-0988/1999-0828 present two choices: either merge 0988 with 0828, or | split 0828 into 4 distinct candidates, keeping 0988 intact. Due to the | very small differences (in principle) between the exploits subsumed by | 0828 and 0988 and the shared dacread permissions of the pkg* suite, I | suggest a merge. Below is a summary of the data upon which my decision | was based. | utility exploit | -------- ---------------------------------- | pkgtrans --> symlink + dacread permission prob | pkginfo --> truss (debugging utility) in conjunction with pkginfio -d | etc/shadow. In this case, it captures the interaction between | pkginfo the shadow file. Once again: dacread. | pkgcat --> buffer overflow + dacread permission prob | pkginstall -> buffer overflow + dacread permission prob | pkgparam --> -f etc/shadow (works because of dacread). | Christey> This is a tough one. While there are few procedural | differences, one could view "assignment of an improper | permission" as a "class" of problems along the lines of | buffer overflows and the like. Just like some programs | were fine until they got turned into CGI scripts, this | could be an emerging pattern which should be given | consideration. Consider the Eyedog and scriptlet.typelib | ActiveX utilities being marked as safe for scripting | (CVE-1999-0668 and 0669). | | ftp://ftp.sco.com/SSE/security_bulletins/SB-99.28a loosely | alludes to this problem; the README for patch SSE053 | effectively confirms it. | Frech> XF:unixware-pkgtrans-symlink | View |
| 506 | CVE-1999-0509 | Candidate | Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands. | Modified (20000114-01) | ACCEPT(2) Northcutt, Wall | MODIFY(1) Frech | NOOP(1) Baker | REVIEWING(1) Christey | Christey> What is the right level of abstraction to use here? Should | we combine all possible interpreters into a single entry, | or have a different entry for each one? I"ve often seen | Perl separated from other interpreters - is it included | by default in some Windows web server configurations? | Christey> Add tcsh, zsh, bash, rksh, ksh, ash, to support search. | Frech> XF:http-cgi-vuln(146) | View |
| 114 | CVE-1999-0114 | Candidate | Local users can execute commands as other users, and read other users" files, through the filter command in the Elm elm-2.4 mail package using a symlink attack. | Modified (20000106-01) | ACCEPT(7) Armstrong, Bishop, Blake, Cole, Landfield, Shostack, Wall | MODIFY(2) Baker, Frech | NOOP(3) Christey, Northcutt, Ozancin | REVIEWING(1) Levy | Frech> XF:elm-filter2 | CHANGE> [Wall changed vote from NOOP to ACCEPT] | Landfield> with Frech modifications | Baker> ADD REF http://www.cert.org/ftp/cert_bulletins/VB-95:10a.elm Official Advisory | Christey> The correct URL is http://www.cert.org/vendor_bulletins/VB-95:10a.elm | Need to make sure that this CERT advisory describes the right | problem, especially since the CERT advisory is dated December | 18, 1995 and the original Bugtraq post was December 26, 1995. | Christey> BID:1802 | URL:http://www.securityfocus.com/bid/1802 | BID:1802 doesn"t include the 1999 posting - does Security | Focus think that the 1999 post describes a different | vulnerability? | Christey> XF:elm-filter2 isn"t on the X-Force web site. How about XF:elm-filter(402) ? | Its references point to the December 26, 1995 BUgtraq post. | | Also consider CIAC:G-36 and CERT:VB-95:10 | Frech> DELREF:XF:elm-filter2(711) | ADDREF:XF:elm-filter(402) | View |
| 397 | CVE-1999-0398 | Candidate | In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | Frech> Followups to the bugtraq message (1/24/99) indicate that 1.2.27 was not yet | released. v1.2.26 should be substituted in the description for "27. | XF:ssh-exp-account-access | View |
| 430 | CVE-1999-0431 | Candidate | Linux 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation attack, causing a denial of service. | Modified (20000106-01) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(1) Christey | Frech> XF:linux-zerolength-fragment | Christey> Consider adding BID:2247 | View |
Page 568 of 20943, showing 5 records out of 104715 total, starting on record 2836, ending on 2840
