CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1899 | CVE-2000-0321 | Candidate | Buffer overflow in IC Radius package allows a remote attacker to cause a denial of service via a long user name. | Proposed (20000518) | ACCEPT(1) Levy | MODIFY(1) Frech | NOOP(4) Baker, Cole, LeBlanc, Wall | REJECT(1) Christey | Frech> XF:icradius-username-bo | Every reference I pull up shows the product"s name as ICRADIUS. See | http://mysql.eunet.fi/Downloads/Contrib/icradius.README | Christey> In a followup, Alan DeKok (aland@FREERADIUS.ORG) says that | this could occur in other RADIUS servers also; however, the | bug could only be exploited if someone has altered the | configuration file, which shouldn"t normally be modifiable | by anyone else. | | So, this should be REJECTed since the bug doesn"t directly give | anyone else any additional privileges or access. | Christey> Alan DeKok <aland@FREERADIUS.ORG> says it applies to other RADIUS | programs also, *however* since it needs a valid username, only | the RADIUS owner can exploit it by changing the config file. But | if the config file can be written by others - well, that"s still | a potential risk, but you"ve probably got bigger problems then. | - http://marc.theaimsgroup.com/?l=bugtraq&m=95671883515060&w=2 | Look at ChangeLog at ftp://ftp.cheapnet.net/pub/icradius/ChangeLog | | Possible confirmation in 0.15: "sql_getvpdata now dynamically | allocates buffer sizes for sql queries to avoid over runs" | | But that"s a bit general. | | Alan Kok said that Cistron and other RADIUS servers were affected; the | ICRADIUS changelog says to check the Cistron logs for other possible | bug fixes, since ICRADIUS uses Cistron codebase. Go back to | freeradius.org and find link to Cistron at | http://www.miquels.cistron.nl/radius/ | | Cistron changelog at http://www.miquels.cistron.nl/radius/ChangeLog It | has different version numbers - go back to ICRADIUS changelog to find | rought equivalents. ICRADIUS 0.15 uses Cistron 1.6.3 patches, so | start from there. | | No apparent problems in 1.6.3 or 1.6.4, but 1.6.1 says: "Fix all | strcpy(), strcat(), sprintf() and sccanf() calls for buffer | overflows." So perhaps the problem was fixed then? Or maybe the | vulnerable sscanf() call was missed and/or disregarded because it was | believed that the hostname could be trusted since it came from a | well-controlled configuration file? | View |
| 2190 | CVE-2000-0614 | Candidate | Tnef program in Linux systems allows remote attackers to overwrite arbitrary files via TNEF encoded compressed attachments which specify absolute path names for the decompressed output. | Proposed (20000719) | ACCEPT(1) Levy | MODIFY(1) Frech | NOOP(4) Cole, LeBlanc, Magdych, Wall | REVIEWING(1) Christey | Christey> This problem appears in AMaViS as well, so they may be the | same codebase. If so, then CD:SF-CODEBASE says to merge the | two (thus ADDREF BID:1461). If they are not the same | codebase, then create a separate candidate for BID:1461. | Frech> XF:linux-tnef-email-overwrite(4915) | CHANGE> [Magdych changed vote from REVIEWING to NOOP] | View |
| 2051 | CVE-2000-0473 | Candidate | Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker to cause a denial of service via a long GET request for a program in the cgi-bin directory. | Proposed (20000712) | ACCEPT(1) Levy | MODIFY(1) Frech | REVIEWING(1) Christey | Christey> Appears to be the same as, or similar to, CVE-2000-0011, which was | also discovered by USSR. Comments on the AnalogX web site are | decidedly sparse. In CVE-2000-0011, USSR only claims that | the vendor was informed, so is this still the same problem? | | XF:simpleserver-long-url-dos | Frech> XF:simpleserver-long-url-dos(4693) | Please review whether your BUGTRAQ:19991231 reference is correct; seems like | this is the reference to CVE-2000-0011: Buffer overflow in AnalogX | SimpleServer:WWW HTTP server allows remote attackers to execute commands via | a long GET request. They are subtle; almost the only thing that changed was | the version. | A possible reference is "Remote DoS attack in AnalogX SimpleServer WWW | Version 1.05 Vulnerability" at http://www.ussrback.com/labs45.html. | View |
| 2108 | CVE-2000-0531 | Candidate | Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets. | Modified (20040818) | ACCEPT(1) Levy | MODIFY(1) Frech | REVIEWING(1) Christey | Frech> XF:linux-gpm-gpmctl-dos(5010) | Christey> ADDREF REDHAT:RHSA-2000:045-01 | ADDREF BUGTRAQ:20000728 MDKSA:2000-025 gpm update | URL:http://archives.neohapsis.com/archives/bugtraq/2000-07/0409.html | CHANGE> [Christey changed vote from NOOP to REVIEWING] | Christey> Per Andre Frech"s comments for CVE-2000-0667. | View |
| 487 | CVE-1999-0489 | Candidate | MSHTML.DLL in Internet Explorer 5.0 allows a remote attacker to paste a file name into the file upload intrinsic control, a variant of "untrusted scripted paste" as described in MS:MS98-013. | Modified (19991205-01) | ACCEPT(1) Levy | MODIFY(1) Wall | NOOP(2) Baker, Ozancin | RECAST(1) Prosser | REJECT(1) Christey | REVIEWING(1) Frech | Frech> Wasn"t Untrusted scripted paste MS98-015? I can find no mention of a | clipboard in either. | I cannot proceed on this one without further clarification. | Wall> (source: MS:MS99-012) | Prosser> agree with Andre here. The Untrusted Scripted paste | vulnerability was originally addressed in MS98-015 and it is in the file | upload intrinsic control in which an attacker can paste the name of a file | on the target"s drive in the control and a form submission would then send | that file from the attacked machine to the remote web site. This one has | nothing to do with the clipboard. What the advisory mentioned here, | MS99-012, does is replace the MSHTML parsing engine which is supposed to fix | the original Untrusted Scripted Paste issue and a variant, as well as the | two Cross-Frame variants and a privacy issue in IMG SRC. | The vulnerability that allowed reading of a user"s clipboard is the Forms | 2.0 Active X control vulnerability discussed in MS99-01 | Christey> The advisory should have been listed as MS99-012. | CVE-1999-0468 describes the untrusted scripted paste problem | in MS99-012. | Frech> Pending response to guidance request. 12/6/01. | View |
Page 739 of 20943, showing 5 records out of 104715 total, starting on record 3691, ending on 3695
