CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 3239 | CVE-2001-0421 | Candidate | FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permissions, by providing a valid username with an invalid password followed by a CWD ~ command, which could release sensitive information such as shadowed passwords, or fill the disk partition. | Proposed (20010524) | ACCEPT(1) Cole | MODIFY(2) Dik, Frech | NOOP(1) Wall | REVIEWING(2) Williams, Ziese | Frech> XF:solaris-ftp-shadow-recovery(6422) | Dik> sun bug ids: 4436988 | | The "world-readable" core dump problem does not exist in | Solaris 8 and other Solaris releases which have been patched | to include the "coreadm" command and possibly earlier (many release | have been patched to avoid core dumps in more situations and | always make them mode 0600) | | Solaris 8 was the first release to contain coreadm initially | (backported and include in 2.6 & 7) | Solaris 7 was the first release to make core dumps mode 0600. | (fix backported to 2.6 and earlier) | View |
| 3244 | CVE-2001-0426 | Candidate | Buffer overflow in dtsession on Solaris, and possibly other operating systems, allows local users to gain privileges via a long LANG environmental variable. | Proposed (20010524) | ACCEPT(1) Dik | MODIFY(1) Frech | NOOP(2) Cole, Wall | REVIEWING(1) Ziese | Frech> XF:solaris-dtsession-bo(6366) | Dik> sun bug: 4448598 | View |
| 1393 | CVE-1999-1413 | Candidate | Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg. | Proposed (20010912) | MODIFY(2) Dik, Frech | NOOP(2) Cole, Foat | Frech> XF:solaris-coredump-symlink(7196) | Dik> sun bug: 1208241 | | Also applies to set-uid executables that have made real | and effective uid identical | View |
| 1005 | CVE-1999-1025 | Candidate | CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user"s console session when the host is an NIS+ client, which allows others with physical access to login with any string. | Proposed (20010912) | ACCEPT(4) Cole, Dik, Foat, Stracener | MODIFY(1) Frech | Frech> XF:solaris-cde-nisplus-lock(7473) | Dik> sun bug: 4115685 | View |
| 2273 | CVE-2000-0697 | Candidate | The administration interface for the dwhttpd web server in Solaris AnswerBook2 allows interface users to remotely execute commands via shell metacharacters. | Modified (20080918) | ACCEPT(4) Baker, Cole, Dik, Levy | MODIFY(1) Frech | NOOP(2) Christey, Wall | Frech> XF:solaris-answerbook2-remote-execution | Christey> XF:solaris-answerbook2-remote-execution | http://xforce.iss.net/static/5058.php | CHANGE> [Dik changed vote from REVIEWING to ACCEPT] | Dik> COMMENTS | verified bug existance. | Christey> There needs to be a separate item for the .. problem reported | in this same post. | View |
Page 81 of 20943, showing 5 records out of 104715 total, starting on record 401, ending on 405
