CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 123 | CVE-1999-0123 | Candidate | Race condition in Linux mailx command allows local users to read user files. | Modified (20000105-01) | ACCEPT(3) Baker, Frech, Ozancin | NOOP(1) Wall | View | |
| 474 | CVE-1999-0476 | Candidate | A weak encryption algorithm is used for passwords in SCO TermVision, allowing them to be easily decrypted by a local user. | Proposed (19990721) | ACCEPT(3) Baker, Frech, Ozancin | NOOP(3) LeBlanc, Northcutt, Wall | View | |
| 3388 | CVE-2001-0575 | Candidate | Buffer overflow in lpshut in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a long first argument to lpshut. | Modified (20020225-01) | ACCEPT(3) Baker, Frech, Williams | MODIFY(1) Bishop | NOOP(4) Cole, Foat, Wall, Ziese | Bishop> recommend combining as stated in analysis | Baker> http://support.caldera.com/caldera/solution?11=113723&130=0988647911&14=&2715=&15=&2716=&57=search&58=&2900=dckSSu3pru&25=6&3=SSE072B | "What is SSE072B, the buffer overflow security patch for Openserver 5? (Ref. #113723)" | Buffer overflows have been found in the following 19 | SCO OpenServer 5 utilities: | | /usr/bin/accept | /usr/bin/cancel | /usr/mmdf/bin/deliver | /usr/bin/disable | /usr/bin/enable | /usr/lib/libcurses.a | /usr/bin/lp | /usr/lib/lpadmin | /usr/lib/lpfilter | /usr/lib/lpforms | /usr/lib/lpmove | /usr/lib/lpshut | /usr/bin/lpstat | /usr/lib/lpusers | /usr/bin/recon | /usr/bin/reject | /usr/bin/rmail | /usr/lib/sendmail | /usr/bin/tput | | NOTE: the accept, reject, enable, and disable commands are | symbolically linked to the same binary. | | Running any of the above utilities with a very large argument | can result in a core dump. | View |
| 3396 | CVE-2001-0583 | Candidate | Alt-N Technologies MDaemon 3.5.4 allows a remote attacker to create a denial of service via the URL request of a MS-DOS device (such as GET /aux) to (1) the Worldclient service at port 3000, or (2) the Webconfig service at port 3001. | Proposed (20010727) | ACCEPT(3) Baker, Frech, Williams | NOOP(5) Bishop, Cole, Foat, Wall, Ziese | Baker> ftp1.deerfield.com/pub/mdaemon/Archive/3.5.6/ | This is the site for downloading from Deerfield, the parent company. | The release notes on the web site only apply to version 4.0 and higher. | If you download the 3.5.6 version, you can then install the software, | which will also install the release notes, named RelNotes.txt, in the | docs sub-directory. Inside this file is a vendor confirmation | of sorts, at least close enough for me.... | I quote: | "----------------------------------------------------------------------------- | MDaemon Server v3.X Release Notes | ----------------------------------------------------------------------------- | | PLEASE READ THIS ENTIRE DOCUMENT. IMPORTANT ISSUES RELATED TO THE RELEASE OF | MDAEMON 3.X ARE LISTED TOWARD THE BOTTOM OF THIS DOCUMENT. THEY ARE | CRITICALLY IMPORTANT! PLEASE READ THIS ENTIRE DOCUMENT. | | ---------------------------- | MDaemon v3.5.6 - Mar 9, 2001 | ---------------------------- | | SPECIAL CONSIDERATIONS | ---------------------- | | o None (see 3.51 below) | | MAJOR NEW FEATURES | ------------------ | | o None | | | ADDITIONAL CHANGES AND NEW FEATURES | ----------------------------------- | | o None | | FIXES | ----- | | o Fix to memory leak in IMAP server. | o Fix to crash problem in WorldClient Standard and WebConfig web server. | o Fix to "Send As" address not being used as MAIL FROM when forwarding. | o Fix to "local only" restriction not being applied when mail collected | via DomainPOP. | | ------------------------------- | MDaemon v3.5.4 - Feb 19th, 2001 | ------------------------------- | " | This matches the described problems in the worldclient and webconfig servers | which are part of the Mdaemon package. | View |
| 3379 | CVE-2001-0566 | Candidate | Cisco Catalyst 2900XL switch allows a remote attacker to create a denial of service via an empty UDP packet sent to port 161 (SNMP) when SNMP is disabled. | Proposed (20010727) | ACCEPT(3) Baker, Frech, Ziese | MODIFY(1) Bishop | NOOP(2) Cole, Wall | REJECT(1) Foat | Bishop> Is the entire switch shut down or is traffic blocked for a | limited time? | Foat> Unable to duplicate event | Baker> Seems kind of strange that someone that works at Cisco would accept this vulnerability, | yet someone else would reject it. I was unable to find a reference on the Cisco | web site, so perhaps we need some clarification about the accept vote, like what build | of the OS is vulnerable, since the "fail to duplicate" may be a different build of the | OS. | CHANGE> [Baker changed vote from REVIEWING to ACCEPT] | View |
Page 950 of 20943, showing 5 records out of 104715 total, starting on record 4746, ending on 4750
