CVE

Id
5868  
CVE No.
CVE-2002-1484  
Status
Candidate  
Description
DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.  
Phase
Proposed (20030317)  
Votes
ACCEPT(2) Armstrong, Cole | MODIFY(1) Baker | NOOP(2) Cox, Wall  
Comments
Baker> The default behavior is the verbose debug messages, so the description should indicate that this is the default configuration.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
33043 5868 CVE-2002-1484 BUGTRAQ:20020917 Advisory: TCP-Connection risk in DB4Web  View
33044 5868 CVE-2002-1484 URL:http://archives.neohapsis.com/archives/bugtraq/2002-09/0201.html  View
33045 5868 CVE-2002-1484 VULNWATCH:20020919 Advisory: TCP-Connection risk in DB4Web  View
33046 5868 CVE-2002-1484 URL:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0125.html  View
33047 5868 CVE-2002-1484 XF:db4web-tcp-portscan(10136)  View
33048 5868 CVE-2002-1484 URL:http://www.iss.net/security_center/static/10136.php  View
33049 5868 CVE-2002-1484 BID:5725  View

Related JVN