Cluster 03: VEN-SUN

["Steven M. Christey" <coley@linus.mitre.org>]

This cluster has 18 vulnerabilities.

------------------------------------------
Candidate: CAN-1999-0054
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00171

Sun's ftpd daemon is subject to a denial of service

------------------------------------------
Candidate: CAN-1999-0055
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00172
Reference: RSI:RSI.0005.05-14-98.SUN.LIBNSL
Reference: XF:sun-libnsl

Buffer overflows in Sun libnsl allow root access.

------------------------------------------
Candidate: CAN-1999-0056
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00174
Reference: XF:sun-ping

Buffer overflow in Sun's ping program can give root access to local users.

------------------------------------------
Candidate: CAN-1999-0065
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00181
Reference: XF:hp-dtmail

Bug in how dtmail handles attachments allows remote attacker to
execute commands with the same privileges as the user who is
reading the message.

------------------------------------------
Candidate: CAN-1999-0069
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00169

Solaris ufsrestore buffer overflow.

------------------------------------------
Candidate: CAN-1999-0121
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00164
Reference: ERS:ERS-SVA-E01-1997:005.1

Buffer overflow in dtaction command gives root access.

------------------------------------------
Candidate: CAN-1999-0185
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00156

In Solaris, a remote user could connect from an FTP server's
data port to an rlogin server on a host that trusts the FTP server,
allowing remote command execution.

------------------------------------------
Candidate: CAN-1999-0188
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00182
Reference: XF:sun-passwd-dos

The passwd command in Solaris could be subjected to a denial of service.

------------------------------------------
Candidate: CAN-1999-0190
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00167

Solaris rpcbind can be exploited to overwrite arbitrary files and gain
root access.

------------------------------------------
Candidate: CAN-1999-0212
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00168

rpc.mountd in Linux and Solaris would generate error messages that
allowed an attacker to determine what files were on the server.

------------------------------------------
Candidate: CAN-1999-0263
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00173
Reference: XF:sun-sunwadmap

Solaris SUNWadmap can be exploited to obtain root access.

------------------------------------------
Candidate: CAN-1999-0296
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00162
Reference: XF:sun-volrmmount

Solaris volrmmount program allows attackers to read any file.

------------------------------------------
Candidate: CAN-1999-0300
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00155
Reference: XF:sun-niscache

nis_cachemgr for Solaris NIS+ allows attackers to add malicious
NIS+ servers.

------------------------------------------
Candidate: CAN-1999-0301
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00149
Reference: AUSCERT:AUSCERT-97.17
Reference: XF:sun-ps2bo

Buffer overflow in SunOS/Solaris ps command.

------------------------------------------
Candidate: CAN-1999-0302
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00176
Reference: XF:sun-ftp-server

SunOS/Solaris FTP clients can be forced to execute arbitrary commands
from a malicious FTP server.

------------------------------------------
Candidate: CAN-1999-0320
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00166

SunOS rpc.cmsd allows attackers to obtain root access by overwriting
arbitrary files.

------------------------------------------
Candidate: CAN-1999-0369
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00183

The Sun sdtcm_convert calendar utility for OpenWindows has a buffer
overflow which can gain root access.

------------------------------------------
Candidate: CAN-1999-0370
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: SUN:00184

In Sun Solaris and SunOS, man and catman contain vulnerabilities
that allow overwriting arbitrary files.