[PROPOSAL] Cluster RECENT-22 - 33 candidates

["Steven M. Christey" <coley@linus.mitre.org>]

The following cluster contains 33 candidates that were announced
between 5/21/2000 and 6/5/2000.

The candidates are listed in order of priority.  Priority 1 and
Priority 2 candidates both deal with varying levels of vendor
confirmation, so they should be easy to review and it can be trusted
that the problems are real.

If you discover that any RECENT-XX cluster is incomplete with respect
to the problems discovered during the associated time frame, please
send that information to me so that candidates can be assigned.

- Steve



Summary of votes to use (in ascending order of "severity")
----------------------------------------------------------

ACCEPT - voter accepts the candidate as proposed
NOOP - voter has no opinion on the candidate
MODIFY - voter wants to change some MINOR detail (e.g. reference/description)
REVIEWING - voter is reviewing/researching the candidate, or needs more info
RECAST - candidate must be significantly modified, e.g. split or merged
REJECT - candidate is "not a vulnerability", or a duplicate, etc.

1) Please write your vote on the line that starts with "VOTE: ".  If
   you want to add comments or details, add them to lines after the
   VOTE: line.

2) If you see any missing references, please mention them so that they
   can be included.  References help greatly during mapping.

3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes.
   So if you don't have sufficient information for a candidate but you
   don't want to NOOP, use a REVIEWING.

********** NOTE ********** NOTE ********** NOTE ********** NOTE **********

Please keep in mind that your vote and comments will be recorded and
publicly viewable in the mailing list archives or in other formats.

=================================
Candidate: CAN-2000-0467
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000614 Splitvt exploit
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0125.html
Reference: DEBIAN:20000605 root exploit in splitvt
Reference: URL:http://www.debian.org/security/2000/20000605a
Reference: BID:1346
Reference: URL:http://www.securityfocus.com/bid/1346

Buffer overflow in Linux splitvt 1.6.3 and earlier allows local users
to gain root privileges via a long password in the screen locking
function.


ED_PRI CAN-2000-0467 1


VOTE:

=================================
Candidate: CAN-2000-0495
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: MS:MS00-038
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-038.asp
Reference: BID:1282
Reference: URL:http://www.securityfocus.com/bid/1282

Microsoft Windows Media Encoder allows remote attackers to cause a
denial of service via a malformed request, aka the "Malformed Windows
Media Encoder Request" vulnerability.


ED_PRI CAN-2000-0495 1


VOTE:

=================================
Candidate: CAN-2000-0517
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: CERT:CA-2000-08
Reference: URL:http://www.cert.org/advisories/CA-2000-08.html
Reference: BID:1260
Reference: URL:http://www.securityfocus.com/bid/1260

Netscape 4.73 and earlier does not properly warn users about a
potentially invalid certificate if the user has previously accepted
the certificate for a different web site, which could allow remote
attackers to spoof a legitimate web site by compromising that site's
DNS information.


ED_PRI CAN-2000-0517 1


VOTE:

=================================
Candidate: CAN-2000-0518
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: MS:MS00-039
Reference: http://www.microsoft.com/technet/security/bulletin/ms00-039.asp
Reference: BID:1309
Reference: URL:http://www.securityfocus.com/bid/1309

Internet Explorer 4.0 and 5.0 does not properly verify all contents of
an SSL certificate if a connection is made to the server via an image
or a frame, aka one of two different "SSL Certificate Validation"
vulnerabilities.


ED_PRI CAN-2000-0518 1


VOTE:

=================================
Candidate: CAN-2000-0519
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: MS:MS00-039
Reference: http://www.microsoft.com/technet/security/bulletin/ms00-039.asp
Reference: BID:1309
Reference: URL:http://www.securityfocus.com/bid/1309

Internet Explorer 4.0 and 5.0 does not properly re-validate an SSL
certificate if the user establishes a new SSL session with the same
server during the same Internet Explorer session, aka one of two
different "SSL Certificate Validation" vulnerabilities.


ED_PRI CAN-2000-0519 1


VOTE:

=================================
Candidate: CAN-2000-0530
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000531 KDE::KApplication feature?
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0387.html
Reference: CALDERA:CSSA-2000-015.0
Reference: URL:ftp://ftp.calderasystems.com/pub/OpenLinux/security/CSSA-2000-015.0.txt
Reference: BID:1291
Reference: URL:http://www.securityfocus.com/bid/1291

The KApplication class in the KDE 1.1.2 configuration file management
capability allows local users to overwrite arbitrary files.


ED_PRI CAN-2000-0530 1


VOTE:

=================================
Candidate: CAN-2000-0537
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000606 BRU Vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0013.html
Reference: CALDERA:CSSA-2000-018.0
Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2000-018.0.txt
Reference: BID:1321
Reference: URL:http://www.securityfocus.com/bid/1321

BRU backup software allows local users to append data to arbitrary
files by specifying an alternate configuration file with the
BRUEXECLOG environmental variable.


ED_PRI CAN-2000-0537 1


VOTE:

=================================
Candidate: CAN-2000-0545
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000602 /usr/bin/Mail exploit for Slackware 7.0 (mail-slack.c)
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0435.html
Reference: DEBIAN:20000605 mailx: mail group exploit in mailx
Reference: URL:http://www.debian.org/security/2000/20000605
Reference: BID:1305
Reference: URL:http://www.securityfocus.com/bid/1305

Buffer overflow in mailx mail command (aka Mail) on Linux systems
allows local users to gain privileges via a long -c (carbon copy)
parameter.


ED_PRI CAN-2000-0545 1


VOTE:

=================================
Candidate: CAN-2000-0474
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 Remote DoS attack in Real Networks Real Server (Strike #2) Vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0410.html
Reference: BUGTRAQ:20000601 Remote DoS attack in RealServer: USSR-2000043
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0427.html
Reference: BID:1288
Reference: URL:http://www.securityfocus.com/bid/1288

Real Networks RealServer 7.x allows remote attackers to cause a denial
of service via a malformed request for a page in the viewsource
directory.


ED_PRI CAN-2000-0474 2


VOTE:

=================================
Candidate: CAN-2000-0486
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000530 An Analysis of the TACACS+ Protocol and its Implementations
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0369.html
Reference: CONFIRM:http://archives.neohapsis.com/archives/bugtraq/2000-05/0370.html
Reference: BID:1293
Reference: URL:http://www.securityfocus.com/bid/1293

Buffer overflow in Cisco TACACS+ tac_plus server allows remote
attackers to cause a denial of service via a malformed packet with a
long length field.


ED_PRI CAN-2000-0486 2


VOTE:

=================================
Candidate: CAN-2000-0505
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000603 Re: IBM HTTP SERVER / APACHE
Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.BSF.4.20.0006031912360.45740-100000@alive.znep.com
Reference: BID:1284
Reference: URL:http://www.securityfocus.com/bid/1284

The Apache 1.3.x HTTP server for Windows platforms allows remote
attackers to list directory contents by requesting a URL containing a
large number of / characters.


ED_PRI CAN-2000-0505 2


VOTE:

=================================
Candidate: CAN-2000-0536
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: CONFIRM:http://www.synack.net/xinetd/
Reference: BID:1381
Reference: URL:http://www.securityfocus.com/bid/1381

xinetd 2.1.8.x does not properly restrict connections if hostnames are
used for access control and the connecting host does not have a
reverse DNS entry.


ED_PRI CAN-2000-0536 2


VOTE:

=================================
Candidate: CAN-2000-0468
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 HP Security vulnerability in the man command
Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.SOL.4.02.10006021014400.4779-100000@nofud.nwest.attws.com
Reference: BID:1302
Reference: URL:http://www.securityfocus.com/bid/1302

man in HP-UX 10.20 and 11 allows local attackers to overwrite files
via a symlink attack.


ED_PRI CAN-2000-0468 3


VOTE:

=================================
Candidate: CAN-2000-0470
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 Hardware Exploit - Gets network Down
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0398.html
Reference: BID:1290
Reference: URL:http://www.securityfocus.com/bid/1290

Allegro RomPager HTTP server allows remote attackers to cause a denial
of service via a malformed authentication request.


ED_PRI CAN-2000-0470 3


VOTE:

=================================
Candidate: CAN-2000-0476
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 [rootshell.com] Xterm DoS Attack
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0409.html
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0420.html
Reference: BID:1298
Reference: URL:http://www.securityfocus.com/bid/1298

xterm, Eterm, and rxvt allow an attacker to cause a denial of service
by embedding certain escape characters which force the window to be
resized.


ED_PRI CAN-2000-0476 3


VOTE:

=================================
Candidate: CAN-2000-0481
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: VULN-DEV:20000601 Kmail heap overflow
Reference: URL:http://securityfocus.com/templates/archive.pike?list=82&date=2000-06-22&msg=00060200422401.01667@lez
Reference: BID:1380
Reference: URL:http://www.securityfocus.com/bid/1380

Buffer overflow in KDE Kmail allows a remote attacker to cause a
denial of service via an attachment with a long file name.


ED_PRI CAN-2000-0481 3


VOTE:

=================================
Candidate: CAN-2000-0487
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: MS:MS00-032
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-032.asp
Reference: BID:1295
Reference: URL:http://www.securityfocus.com/bid/1295

The Protected Store in Windows 2000 does not properly select the
strongest encryption when available, which causes it to use a default
of 40-bit encryption instead of 56-bit DES encryption, aka the
"Protected Store Key Length" vulnerability.


ED_PRI CAN-2000-0487 3


VOTE:

=================================
Candidate: CAN-2000-0488
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 DST2K0007: Buffer Overrun in ITHouse Mail Server v1.04
Reference: URL:http://archives.neohapsis.com/archives/win2ksecadvice/2000-q2/0148.html
Reference: BID:1285
Reference: URL:http://www.securityfocus.com/bid/1285

Buffer overflow in ITHouse mail server 1.04 allows remote attackers to
execute arbitrary commands via a long RCPT TO mail command.


ED_PRI CAN-2000-0488 3


VOTE:

=================================
Candidate: CAN-2000-0489
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:19990826 Local DoS in FreeBSD
Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.10.9908270039010.16315-100000@thetis.deor.org
Reference: BUGTRAQ:20000601 Local FreeBSD, Openbsd, NetBSD, DoS Vulnerability - Mac OS X affected
Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=NCBBKFKDOLAGKIAPMILPCEJLCEAA.labs@ussrback.com
Reference: BID:622
Reference: URL:http://www.securityfocus.com/bid/622

FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of
service by creating a large number of socket pairs using the
socketpair function, setting a large buffer size via setsockopt, then
writing large buffers.


ED_PRI CAN-2000-0489 3


VOTE:

=================================
Candidate: CAN-2000-0490
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 Netwin's Dmail package
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0407.html
Reference: BID:1297
Reference: URL:http://www.securityfocus.com/bid/1297

Buffer overflow in the NetWin DSMTP 2.7q in the NetWin dmail package
allows remote attackers to execute arbitrary commands via a long ETRN
request.


ED_PRI CAN-2000-0490 3


VOTE:

=================================
Candidate: CAN-2000-0491
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000521 "gdm" remote hole
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0241.html
Reference: SUSE:20000524 Security hole in gdm <= 2.0beta4-25
Reference: URL:http://www.suse.de/de/support/security/suse_security_announce_49.txt
Reference: BUGTRAQ:20000607 Conectiva Linux Security Announcement - gdm
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0025.html
Reference: CALDERA:CSSA-2000-013.0
Reference: URL:ftp://ftp.calderasystems.com/pub/OpenLinux/security/CSSA-2000-013.0.txt
Reference: BID:1233
Reference: URL:http://www.securityfocus.com/bid/1233
Reference: BID:1279
Reference: URL:http://www.securityfocus.com/bid/1279
Reference: BID:1370
Reference: URL:http://www.securityfocus.com/bid/1370

Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and
wdm allows remote attackers to execute arbitrary commands or cause a
denial of service via a long FORWARD_QUERY request.


ED_PRI CAN-2000-0491 3


VOTE:

=================================
Candidate: CAN-2000-0492
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000609 Insecure encryption in PassWD v1.2
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0450.html
Reference: BID:1300
Reference: URL:http://www.securityfocus.com/bid/1300

PassWD 1.2 uses weak encryption (trivial encoding) to store passwords,
which allows an attacker who can read the password file to easliy
decrypt the passwords.


ED_PRI CAN-2000-0492 3


VOTE:

=================================
Candidate: CAN-2000-0493
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: VULN-DEV:20000601 Vulnerability in SNTS
Reference: URL:http://archives.neohapsis.com/archives/vuln-dev/2000-q2/0843.html
Reference: BID:1289
Reference: URL:http://www.securityfocus.com/bid/1289

Buffer overflow in Simple Network Time Sync (SMTS) daemon allows
remote attackers to cause a denial of service via a long command.


ED_PRI CAN-2000-0493 3


VOTE:

=================================
Candidate: CAN-2000-0507
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 DST2K0006: Denial of Service Possibility in Imate WebMail Server
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95990195708509&w=2
Reference: BID:1286
Reference: URL:http://www.securityfocus.com/bid/1286

Imate Webmail Server 2.5 allows remote attackers to cause a denial of
service via a long HELO command.


ED_PRI CAN-2000-0507 3


VOTE:

=================================
Candidate: CAN-2000-0509
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000601 DST2K0008: Buffer Overrun in Sambar Server 4.3
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=95990103207665&w=2
Reference: BID:1287
Reference: URL:http://www.securityfocus.com/bid/1287

Buffer overflows in the finger and whois demonstration scripts in
Sambar Server 4.3 allow remote attackers to execute arbitrary commands
via a long hostname.


ED_PRI CAN-2000-0509 3


VOTE:

=================================
Candidate: CAN-2000-0521
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000605 MDMA Advisory #5: Reading of CGI Scripts under Savant Webserver
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0469.html
Reference: BID:1313
Reference: URL:http://www.securityfocus.com/bid/1313

Savant web server allows remote attackers to read source code of CGI
scripts via a GET request that does not include the HTTP version
number.


ED_PRI CAN-2000-0521 3


VOTE:

=================================
Candidate: CAN-2000-0524
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000604 Microsoft Outlook (Express) bug..
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0045.html
Reference: BID:1333
Reference: URL:http://www.securityfocus.com/bid/1333

Microsoft Outlook and Outlook Express allow remote attackers to cause
a denial of service by sending email messages with blank fields such
as BCC, Reply-To, Return-Path, or From.


ED_PRI CAN-2000-0524 3


VOTE:

=================================
Candidate: CAN-2000-0544
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: NTBUGTRAQ:20000604 anonymous SMBwriteX DoS
Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0231.html
Reference: BID:1304
Reference: URL:http://www.securityfocus.com/bid/1304

Windows NT and Windows 2000 hosts allow a remote attacker to cause a
denial of service via malformed DCE/RPC SMBwriteX requests
that contain an invalid data length.


ED_PRI CAN-2000-0544 3


VOTE:

=================================
Candidate: CAN-2000-0551
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: BUGTRAQ:20000523 I think
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0339.html
Reference: BID:1263
Reference: URL:http://www.securityfocus.com/bid/1263

The file transfer mechanism in Danware NetOp 6.0 does not provide
authentication, which allows remote attackers to access and modify
arbitrary files.


ED_PRI CAN-2000-0551 3


VOTE:

=================================
Candidate: CAN-2000-0553
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: unknown
Reference: BUGTRAQ:20000525 Security Vulnerability in IPFilter 3.3.15 and 3.4.3
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-05/0326.html
Reference: BID:1308
Reference: URL:http://www.securityfocus.com/bid/1308

Race condition in IPFilter firewall 3.4.3 and earlier, when configured
with overlapping "return-rst" and "keep state" rules, allows remote
attackers to bypass access restrictions.


ED_PRI CAN-2000-0553 3


VOTE:

=================================
Candidate: CAN-2000-0556
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: NTBUGTRAQ:20000608 DST2K0011: DoS & BufferOverrun in CMail v2.4.7 WebMail
Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0248.html
Reference: CONFIRM:http://www.computalynx.net/news/Jun2000/news0806200001.html
Reference: BID:1319
Reference: URL:http://www.securityfocus.com/bid/1319

Buffer overflow in the web interface for Cmail 2.4.7 allows remote
attackers to cause a denial of service by sending a large user name to
the user dialog running on port 8002.


ED_PRI CAN-2000-0556 3


VOTE:

=================================
Candidate: CAN-2000-0557
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: NTBUGTRAQ:20000608 DST2K0011: DoS & BufferOverrun in CMail v2.4.7 WebMail
Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0248.html
Reference: BID:1318
Reference: URL:http://www.securityfocus.com/bid/1318

Buffer overflow in the web interface for Cmail 2.4.7 allows remote
attackers to execute arbitrary commands via a long GET request.


ED_PRI CAN-2000-0557 3


VOTE:

=================================
Candidate: CAN-2000-0564
Published:
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20000712
Assigned: 20000711
Category: SF
Reference: NTBUGTRAQ:20000529 ICQ Web Front Remote DoS Attack Vulnerability
Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0218.html

The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b,
and others allows remote attackers to cause a denial of service via a
URL with a long name parameter.


ED_PRI CAN-2000-0564 3


VOTE: