Re: [PROPOSAL] Cluster RECENT-24 - 31 candidates

[aleph1@securityfocus.com]

* Steven M. Christey (coley@LINUS.MITRE.ORG) [000712 02:33]:
> The following cluster contains 31 candidates that were announced
> between 6/14/2000 and 6/22/2000.
> 
> The candidates are listed in order of priority.  Priority 1 and
> Priority 2 candidates both deal with varying levels of vendor
> confirmation, so they should be easy to review and it can be trusted
> that the problems are real.
> 
> If you discover that any RECENT-XX cluster is incomplete with respect
> to the problems discovered during the associated time frame, please
> send that information to me so that candidates can be assigned.
> 
> - Steve
> 
> 
> Summary of votes to use (in ascending order of "severity")
> ----------------------------------------------------------
> 
> ACCEPT - voter accepts the candidate as proposed
> NOOP - voter has no opinion on the candidate
> MODIFY - voter wants to change some MINOR detail (e.g. reference/description)
> REVIEWING - voter is reviewing/researching the candidate, or needs more info
> RECAST - candidate must be significantly modified, e.g. split or merged
> REJECT - candidate is "not a vulnerability", or a duplicate, etc.
> 
> 1) Please write your vote on the line that starts with "VOTE: ".  If
>    you want to add comments or details, add them to lines after the
>    VOTE: line.
> 
> 2) If you see any missing references, please mention them so that they
>    can be included.  References help greatly during mapping.
> 
> 3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes.
>    So if you don't have sufficient information for a candidate but you
>    don't want to NOOP, use a REVIEWING.
> 
> ********** NOTE ********** NOTE ********** NOTE ********** NOTE **********
> 
> Please keep in mind that your vote and comments will be recorded and
> publicly viewable in the mailing list archives or in other formats.
> 
> =================================
> Candidate: CAN-2000-0466
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000620
> Category: SF
> Reference: ISS:20000620 Insecure call of external program in AIX cdmount
> Reference: URL:http://xforce.iss.net/alerts/advise55.php
> Reference: BID:1384
> Reference: URL:http://www.securityfocus.com/bid/1384
> 
> AIX cdmount allows local users to gain root privileges via shell
> metacharacters.
> 
> 
> ED_PRI CAN-2000-0466 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0475
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: MS:MS00-020
> Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-020.asp
> Reference: BID:1350
> Reference: URL:http://www.securityfocus.com/bid/1350
> 
> Windows 2000 allows a local user process to access another user's
> desktop within the same windows station, aka the "Desktop Separation"
> vulnerability.
> 
> 
> ED_PRI CAN-2000-0475 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0483
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000615 [Brian@digicool.com: [Zope] Zope security alert and 2.1.7 update [*important*]]
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0144.html
> Reference: CONFIRM:http://www.zope.org/Products/Zope/Hotfix_06_16_2000/security_alert
> Reference: REDHAT:RHSA-2000:038-01
> Reference: URL:http://www.securityfocus.com/templates/advisory.html?id=2350
> Reference: BUGTRAQ:2000615 Conectiva Linux Security Announcement - ZOPE
> Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000616103807.A3768@conectiva.com.br
> Reference: BID:1354
> Reference: URL:http://www.securityfocus.com/bid/1354
> 
> The Zope DocumentTemplate package allows a remote attacker to modify
> DTMLDocuments or DTMLMethods without authorization.
> 
> 
> ED_PRI CAN-2000-0483 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0485
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: MS:MS00-041
> Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms00-041.asp
> Reference: BID:1292
> Reference: URL:http://www.securityfocus.com/bid/1292
> 
> Microsoft SQL Server allows local users to obtain database passwords
> via the Data Transformation Service (DTS) package Properties dialog,
> aka the "DTS Password" vulnerability.
> 
> 
> ED_PRI CAN-2000-0485 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0533
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: SGI:20000601-01-P
> Reference: URL:ftp://sgigate.sgi.com/security/20000601-01-P
> Reference: BID:1379
> Reference: URL:http://www.securityfocus.com/bid/1379
> 
> Vulnerability in cvconnect in SGI IRIX WorkShop allows local users to
> overwrite arbitrary files.
> 
> 
> ED_PRI CAN-2000-0533 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0539
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: ALLAIRE:ASB00-015
> Reference: URL:http://www.allaire.com/handlers/index.cfm?ID=16290&Method=Full
> Reference: BID:1386
> Reference: URL:http://www.securityfocus.com/bid/1386
> 
> Servlet examples in Allaire JRun 2.3.x allow remote attackers to
> obtain sensitive information, e.g. listing HttpSession ID's via the
> SessionServlet servlet.
> 
> 
> ED_PRI CAN-2000-0539 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0540
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: ALLAIRE:ASB00-015
> Reference: URL:http://www.allaire.com/handlers/index.cfm?ID=16290&Method=Full
> Reference: BID:1386
> Reference: URL:http://www.securityfocus.com/bid/1386
> 
> JSP sample files in Allaire JRun 2.3.x allow remote attackers to
> access arbitrary files (e.g. via viewsource.jsp) or obtain
> configuration information.
> 
> 
> ED_PRI CAN-2000-0540 1
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0469
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000613 CGI: Selena Sol's WebBanner ( Random Banner Generator ) Vulnerability
> Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-06-22&msg=ILENKALMCAFBLHBGEOFKGEJCCAAA.jwesterink@jwesterink.daxis.nl
> Reference: BUGTRAQ:20000620 Re: CGI: Selena Sol's WebBanner ( Random Banner Generator ) Vulnerability
> Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=4.2.0.58.20000620193604.00979950@mail.clark.net
> Reference: BID:1347
> Reference: URL:http://www.securityfocus.com/bid/1347
> 
> Selena Sol WebBanner 4.0 allows remote attackers to read arbitrary
> files via a .. (dot dot) attack.
> 
> 
> ED_PRI CAN-2000-0469 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0477
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000614 Vulnerabilities in Norton Antivirus for Exchange
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0136.html
> Reference: BID:1351
> Reference: URL:http://www.securityfocus.com/bid/1351
> 
> Buffer overflow in Norton Antivirus for Exchange (NavExchange) allows
> remote attackers to cause a denial of service via a .zip file that
> contains long file names.
> 
> 
> ED_PRI CAN-2000-0477 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0478
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000614 Vulnerabilities in Norton Antivirus for Exchange
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0136.html
> Reference: BID:1351
> Reference: URL:http://www.securityfocus.com/bid/1351
> 
> In some cases, Norton Antivirus for Exchange (NavExchange) enters a
> "fail-open" state which allows viruses to pass through the server.
> 
> 
> ED_PRI CAN-2000-0478 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0510
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 CUPS DoS Bugs
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0188.html
> Reference: CONFIRM:ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch
> Reference: BID:1373
> Reference: URL:http://www.securityfocus.com/bid/1373
> 
> CUPS (Common Unix Printing System) 1.04 and earlier allows remote
> attackers to cause a denial of service via a malformed IPP request.
> 
> 
> ED_PRI CAN-2000-0510 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0511
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 CUPS DoS Bugs
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0188.html
> Reference: CONFIRM:ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch
> Reference: BID:1373
> Reference: URL:http://www.securityfocus.com/bid/1373
> 
> CUPS (Common Unix Printing System) 1.04 and earlier allows remote
> attackers to cause a denial of service via a CGI POST request.
> 
> 
> ED_PRI CAN-2000-0511 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0512
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 CUPS DoS Bugs
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0188.html
> Reference: CONFIRM:ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch
> Reference: BID:1373
> Reference: URL:http://www.securityfocus.com/bid/1373
> 
> CUPS (Common Unix Printing System) 1.04 and earlier does not properly
> delete request files, which allows a remote attacker to cause a denial
> of service.
> 
> 
> ED_PRI CAN-2000-0512 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0513
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 CUPS DoS Bugs
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0188.html
> Reference: CONFIRM:ftp://ftp.easysw.com/pub/cups/1.0.5/cups-DoS.patch
> Reference: BID:1373
> Reference: URL:http://www.securityfocus.com/bid/1373
> 
> CUPS (Common Unix Printing System) 1.04 and earlier allows remote
> attackers to cause a denial of service by authenticating with a user
> name that does not exist or does not have a shadow password.
> 
> 
> ED_PRI CAN-2000-0513 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0514
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000614 Security Advisory: REMOTE ROOT VULNERABILITY IN GSSFTP DAEMON
> Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=ldvsnufao18.fsf@saint-elmos-fire.mit.edu
> Reference: CONFIRM:http://web.mit.edu/kerberos/www/advisories/ftp.txt
> Reference: BID:1374
> Reference: URL:http://www.securityfocus.com/bid/1374
> 
> GSSFTP FTP daemon in Kerberos 5 1.1.x does not properly restrict
> access to some FTP commands, which allows remote attackers to cause a
> denial of service, and local users to gain root privileges.
> 
> 
> ED_PRI CAN-2000-0514 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0528
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000619 Net Tools PKI server exploits
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0166.html
> Reference: CONFIRM:ftp://ftp.tis.com/gauntlet/hide/pki/hotfix.txt
> Reference: BID:1364
> Reference: URL:http://www.securityfocus.com/bid/1364
> 
> Net Tools PKI Server does not properly restrict access to remote
> attackers when the XUDA template files do not contain absolute
> pathnames for other files.
> 
> 
> ED_PRI CAN-2000-0528 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0529
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000619 Net Tools PKI server exploits
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0166.html
> Reference: CONFIRM:ftp://ftp.tis.com/gauntlet/hide/pki/hotfix.txt
> Reference: BID:1363
> Reference: URL:http://www.securityfocus.com/bid/1363
> 
> Net Tools PKI Server allows remote attackers to cause a denial of
> service via a long HTTP request.
> 
> 
> ED_PRI CAN-2000-0529 2
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0562
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 BlackICE by Network ICE Corp vulnerability against Back Orifice 1.2
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0190.html
> 
> BlackIce Defender 2.1 and earlier, and BlackIce Pro 2.0.23 and
> earlier, do not properly block Back Orifice traffic when the security
> setting is Nervous or lower.
> 
> 
> ED_PRI CAN-2000-0562 2
> 
> 
> VOTE: REVIEWING
> 


What do others think? Should this be a vuln? I can see the argument
that some features are simply not available unless you use the maximum
security settings.

> =================================
> Candidate: CAN-2000-0471
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000614 Vulnerability in Solaris ufsrestore
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0114.html
> Reference: BID:1348
> Reference: URL:http://www.securityfocus.com/bid/1348
> 
> Buffer overflow in ufsrestore in Solaris 8 and earlier allows local
> users to gain root privileges via a long pathname.
> 
> 
> ED_PRI CAN-2000-0471 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0473
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:19991231 Local / Remote GET Buffer Overflow Vulnerability in AnalogX SimpleServer:WWW HTTP Server v1.1
> Reference: MISC:http://www.analogx.com/contents/download/network/sswww.htm
> Reference: BID:1349
> Reference: URL:http://www.securityfocus.com/bid/1349
> 
> Buffer overflow in AnalogX SimpleServer 1.05 allows a remote attacker
> to cause a denial of service via a long GET request for a program in
> the cgi-bin directory.
> 
> 
> ED_PRI CAN-2000-0473 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0479
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000616 Multiples Remotes DoS Attacks in Dragon Server v1.00 and v2.00
> Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=96113734714517&w=2
> Reference: BID:1352
> Reference: URL:http://www.securityfocus.com/bid/1352
> 
> Dragon FTP server allows remote attackers to cause a denial of service
> via a long USER command.
> 
> 
> ED_PRI CAN-2000-0479 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0480
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000616 Multiples Remotes DoS Attacks in Dragon Server v1.00 and v2.00
> Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=96113734714517&w=2
> Reference: BID:1352
> Reference: URL:http://www.securityfocus.com/bid/1352
> 
> Dragon telnet server allows remote attackers to cause a denial of service
> via a long username.
> 
> 
> ED_PRI CAN-2000-0480 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0484
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000616 Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability
> Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=96113651713414&w=2
> Reference: NTBUGTRAQ:20000616 Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability
> Reference: URL:http://marc.theaimsgroup.com/?l=ntbugtraq&m=96151775004229&w=2
> Reference: BID:1355
> Reference: URL:http://www.securityfocus.com/bid/1355
> 
> Buffer overflow in Small HTTP Server allows remote attackers to cause
> a denial of service via a long GET request.
> 
> 
> ED_PRI CAN-2000-0484 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0494
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000616 Veritas Volume Manager 3.0.x hole
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0151.html
> Reference: BID:1356
> Reference: URL:http://www.securityfocus.com/bid/1356
> 
> Veritas Volume Manager creates a world writable .server_pids file,
> which allows local users to add arbitrary commands into the file,
> which is then executed by the vmsa_server script.
> 
> 
> ED_PRI CAN-2000-0494 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0500
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: CF
> Reference: BUGTRAQ:20000621 BEA WebLogic /file/ showcode vulnerability
> Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=96161462915381&w=2
> Reference: BID:1378
> Reference: URL:http://www.securityfocus.com/bid/1378
> 
> The default configuration of BEA WebLogic 5.1.0 allows a remote
> attacker to view source code of programs by requesting a URL beginning
> with /file/, which causes the default servlet to display the file
> without further processing.
> 
> 
> ED_PRI CAN-2000-0500 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0501
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: NTBUGTRAQ:20000616 mdaemon 2.8.5.0 WinNT and Win9x remote DoS
> Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0277.html
> Reference: BID:1366
> Reference: URL:http://www.securityfocus.com/bid/1366
> 
> Race condition in MDaemon 2.8.5.0 POP server allows local users to
> cause a denial of service by entering a UIDL command and quickly
> exiting the server.
> 
> 
> ED_PRI CAN-2000-0501 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0504
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000619 XFree86: libICE DoS
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0170.html
> Reference: BID:1369
> Reference: URL:http://www.securityfocus.com/bid/1369
> 
> libICE in XFree86 allows remote attackers to cause a denial of service
> by specifying a large value which is not properly checked by the
> SKIP_STRING macro.
> 
> 
> ED_PRI CAN-2000-0504 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0531
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 Bug in gpm
> Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.10.10006201453090.1812-200000@apollo.aci.com.pl
> Reference: BID:1377
> Reference: URL:http://www.securityfocus.com/bid/1377
> 
> Linux gpm program allows local users to cause a denial of service by
> flooding the /dev/gpmctl device with STREAM sockets.
> 
> 
> ED_PRI CAN-2000-0531 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0541
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000617 Infosec.20000617.panda.a
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0164.html
> Reference: BID:1359
> Reference: URL:http://www.securityfocus.com/bid/1359
> 
> The Panda Antivirus console on port 2001 allows local users to execute
> arbitrary commands without authentication via the CMD command.
> 
> 
> ED_PRI CAN-2000-0541 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0543
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000614 Remote DoS attack in Networks Associates PGP Certificate Server Version 2.5 Vulnerability
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0107.html
> Reference: BID:1343
> Reference: URL:http://www.securityfocus.com/bid/1343
> 
> The command port for PGP Certificate Server 2.5.0 and 2.5.1 allows
> remote attackers to cause a denial of service if their hostname does
> not have a reverse DNS entry and they connect to port 4000.
> 
> 
> ED_PRI CAN-2000-0543 3
> 
> 
> VOTE: ACCEPT
> 
> =================================
> Candidate: CAN-2000-0561
> Published:
> Final-Decision:
> Interim-Decision:
> Modified:
> Proposed: 20000712
> Assigned: 20000711
> Category: SF
> Reference: BUGTRAQ:20000620 DST2K0018: Multiple BufferOverruns in WebBBS HTTP Server v1.15
> Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-06/0175.html
> Reference: BID:1365
> Reference: URL:http://www.securityfocus.com/bid/1365
> 
> Buffer overflow in WebBBS 1.15 allows remote attackers to execute
> arbitrary commands via a long HTTP GET request.
> 
> 
> ED_PRI CAN-2000-0561 3
> 
> 
> VOTE: ACCEPT

-- 
Elias Levy
SecurityFocus.com
http://www.securityfocus.com/
Si vis pacem, para bellum