[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PROPOSAL] Cluster RECENT-41 - 42 candidates

The following cluster contains 42 candidates that were announced
between October 5 and October 12, 2000.

Note that the voting web site will not be updated with this cluster
until sometime Wednesday.

The candidates are listed in order of priority.  Priority 1 and
Priority 2 candidates both deal with varying levels of vendor
confirmation, so they should be easy to review and it can be trusted
that the problems are real.

If you discover that any RECENT-XX cluster is incomplete with respect
to the problems discovered during the associated time frame, please
send that information to me so that candidates can be assigned.

- Steve



Summary of votes to use (in ascending order of "severity")
----------------------------------------------------------

ACCEPT - voter accepts the candidate as proposed
NOOP - voter has no opinion on the candidate
MODIFY - voter wants to change some MINOR detail (e.g. reference/description)
REVIEWING - voter is reviewing/researching the candidate, or needs more info
RECAST - candidate must be significantly modified, e.g. split or merged
REJECT - candidate is "not a vulnerability", or a duplicate, etc.

1) Please write your vote on the line that starts with "VOTE: ".  If
   you want to add comments or details, add them to lines after the
   VOTE: line.

2) If you see any missing references, please mention them so that they
   can be included.  References help greatly during mapping.

3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes.
   So if you don't have sufficient information for a candidate but you
   don't want to NOOP, use a REVIEWING.

********** NOTE ********** NOTE ********** NOTE ********** NOTE **********

Please keep in mind that your vote and comments will be recorded and
publicly viewable in the mailing list archives or in other formats.

======================================================
Candidate: CAN-2000-0816
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0816
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20000929
Category: SF
Reference: ISS:20001006 Insecure call of external programs in Red Hat Linux tmpwatch
Reference: URL:http://xforce.iss.net/alerts/advise64.php
Reference: REDHAT:RHSA-2000:080-01
Reference: URL:http://www.redhat.com/support/errata/RHSA-2000-080-01.html
Reference: MANDRAKE:MDKSA-2000:056
Reference: URL:http://www.linux-mandrake.com/en/security/MDKSA-2000-056.php3?dis=7.1
Reference: BID:1785
Reference: URL:http://www.securityfocus.com/bid/1785

Linux tmpwatch --fuser option allows local users to execute arbitrary
commands by creating files whose names contain shell metacharacters.

Analysis
----------------
ED_PRI CAN-2000-0816 1
Vendor Acknowledgement: yes

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0916
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0916
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: FREEBSD:FreeBSD-SA-00:52
Reference: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:52.tcp-iss.asc
Reference: BID:1766
Reference: URL:http://www.securityfocus.com/bid/1766

FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an
insufficient random number generator to generate initial TCP sequence
numbers (ISN), which allows remote attackers to spoof TCP connections.

Analysis
----------------
ED_PRI CAN-2000-0916 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0920
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0920
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001006 Vulnerability in BOA web server v0.94.8.2
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0092.html
Reference: FREEBSD:FreeBSD-SA-00:60
Reference: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:60.boa.asc
Reference: DEBIAN:20001009 boa: exposes contents of local files
Reference: URL:http://www.debian.org/security/2000/20001009
Reference: BID:1770
Reference: URL:http://www.securityfocus.com/bid/1770
Reference: XF:boa-webserver-get-dir-traversal
Reference: URL:http://xforce.iss.net/static/5330.php

Directory traversal vulnerability in BOA web server 0.94.8.2 and
earlier allows remote attackers to read arbitrary files via a modified
.. (dot dot) attack in the GET HTTP request that uses a "%2E" instead
of a "."

Analysis
----------------
ED_PRI CAN-2000-0920 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0965
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0965
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: XF:hp-virtualvault-nsapi-dos
Reference: URL:http://xforce.iss.net/static/5361.php
Reference: HP:HPSBUX0010-124
Reference: URL:http://archives.neohapsis.com/archives/hp/2000-q4/0012.html

The NSAPI plugins for TGA and the Java Servlet proxy in HP-UX VVOS
10.24 and 11.04 allows an attacker to cause a denial of service (high
CPU utilization)

Analysis
----------------
ED_PRI CAN-2000-0965 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0967
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0967
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: ATSTAKE:A101200-1
Reference: URL:http://www.atstake.com/research/advisories/2000/a101200-1.txt
Reference: MANDRAKE:MDKSA-2000:062
Reference: URL:http://www.linux-mandrake.com/en/security/MDKSA-2000-062.php3?dis=7.1
Reference: DEBIAN:20001014 php3: possible remote exploit
Reference: URL:http://www.debian.org/security/2000/20001014a
Reference: DEBIAN:20001014 php4: possible remote exploit
Reference: URL:http://www.debian.org/security/2000/20001014b
Reference: CALDERA:CSSA-2000-037.0
Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2000-037.0.txt
Reference: BUGTRAQ:20001012 Conectiva Linux Security Announcement - mod_php3
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0204.html
Reference: BID:1786
Reference: URL:http://www.securityfocus.com/bid/1786
Reference: XF:php-logging-format-string
Reference: URL:http://xforce.iss.net/static/5359.php

PHP 3 and 4 do not properly cleanse user-injected format strings,
which allows remote attackers to execute arbitrary commands by
triggering error messages that are improperly written to the error
logs.

Analysis
----------------
ED_PRI CAN-2000-0967 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0974
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0974
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001011 GPG 1.0.3 doesn't detect modifications to files with multiple signatures
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0201.html
Reference: REDHAT:RHSA-2000:089-04
Reference: URL:http://www.redhat.com/support/errata/RHSA-2000-089-04.html
Reference: CALDERA:CSSA-2000-038.0
Reference: MANDRAKE:MDKSA-2000:063-1
Reference: CONECTIVA:CLSA-2000:334
Reference: URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000334
Reference: BUGTRAQ:20001025 Immunix OS Security Update for gnupg package
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0361.html
Reference: XF:gnupg-message-modify
Reference: URL:http://xforce.iss.net/static/5386.php
Reference: BID:1797
Reference: URL:http://www.securityfocus.com/bid/1797

GnuPG (gpg) 1.0.3 does not properly check all signatures of a file
containing multiple documents, which allows an attacker to modify
contents of all documents but the first without detection.

Analysis
----------------
ED_PRI CAN-2000-0974 1
Vendor Acknowledgement: yes

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0979
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0979
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001012 NSFOCUS SA2000-05: Microsoft Windows 9x NETBIOS password
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97147777618139&w=2
Reference: MS:MS00-072
Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS00-072.asp
Reference: BID:1780
Reference: URL:http://www.securityfocus.com/bid/1780
Reference: XF:win9x-share-level-password
Reference: URL:http://xforce.iss.net/static/5395.php

File and Print Sharing service in Windows 95, Windows 98, and Windows
Me does not properly check the password for a file share, which allows
remote attackers to bypass share access controls by sending a 1-byte
password that matches the first character of the real password, aka
the "Share Level Password" vulnerability.

Analysis
----------------
ED_PRI CAN-2000-0979 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0980
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0980
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: MS:MS00-073
Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS00-073.asp
Reference: BID:1781
Reference: URL:http://www.securityfocus.com/bid/1781
Reference: XF:win-nmpi-packet-dos
Reference: URL:http://xforce.iss.net/static/5357.php

NMPI (Name Management Protocol on IPX) listener in Microsoft NWLink
does not properly filter packets from a broadcast address, which
allows remote attackers to cause a broadcast storm and flood the
network.

Analysis
----------------
ED_PRI CAN-2000-0980 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0982
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0982
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: MS:MS00-076
Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS00-076.asp
Reference: BID:1793
Reference: URL:http://www.securityfocus.com/bid/1793
Reference: XF:ie-cache-info
Reference: URL:http://xforce.iss.net/static/5367.php

Internet Explorer before 5.5 forwards cached user credentials for a
secure web site to insecure pages on the same web site, which could
allow remote attackers to obtain the credentials by monitoring
connections to the web server, aka the "Cached Web Credentials"
vulnerability.

Analysis
----------------
ED_PRI CAN-2000-0982 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1061
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1061
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category:
Reference: MS:MS00-075
Reference: URL:http://www.microsoft.com/technet/security/bulletin/MS00-075.asp

Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows
an unsigned applet to create and use ActiveX controls, which allows a
remote attacker to bypass Internet Explorer's security settings and
execute arbitrary commands via a malicious web page or email, aka the
"Microsoft VM ActiveX Component" vulnerability.

Analysis
----------------
ED_PRI CAN-2000-1061 1
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0946
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0946
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: NTBUGTRAQ:20001012 Security issue with Compaq Easy Access Keyboard software
Reference: URL:http://archives.neohapsis.com/archives/ntbugtraq/2000-q4/0023.html
Reference: CONFIRM:http://www5.compaq.com/support/files/desktops/us/revision/1723.html

Compaq Easy Access Keyboard software 1.3 does not properly disable
access to custom buttons when the screen is locked, which could allow
an attacker to gain privileges or execute programs without
authorization.

Analysis
----------------
ED_PRI CAN-2000-0946 2
Vendor Acknowledgement: yes changelog

ACKNOWLEDGEMENT:
The Changelog for Version 1.51 A states: "[this patch] provides
enhanced security, by locking down the Easy Access Keyboard buttons"

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0978
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0978
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001010 Big Brother Systems and Network Monitor vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0162.html
Reference: BID:1779
Reference: URL:http://www.securityfocus.com/bid/1779

bbd server in Big Brother System and Network Monitor before 1.5c2
allows remote attackers to execute arbitrary commands via the "&"
shell metacharacter.

Analysis
----------------
ED_PRI CAN-2000-0978 2
Vendor Acknowledgement: yes email-announce

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1005
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1005
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001009 Security Advisory : eXtropia WebStore (web_store.cgi) Directory Traversal Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/138495
Reference: BID:1774
Reference: URL:http://www.securityfocus.com/bid/1774
Reference: XF:extropia-webstore-fileread
Reference: URL:http://xforce.iss.net/static/5347.php

Directory traversal vulnerability in html_web_store.cgi and
web_store.cgi CGI programs in eXtropia WebStore allows remote
attackers to read arbitrary files via a .. (dot dot) attack on the
page parameter.

Analysis
----------------
ED_PRI CAN-2000-1005 2
Vendor Acknowledgement: yes followup

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1010
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1010
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001006 talkd [WAS: Re: OpenBSD Security Advisory]
Reference: URL:http://www.securityfocus.com/archive/1/137890
Reference: BID:1764
Reference: URL:http://www.securityfocus.com/bid/1764
Reference: XF:linux-talkd-overwrite-root
Reference: URL:http://xforce.iss.net/static/5344.php

Format string vulnerability in talkd in OpenBSD and possibly other
BSD-based OSes allows remote attackers to execute arbitrary commands
via a user name that contains format characters.

Analysis
----------------
ED_PRI CAN-2000-1010 2
Vendor Acknowledgement: yes advisory

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0914
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0914
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001005 obsd_fun.c
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0078.html
Reference: BID:1759
Reference: URL:http://www.securityfocus.com/bid/1759
Reference: XF:bsd-arp-request-dos
Reference: URL:http://xforce.iss.net/static/5340.php

OpenBSD 2.6 and earlier allows remote attackers to cause a denial of
service by flooding the server with ARP requests.

Analysis
----------------
ED_PRI CAN-2000-0914 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0919
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0919
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001007 PHPix advisory
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0117.html
Reference: BID:1773
Reference: URL:http://www.securityfocus.com/bid/1773
Reference: XF:phpix-dir-traversal
Reference: URL:http://xforce.iss.net/static/5331.php

Directory traversal vulnerability in PHPix Photo Album 1.0.2 and
earlier allows remote attackers to read arbitrary files via a .. (dot
dot) attack.

Analysis
----------------
ED_PRI CAN-2000-0919 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0921
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0921
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001007 Security Advisory: Hassan Consulting's shop.cgi Directory Traversal Vulnerability.
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0115.html
Reference: BID:1777
Reference: URL:http://www.securityfocus.com/bid/1777
Reference: XF:hassan-shopping-cart-dir-traversal
Reference: URL:http://xforce.iss.net/static/5342.php

Directory traversal vulnerability in Hassan Consulting shop.cgi
shopping cart program allows remote attackers to read arbitrary files
via a .. (dot dot) attack on the page parameter.

Analysis
----------------
ED_PRI CAN-2000-0921 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0922
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0922
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001008 Security Advisory: Bytes Interactive's Web Shopper (shopper.cgi) Directory Traversal Vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0120.html
Reference: BID:1776
Reference: URL:http://www.securityfocus.com/bid/1776
Reference: XF:web-shopper-directory-traversal
Reference: URL:http://xforce.iss.net/static/5351.php

Directory traversal vulnerability in Bytes Interactive Web Shopper
shopping cart program (shopper.cgi) 2.0 and earlier allows remote
attackers to read arbitrary files via a .. (dot dot) attack on the
newpage parameter.

Analysis
----------------
ED_PRI CAN-2000-0922 3
Vendor Acknowledgement: no

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0923
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0923
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001006 Fwd: APlio PRO web shell
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0107.html
Reference: XF:uclinux-apliophone-bin-execute
Reference: URL:http://xforce.iss.net/static/5333.php
Reference: BID:1784
Reference: URL:http://www.securityfocus.com/bid/1784

authenticate.cgi CGI program in Aplio PRO allows remote attackers to
execute arbitrary commands via shell metacharacters in the password
parameter.

Analysis
----------------
ED_PRI CAN-2000-0923 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0924
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0924
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001009 Master Index traverse advisory
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0141.html
Reference: BID:1772
Reference: URL:http://www.securityfocus.com/bid/1772

Directory traversal vulnerability in search.cgi CGI script in Armada
Master Index allows remote attackers to read arbitrary files via a
.. (dot dot) attack in the "catigory" parameter.

Analysis
----------------
ED_PRI CAN-2000-0924 3
Vendor Acknowledgement:

It is possible that the affected parameter is spelled "category" and
the discloser did not report it accurately.

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0928
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0928
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001006 DST2K0040: QuotaAdvisor 4.1 by WQuinn susceptible to any user bei ng able to list (not read) all files on any server running QuotaAdvisor.
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0091.html
Reference: BID:1765
Reference: URL:http://www.securityfocus.com/bid/1765

WQuinn QuotaAdvisor 4.1 allows users to list directories and files by
running a report on the targeted shares.

Analysis
----------------
ED_PRI CAN-2000-0928 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0953
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0953
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001009 Shambala 4.5 vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0134.html
Reference: BID:1778
Reference: URL:http://www.securityfocus.com/bid/1778
Reference: XF:shambala-connection-dos
Reference: URL:http://xforce.iss.net/static/5345.php

Shambala Server 4.5 allows remote attackers to cause a denial of
service by opening then closing a connection.

Analysis
----------------
ED_PRI CAN-2000-0953 3
Vendor Acknowledgement: unknown claimed

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0954
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0954
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001009 Shambala 4.5 vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0134.html
Reference: BID:1771
Reference: URL:http://www.securityfocus.com/bid/1771
Reference: XF:shambala-password-plaintext
Reference: URL:http://xforce.iss.net/static/5346.php

Shambala Server 4.5 stores passwords in plaintext, which could allow
local users to obtain the passwords and compromise the server.

Analysis
----------------
ED_PRI CAN-2000-0954 3
Vendor Acknowledgement: unknown claimed
Content Decisions: DESIGN-NO-ENCRYPTION

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0960
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0960
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001011 Netscape Messaging server 4.15 poor error strings
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97138100426121&w=2
Reference: BID:1787
Reference: URL:http://www.securityfocus.com/bid/1787
Reference: XF:netscape-messaging-email-verify
Reference: URL:http://xforce.iss.net/static/5364.php

The POP3 server in Netscape Messaging Server 4.15p1 generates
different error messages for incorrect user names versus incorrect
passwords, which allows remote attackers to determine valid users on
the system and harvest email addresses for spam abuse.

Analysis
----------------
ED_PRI CAN-2000-0960 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0961
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0961
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20000928 commercial products and security [ + new bug ]
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-09/0334.html
Reference: BID:1721
Reference: URL:http://www.securityfocus.com/bid/1721
Reference: XF:netscape-messaging-list-dos
Reference: URL:http://xforce.iss.net/static/5292.php

Buffer overflow in IMAP server in Netscape Messaging Server 4.15 Patch
2 allows local users to execute arbitrary commands via a long LIST
command.

Analysis
----------------
ED_PRI CAN-2000-0961 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0963
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0963
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001009 ncurses buffer overflows
Reference: URL:http://www.securityfocus.com/archive/1/138550
Reference: CALDERA:CSSA-2000-036.0
Reference: URL:http://www.calderasystems.com/support/security/advisories/CSSA-2000-036.0.txt
Reference: BID:1142
Reference: URL:http://www.securityfocus.com/bid/1142

Buffer overflow in ncurses library allows local users to execute
arbitrary commands via long environmental information such as TERM or
TERMINFO_DIRS.

Analysis
----------------
ED_PRI CAN-2000-0963 3
Vendor Acknowledgement: yes advisory
Content Decisions: SF-LOC

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0975
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0975
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001012 Anaconda Advisory
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0210.html

Directory traversal vulnerability in apexec.pl in Anaconda Foundation
Directory allows remote attackers to read arbitrary files via a
.. (dot dot) attack.

Analysis
----------------
ED_PRI CAN-2000-0975 3
Vendor Acknowledgement: unknown claimed notification

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0976
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0976
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001012 another Xlib buffer overflow
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0211.html
Reference: BID:1805
Reference: URL:http://www.securityfocus.com/bid/1805

Buffer overflow in xlib in XFree 3.3.x possibly allows local users to
execute arbitrary commands via a long DISPLAY environment variable or
a -display command line parameter.

Analysis
----------------
ED_PRI CAN-2000-0976 3
Vendor Acknowledgement:

INCLUSION:
This might not be exploitable, as a post by Robert van der Meulen says
that "the display number can only contain numeric values."  See
http://archives.neohapsis.com/archives/bugtraq/2000-10/0237.html

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0977
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0977
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001011 Mail File POST Vulnerability
Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2000-10/0172.html
Reference: BID:1807
Reference: URL:http://www.securityfocus.com/bid/1807

mailfile.cgi CGI program in MailFile 1.10 allows remote attackers to
read arbitrary files by specifying the target file name in the
"filename" parameter in a POST request, which is then sent by email to
the address specified in the "email" parameter.

Analysis
----------------
ED_PRI CAN-2000-0977 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-0985
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0985
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: ATSTAKE:A101200-2
Reference: URL:http://www.atstake.com/research/advisories/2000/a101200-2.txt
Reference: BID:1789
Reference: URL:http://www.securityfocus.com/bid/1789

Buffer overflow in All-Mail 1.1 allows remote attackers to execute
arbitrary commands via a long "MAIL FROM" or "RCPT TO" command.

Analysis
----------------
ED_PRI CAN-2000-0985 3
Vendor Acknowledgement: unknown unsopported

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1002
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1002
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001012 Re: Netscape Messaging server 4.15 poor error strings
Reference: URL:http://www.securityfocus.com/archive/1/139523
Reference: XF:communigate-email-verify
Reference: URL:http://xforce.iss.net/static/5363.php
Reference: BID:1792
Reference: URL:http://www.securityfocus.com/bid/1792

POP3 daemon in Stalker CommuniGate Pro 3.3.2 generates different error
messages for invalid usernames versus invalid passwords, which allows
remote attackers to determine valid email addresses on the server for
SPAM attacks.

Analysis
----------------
ED_PRI CAN-2000-1002 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1003
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1003
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001012 NSFOCUS SA2000-04: Microsoft Win9x client driver type comparing vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/139511
Reference: BID:1794
Reference: URL:http://www.securityfocus.com/bid/1794
Reference: XF:win-netbios-driver-type-dos
Reference: URL:http://xforce.iss.net/static/5370.php

NETBIOS client in Windows 95 and Windows 98 allows a remote attacker
to cause a denial of service by changing a file sharing service to
return an unknown driver type, which causes the client to crash.

Analysis
----------------
ED_PRI CAN-2000-1003 3
Vendor Acknowledgement: unknown claimed notified

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1018
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1018
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001124
Category: SF
Reference: BUGTRAQ:20001010 Shred 1.0 Bug Report
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97119799515246&w=2
Reference: BUGTRAQ:20001011 Shred v1.0 Fix
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97131166004145&w=2
Reference: BID:1788
Reference: URL:http://www.securityfocus.com/bid/1788

shred 1.0 file wiping utility does not properly open a file for
overwriting or flush its buffers, which prevents shred from properly
replacing the file's data and allows local users to recover the file.

Analysis
----------------
ED_PRI CAN-2000-1018 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1062
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1062
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: BUGTRAQ:20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97119729613778&w=2
Reference: BID:1775
Reference: URL:http://www.securityfocus.com/bid/1775
Reference: XF:hp-jetdirect-firmware-dos
Reference: URL:http://xforce.iss.net/static/5353.php

Buffer overflow in the FTP service in HP JetDirect printer card
Firmware x.08.20 and earlier allows remote attackers to cause a denial
of service.

Analysis
----------------
ED_PRI CAN-2000-1062 3
Vendor Acknowledgement: unknown discloser-claimed
Content Decisions: SF-LOC

CD:SF-LOC suggests having separate CVE entries for separate buffer
overflows.  While the VIGILANTE advisory indicates that multiple
services are affected, it is not completely clear whether each service
has a separate buffer overflow, or if there is a single overflow in a
library used by all services.  If it is the latter, then CD:SF-LOC
suggests merging this item with the others for the Telnet and LPD
services.  However, in the absence of complete information, the
default action is to keep these items split.

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1063
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1063
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: BUGTRAQ:20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97119729613778&w=2
Reference: BID:1775
Reference: URL:http://www.securityfocus.com/bid/1775
Reference: XF:hp-jetdirect-firmware-dos
Reference: URL:http://xforce.iss.net/static/5353.php

Buffer overflow in the Telnet service in HP JetDirect printer card
Firmware x.08.20 and earlier allows remote attackers to cause a denial
of service.

Analysis
----------------
ED_PRI CAN-2000-1063 3
Vendor Acknowledgement: unknown discloser-claimed
Content Decisions: SF-LOC

CD:SF-LOC suggests having separate CVE entries for separate buffer
overflows.  While the VIGILANTE advisory indicates that multiple
services are affected, it is not completely clear whether each service
has a separate buffer overflow, or if there is a single overflow in a
library used by all services.  If it is the latter, then CD:SF-LOC
suggests combining this item with the others for the FTP and LPD
services.  However, in the absence of complete information, the
default action is to keep these items split.

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1064
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1064
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: BUGTRAQ:20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97119729613778&w=2
Reference: BID:1775
Reference: URL:http://www.securityfocus.com/bid/1775
Reference: XF:hp-jetdirect-firmware-dos
Reference: URL:http://xforce.iss.net/static/5353.php

Buffer overflow in the LPD service in HP JetDirect printer card
Firmware x.08.20 and earlier allows remote attackers to cause a denial
of service.

Analysis
----------------
ED_PRI CAN-2000-1064 3
Vendor Acknowledgement: unknown discloser-claimed
Content Decisions: SF-LOC

CD:SF-LOC suggests having separate CVE entries for separate buffer
overflows.  While the VIGILANTE advisory indicates that multiple
services are affected, it is not completely clear whether each service
has a separate buffer overflow, or if there is a single overflow in a
library used by all services.  If it is the latter, then CD:SF-LOC
suggests combining this item with the others for the FTP and Telnet
services.  However, in the absence of complete information, the
default action is to keep these items split.

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1065
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1065
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: BUGTRAQ:20001010 VIGILANTE-2000014: HP Jetdirect multiple DoS
Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=97119729613778&w=2
Reference: BID:1775
Reference: URL:http://www.securityfocus.com/bid/1775
Reference: XF:hp-jetdirect-ip-implementation
Reference: URL:http://xforce.iss.net/static/5354.php

Vulnerability in IP implementation of HP JetDirect printer card
Firmware x.08.20 and earlier allows remote attackers to cause a denial
of service (printer crash) via a malformed packet.

Analysis
----------------
ED_PRI CAN-2000-1065 3
Vendor Acknowledgement: unknown discloser-claimed
Content Decisions: SF-LOC

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1071
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1071
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: CF
Reference: ATSTAKE:A100900-1
Reference: URL:http://www.atstake.com/research/advisories/2000/a100900-1.txt
Reference: BID:1767
Reference: URL:http://www.securityfocus.com/bid/1767

The GUI installation for iCal 2.1 Patch 2 disables access control for
the X server using an "xhost +" command, which allows remote attackers
to monitor X Windows events and gain privileges.

Analysis
----------------
ED_PRI CAN-2000-1071 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1072
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1072
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: CF
Reference: ATSTAKE:A100900-1
Reference: URL:http://www.atstake.com/research/advisories/2000/a100900-1.txt
Reference: BID:1768
Reference: URL:http://www.securityfocus.com/bid/1768

iCal 2.1 Patch 2 installs many files with world-writeable permissions,
which allows local users to modify the iCal configuration and execute
arbitrary commands by replacing the iplncal.sh program with a Trojan
horse.

Analysis
----------------
ED_PRI CAN-2000-1072 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1073
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1073
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: ATSTAKE:A100900-1
Reference: URL:http://www.atstake.com/research/advisories/2000/a100900-1.txt
Reference: BID:1769
Reference: URL:http://www.securityfocus.com/bid/1769

csstart program in iCal 2.1 Patch 2 searches for the cshttpd program
in the current working directory, which allows local users to gain
root privileges by creating a Trojan Horse cshttpd program in a
directory and calling csstart from that directory.

Analysis
----------------
ED_PRI CAN-2000-1073 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1074
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1074
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: ATSTAKE:A100900-1
Reference: URL:http://www.atstake.com/research/advisories/2000/a100900-1.txt
Reference: BID:1769
Reference: URL:http://www.securityfocus.com/bid/1769

csstart program in iCal 2.1 Patch 2 uses relative pathnames to install
the libsocket and libnsl libraries, which could allow the icsuser
account to gain root privileges by creating a Trojan Horse library in
the current or parent directory.

Analysis
----------------
ED_PRI CAN-2000-1074 3
Vendor Acknowledgement:

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:

======================================================
Candidate: CAN-2000-1078
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1078
Final-Decision:
Interim-Decision:
Modified:
Proposed: 20001129
Assigned: 20001129
Category: SF
Reference: BUGTRAQ:20001007 ICQ WebFront HTTPd DoS
Reference: URL:http://www.securityfocus.com/archive/1/138332
Reference: XF:icq-webfront-url-dos
Reference: URL:http://xforce.iss.net/static/5332.php

ICQ Web Front HTTPd allows remote attackers to cause a denial of
service by requesting a URL that contains a "?" character.

Analysis
----------------
ED_PRI CAN-2000-1078 3
Vendor Acknowledgement:
Content Decisions: EX-CLIENT-DOS

INCLUSION:

While this could be viewed as a client-side DoS, there are 2 reasons
why CD:EX-CLIENT-DOS does *not* apply here: (a) the attacker can cause
the DoS without forcing the client to trigger it; and (b) the
vulnerable component is, effectively, a web server.

Voting Section
--------------
Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT
If ACCEPT or MODIFY, include reason for acceptance:
  VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST,
  HAS-INDEPENDENT-CONFIRMATION, or provide other reason.

VOTE:
ACCEPT_REASON:

COMMENTS:
Page Last Updated or Reviewed: May 22, 2007