1

<hr>Name: CVE-1999-0052

Description: 
IP fragmentation denial of service in FreeBSD allows a remote attacker
to cause a crash.
Status: Entry 
Reference: FREEBSD:FreeBSD-SA-98:08
 Reference: OSVDB:908
 Reference: URL:http://www.osvdb.org/908
 Reference: XF:freebsd-ip-frag-dos(1389)
 Reference: URL:http://xforce.iss.net/xforce/xfdb/1389

TCP RST denial of service in FreeBSD.
Reference: FREEBSD:FreeBSD-SA-98:07

Sun's ftpd daemon can be subjected to a denial of service.
Reference: SUN:00171
 Reference: URL:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=co
ll&doc=secbull/171
 Reference: XF:sun-ftpd

Buffer overflows in Sun libnsl allow root access.
ll&doc=secbull/172
 Reference: AIXAPAR:IX80543
 Reference: URL:http://www-1.ibm.com/support/search.wss?rs=0&q=IX8
0543&apar=only
 Reference: RSI:RSI.0005.05-14-98.SUN.LIBNSL
 Reference: XF:sun-libnsl

Buffer overflow in Sun's ping program can give root access to local users.
ll&doc=secbull/174
 Reference: XF:sun-ping

Vacation program allows command execution by remote users through
a sendmail command.
Reference: NAI:NAI-19
 Reference: XF:vacation
 Reference: HP:HPSBUX9811-087
 Reference: URL:http://www1.itrc.hp.com/service/cki/docDisplay.do?docI
d=HPSBUX9811-087

Buffer overflow in PHP cgi program, php.cgi allows shell access.
 Reference: BID:712
 Reference: URL:http://www.securityfocus.com/bid/712
 Reference: XF:http-cgi-phpbo

IRIX fam service allows an attacker to obtain a list of all files
on the server.
 Reference: XF:irix-fam(325)
 Reference: URL:http://xforce.iss.net/xforce/xfdb/325

Attackers can cause a denial of service in Ascend MAX and Pipeline
routers with a malformed packet to the discard port, which is used by
the Java Configurator tool.
 Reference: XF:ascend-config-kill
 Reference: ASCEND:http://www.ascend.com/2695.html


Description: File creation and deletion, and remote execution, in the
BSD
line printer daemon (lpd).

Status: Candidate 
Phase: Proposed (19990630) 
Reference: NAI:NAI-20 
Reference: XF:bsd-lpd 

Votes:
<pre> ACCEPT(3) Frech, Hill, Northcutt
RECAST(1) Baker
REVIEWING(1) Christey
</pre>
Voter Comments: 
<pre> Christey> This should be split into three separate problems based on
the SNI advisory. But there's newer information to further
complicate things.
What do we do about this one? in 1997 or so, SNI did an
advisory on this problem. In early 2000, it was still
discovered to be present in some Linux systems. So an
SF-DISCOVERY content decision might say that this is a
long enough time between the two, so this should be recorded
separately. But they're the same codebase... so if we keep
them in the same entry, how do we make sure that this entry
reflects that some new information has been discovered?
The use of dot notation may help in this regard, to use one
dot for the original problem as discovered in 1997, and
another dot for the resurgence of the problem in 2000.
Baker> We should merge these.
Christey> Perhaps this should be NAI-19 instead of NAI-20?
The original Bugtraq post for the SNI advisory suggests SNI-19:
BUGTRAQ:19971002 SNI-19:BSD lpd vulnerability
URL:SNI-19:BSD lpd vulnerability
Also add:
BUGTRAQ:19971021 SNI-19: BSD lpd vulnerabilities (UPDATE)
URL:http://marc.theaimsgroup.com/?l=bugtraq&m=87747479514310&w=2
However, archives of "NAI-0020" point to the lpd vuln.
If I recall correctly, some of the NAI advisory numbers got
switched when NAI acquired SNI.
</pre>
The chpass command in OpenBSD allows a local user to gain root access
through file descriptor leakage.
Reference: XF:openbsd-chpass
 Reference: NAI:NAI-28

Cisco IOS 12.0 and other versions can be crashed by malicious UDP
packets to the syslog port.
Reference: AUSCERT:ESB-98.197
 Reference: CISCO:http://www.cisco.com/warp/public/770/iossyslog-pub.s
html
 Reference: XF:cisco-syslog-crash

Buffer overflow in AIX lquerylv program gives root access to local users.
Reference: BUGTRAQ:May28,1997
 Reference: XF:lquerylv-bo

Multiple buffer overflows in how dtmail handles attachments allows a
remote attacker to execute commands.
ll&doc=secbull/181
 Reference: XF:hp-dtmail

AnyForm CGI remote execution.
Reference: BUGTRAQ:19950731 SECURITY HOLE: "AnyForm" CGI
 Reference: XF:http-cgi-anyform

phf CGI program allows remote command execution through shell
metacharacters.
Reference: BUGTRAQ:19960923 PHF Attacks - Fun and games for the whole fam
ily
 Reference: CERT:CA-1996-06
 Reference: URL:http://www.cert.org/advisories/CA-1996-06.html
 Reference: AUSCERT:AA-96.01
 Reference: XF:http-cgi-phf

1

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

1

Загружено:

Авторское право:

Доступные форматы

<p>

<hr><font size=+2><b>Name: CVE-1999-0052</b></font><p>

Вам также может понравиться