(提案)集群RECENT-18 - 14的候选人

下面的集群包含14个候选人宣布4月27日至5月17日,2000年。注意,这个集群不包括所有这些日期之间的新问题;这些将被添加在未来的发布。中列出的候选人优先秩序。优先级1和优先级2的候选人都应对不同层次的供应商确认,所以他们应该易于检查和可以信任的,是真实的问题。如果你发现任何RECENT-XX集群是不完整的对过程中发现的问题相关的时间框架,请发送信息给我,这样候选人可以被指定。——史蒂夫总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。 3) Note that a "MODIFY" is treated as an "ACCEPT" when counting votes. So if you don't have sufficient information for a candidate but you don't want to NOOP, use a REVIEWING. ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ================================= Candidate: CAN-2000-0303 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000518 Assigned: 20000503 Category: SF Reference: ISS:20000503 Vulnerability in Quake3Arena Auto-Download Feature Reference: URL:http://xforce.iss.net/alerts/advise50.php3参考:确认:http://www.quake3arena.com/万博下载包news/index.htmlQuake3领域允许恶意服务器运营商读取或修改文件在客户端通过点点(. .)攻击。ED_PRI - 2000 - 0303 1投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0304:最终决定:阶段性裁决:修改:建议:20000518分配:20000508类别:科幻参考:国际空间站:20000511 Microsoft IIS远程拒绝服务攻击参考:网址:http://xforce.iss.net/alerts/advise52.php3参考:女士:ms00 - 031参考:网址:http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20905Microsoft IIS 4.0和5.0 IISADMPWD虚拟目录安装允许远程攻击者通过畸形导致拒绝servoce inetinfo请求。exe程序ED_PRI可以- 2000 - 0304 1投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0342:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:MISC:http://www.peacefire.org/security/stealthattach/explanation.html参考:确认:http://万博下载包news.cnet.com/news/0 - 1005 - 200 - 1773077. - html?tag=st.ne.fd.lthd.1005 - 200 - 1773077参考:报价:1157参考:网址:http://www.securityfocus.com/bid/1157尤朵拉4。x允许远程攻击者绕过用户警告可执行附件指的是通过使用.lnk文件附件。ED_PRI - 2000 - 0342 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0346:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502信息:AppleShare IP再南瓜安全缺陷参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000502133240.21807.qmail@securityfocus.com参考:确认:http://asu.info.apple.com/swupdates.nsf/artnum/n11670参考:报价:1162参考:网址:http://www.securityfocus.com/bid/1162AppleShare IP 6.1和以后可能允许远程攻击者读取敏感信息通过一个无效的请求到web服务器ED_PRI - 2000 - 0346 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0350:最终决定:阶段性裁决:修改:建议:20000518分配:20000516类别:科幻参考:MISC:http://www.securityfocus.com/templates/advisory.html?id=2220参考:确认:http://advice.networkice.com/advice/Support/KB/q000166/调试功能NetworkICE冰盖2.0.23启用了早些时候,它允许远程攻击者绕过弱者身份验证和加密后的事件。ED_PRI - 2000 - 0350 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0332:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502玩UltraBoard V1.6X参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000503091316.99073.qmail@hotmail.com参考:报价:1164参考:网址:http://www.securityfocus.com/bid/1164UltraBoard。pl或UltraBoard。cgi cgi脚本UltraBoard 1.6允许远程攻击者读取任意文件通过一个路径名字符串包含一个点点(. .)和结尾空字节。ED_PRI - 2000 - 0332 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0333:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502拒绝服务攻击tcpdump参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=pine.sol.4.10.10005021942380.2077 - 100000 @paranoia.pgci.ca参考:报价:1165参考:网址:http://www.securityfocus.com/bid/1165tcpdump、轻盈和其他嗅探包允许远程攻击者通过畸形引起拒绝服务的DNS数据包跳抵消指本身,导致tcpdump进入一个无限循环而压缩包。ED_PRI - 2000 - 0333 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0335:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502 glibc解析器弱点参考:报价:1166参考:网址:http://www.securityfocus.com/bid/1166glibc 2.1.3中的解析器使用可预测的id,它允许本地攻击者恶搞DNS查询结果。ED_PRI - 2000 - 0335 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0340:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000428 SuSE 6.3 Gnomelib缓冲区溢位参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=00042902575201.09597@wintermute-pub参考:报价:1155参考:网址:http://www.securityfocus.com/bid/1155缓冲区溢出在Gnomelib SuSE Linux 6.3允许本地用户执行任意命令通过显示环境变量。ED_PRI - 2000 - 0340 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0341:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:NTBUGTRAQ: 20000501远程DoS攻击在卡桑德拉NNTPServer v1.10从心房参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=95736106504870&w=2参考:报价:1156参考:网址:http://www.securityfocus.com/bid/1156心房卡桑德拉NNTP服务器1.10允许远程攻击者通过长导致拒绝服务登录名。ED_PRI - 2000 - 0341 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0343:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502 spj - 003 - 000 - S0ftPj咨询参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=200005021736.TAA01991@ALuSSi参考:报价:1158参考:网址:http://www.securityfocus.com/bid/1158缓冲区溢位Sniffit 0.3。x - l日志记录选项启用允许远程攻击者执行任意命令通过一个长的邮件的邮件头。ED_PRI - 2000 - 0343 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0344:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000501 Linux knfsd DoS问题参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=pine.lnx.4.21.0005012042550.6419 - 100000 @ferret.lmh.ox.ac.uk参考:报价:1160参考:网址:http://www.securityfocus.com/bid/1160在Linux内核2.2 knfsd NFS服务器。x允许远程攻击者造成拒绝服务通过一个负面的价值大小。ED_PRI - 2000 - 0344 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0345:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:BUGTRAQ: 20000502可能的问题与思科在线帮助吗?参考网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=20000502222246.28423.qmail@securityfocus.com参考:报价:1161参考:网址:http://www.securityfocus.com/bid/1161在线帮助系统选项在Cisco路由器允许非特权用户“启用”访问获取敏感信息通过显示命令。ED_PRI - 2000 - 0345 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0347:最终决定:阶段性裁决:修改:建议:20000518分配:20000511类别:科幻参考:NTBUGTRAQ: 20000501 el8.org咨询——赢得95/98 DoS (RFParalyze.c)参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=95737580922397&w=2参考:报价:1163参考:网址:http://www.securityfocus.com/bid/1163Windows 95, Windows 98允许远程攻击者通过NETBIOS引起拒绝服务会话请求包和一个零源名称。ED_PRI - 2000 - 0347 3投票: