[VOTEPRI] 17 7/5/2000高优先级的候选人

以下候选人供应商确认,需要一个投票被接受。——史蒂夫总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。3)请注意,“修改”被视为一个“接受”当计算选票。所以如果你没有足够的信息对候选人但你不想等待,使用一个回顾。* * * * * * * * * *注意* * * * * * * * * *注意* * * * * * * * * *注意* * * * * * * * * *注意* * * * * * * * * *请记住,你的投票和评论将被记录和公开的邮件列表档案或其他格式。关键的行动- - - - - - - - - - - - - - - - - - - - - - - -推断行为获取候选人的投票状态。他们可能会使用的编辑器来确定候选人是否被添加到CVE。 Where there is disagreement, the Editor must resolve the issue and achieve consensus, or make the final decision if consensus cannot be reached. - ACCEPT = 3 non-MITRE votes to ACCEPT/MODIFY, and no REVIEWING or REJECT - ACCEPT_ACK = 2 non-MITRE ACCEPT/MODIFY, and vendor acknowledgement - MOREVOTES = needs more votes - ACCEPT_REV = 3 non-MITRE ACCEPT's but is delayed due to a REVIEWING - SMC_REJECT = REJECT by Steve Christey; likely to be rejected outright - SMC_REVIEW = REVIEWING by Steve Christey; likely related to CD's - REVIEWING = at least one member is REVIEWING - REJECT = at least one member REJECTed - REVOTE = members should review their vote on this candidate ================================= Candidate: CAN-1999-0247 Published: Final-Decision: Interim-Decision: Modified: 19991130-01 Proposed: 19990728 Assigned: 19990607 Category: SF Reference: NAI:17 Buffer overflow in nnrpd program in INN up to version 1.6 allows remote users to execute arbitrary commands. Modifications: ADDREF NAI:17 add version number INFERRED ACTION: CAN-1999-0247 MOREVOTES-1 (1 accept, 1 ack, 0 review) Current Votes: ACCEPT(1) Stracener NOOP(1) Northcutt VOTE: ================================= Candidate: CAN-1999-0298 Published: Final-Decision: Interim-Decision: Modified: 20000524-01 Proposed: 19990714 Assigned: 19990607 Category: SF Reference: NAI:19970205 Vulnerabilities in Ypbind when run with -ypset/-ypsetme Reference: URL:http://www.nai.com/nai_labs/asp_set/advisory/06_ypbindsetme_adv.aspypbind -ypset和-ypsetme选项激活Slackware Linux和SunOS允许本地和远程攻击者覆盖文件通过一个. .(点点)攻击。修改:CHANGEREF奈:NAI-6添加细节描述。推断行动:- 1999 - 0298 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Northcutt等待(1)Shostack回顾(1)弗雷希投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0045:最终决定:阶段性裁决:修改:建议:20000125分配:20000122类别:科幻参考:BUGTRAQ: 20000111严重bug在MySQL中密码处理。参考:BUGTRAQ: 20000113新MySQL可用参考:报价:926参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=926MySQL允许本地用户修改密码为任意的MySQL用户通过授予特权。推断行动:- 2000 - 0045 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0063:最终决定:阶段性裁决:修改:建议:20000125分配:20000122类别:科幻参考:BUGTRAQ: 20000118北电Contivity脆弱性参考:报价:938参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=938cgiproc CGI脚本在北电Contivity HTTP服务器允许远程攻击者读取任意文件指定文件名参数的脚本。推断行动:- 2000 - 0063 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0064:最终决定:阶段性裁决:修改:建议:20000125分配:20000122类别:科幻参考:BUGTRAQ: 20000118北电Contivity脆弱性参考:报价:938参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=938cgiproc CGI脚本在北电Contivity HTTP服务器允许远程攻击者通过畸形引起拒绝服务URL,包括shell元字符。推断行动:- 2000 - 0064 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0076:最终决定:阶段性裁决:修改:建议:20000125分配:20000122类别:科幻参考:BUGTRAQ: 19991230 vibackup。sh参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94709988232618&w=2参考:DEBIAN: 20000109 nvi:不正确的引导脚本参考文件删除:网址:http://www.debian.org/security/2000/20000108nviboot引导脚本在Debian nvi包允许本地用户删除文件通过在vi.recover畸形的条目。推断行动:- 2000 - 0076 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener等待(3)征税,墙,科尔投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0094:最终决定:阶段性裁决:修改:建议:20000208分配:20000202类别:科幻参考:BUGTRAQ: 20000121 * BSD procfs脆弱性参考:FREEBSD: FreeBSD-SA-00:02参考:报价:940参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=940procfs在BSD系统允许本地用户获得根权限通过修改/proc/pid/mem接口通过修改文件描述符stderr。推断行动:- 2000 - 0094 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:弗伦奇等待修改(1)(2)墙,Christey回顾(1)科尔评论:Christey >报价:987和NETBSD: 2000 - 001指NETBSD procfs mem的问题,可能是相同的问题。弗雷希> XF: netbsd-procfs Christey >报价:987已经被删除,所以我猜他们同意;-)投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0117:最终决定:阶段性裁决:修改:建议:20000208分配:20000208类别:科幻参考:BUGTRAQ: 20000127 RaQ2钴-用户我的改变了我的管理员密码. .参考:BUGTRAQ: 20000131(钴)安全顾问——01.31.2000 siteUserMod。cgi程序在钴RaQ2服务器允许任何站点管理员修改密码对于其他用户来说,网站的管理员,可能管理(根)。推断行动:- 2000 - 0117 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:弗伦奇等待修改(1)(1)墙回顾(1)科尔评论:弗雷希> XF: http-cgi-cobalt-passwords投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0120:最终决定:阶段性裁决:修改:建议:20000208分配:20000208类别:科幻参考:阿莱尔:ASB00-04参考:报价:955参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=955远程访问服务调用。阿莱尔光谱1.0 cfm模板允许用户通过bAuthenticated绕过身份验证参数。推断行动:- 2000 - 0120 MOREVOTES-1(1接受,1 ack, 2检查)目前投票:弗伦奇审查修改(1)(2)墙,科尔评论:弗雷希> XF: allaire-spectra-ras-access投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0264:最终决定:阶段性裁决:修改:建议:20000426分配:20000426类别:科幻/ CF / MP / SA / /未知参考:BUGTRAQ: 20000417 bug的熊猫安全3.0参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=38FB45F2.550EA000@teleline.es参考:报价:1119参考:网址:http://www.securityfocus.com/bid/1119熊猫安全3.0禁用注册表编辑允许用户通过直接编辑注册表并获得特权执行.reg文件或使用其他方法。推断行动:- 2000 - 0264 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener等待(3)墙,科尔,Christey评论:Christey >确认:http://updates.pandasoftware.com/docs/us/Avoidvulnerability.zip投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0265:最终决定:阶段性裁决:修改:建议:20000426分配:20000426类别:科幻参考:BUGTRAQ: 20000417 bug的熊猫安全3.0参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=38FB45F2.550EA000@teleline.es参考:报价:1119参考:网址:http://www.securityfocus.com/bid/1119熊猫熊猫安全3.0允许用户卸载软件通过添加/删除程序applet。推断行动:- 2000 - 0265 MOREVOTES-1(1接受,1 ack, 0评论)目前投票:接受(1)Stracener等待(3)墙,科尔,Christey评论:Christey >确认:http://updates.pandasoftware.com/docs/us/Avoidvulnerability.zip投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0353:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:MISC:http://www.securiteam.com/unixfocus/HHP-Pine_remote_exploit.html参考:SUSE: 19990628松4中执行的命令。x参考:网址:http://www.suse.de/de/support/security/suse_security_announce_6.txt参考:SUSE: 19990911更新松(固定IMAP支持)参考资料:网址:http://www.suse.de/de/support/security/pine_update_announcement.txt松4。x允许远程攻击者通过索引执行任意命令。html文件执行猞猁和获得一个uudecoded文件从一个恶意的web服务器,然后执行的松树。推断行动:- 2000 - 0353 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener等待(1)Christey回顾(1)法国人评论:Christey > ADDREF报价:1247票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0359:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:BUGTRAQ: 19991113 thttpd 2.04堆栈溢出(VD # 6)参考:网址:http://archives.neohapsis.com/archives/bugtraq/1626.html参考:SUSE: 19991116安全漏洞thttpd 1.90 - 2.04参考:网址:http://www.suse.de/de/support/security/suse_security_announce_30.txt缓冲区溢出在琐碎的HTTP (THTTPd)允许远程攻击者造成拒绝服务或执行任意命令通过一个if - modified - since头。推断行动:- 2000 - 0359 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener等待(1)Christey回顾(1)法国人评论:Christey > ADDREF报价:1248年弗雷希>(不是thttpd-file-read)投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0366:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:DEBIAN: 19991202问题恢复符号链接参考:网址:http://www.debian.org/security/1999/19991202倾倒在Debian Linux 2.1不正确恢复符号链接,它允许本地用户修改任意文件的所有权。推断行动:- 2000 - 0366 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener回顾(1)弗雷希投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0369:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:火山口:综援- 1999 - 029.1参考:网址:ftp://ftp.calderasystems.com/pub/openlinux/security/cssa - 1999 029.1.txt在火山口识别服务器的Linux 2.3为每个识别请求创建多个线程,它允许远程攻击者造成拒绝服务。推断行动:- 2000 - 0369 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener等待(1)Christey回顾(1)法国人评论:Christey > ADDREF报价:1266 Christey > ADDREF报价:1266票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0370:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:火山口:综援- 1999 - 001.0参考:网址:ftp://ftp.calderasystems.com/pub/openlinux/security/cssa - 1999 001.0.txtdebug选项在火山口Linux简讯邮件允许远程攻击者通过shell元字符执行命令的- d选项rmail命令。推断行动:- 2000 - 0370 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener等待(1)Christey回顾(1)法国人评论:Christey > ADDREF报价:1268 Christey > ADDREF报价:1268网址:http://www.securityfocus.com/bid/1268投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0374:最终决定:阶段性裁决:修改:建议:20000524分配:20000523类别:科幻参考:火山口:综援- 1999 - 021.0参考:网址:ftp://ftp.calderasystems.com/pub/openlinux/security/cssa - 1999 021.0.txt股在火山口的默认配置Linux允许从任何主机XDMCP连接,允许远程攻击者获取敏感信息或绕过额外的访问限制。推断行动:- 2000 - 0374 MOREVOTES-1(1接受,1 ack, 1审查)目前投票:接受(1)Stracener回顾(1)法国人评论:弗雷希>(不是xdm-xdmcp-remote-bo)投票: