(提案)集群RECENT-28 - 18的候选人

下面的集群包含18个候选人宣布7/7/2000和7/12/2000之间。中列出的候选人优先秩序。优先级1和优先级2的候选人都应对不同层次的供应商确认,所以他们应该易于检查和可以信任的,是真实的问题。如果你发现任何RECENT-XX集群是不完整的对过程中发现的问题相关的时间框架,请发送信息给我,这样候选人可以被指定。——史蒂夫总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。3)请注意,“修改”被视为一个“接受”当计算选票。所以如果你没有足够的信息对候选人但你不想等待,使用一个回顾。 ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ================================= Candidate: CAN-2000-0637 Published: Final-Decision: Interim-Decision: Modified: Proposed: 20000803 Assigned: 20000802 Category: SF Reference: BUGTRAQ:20000711 Excel 2000 vulnerability - executing programs Reference: URL:http://www.securityfocus.com/templates/archive.pike?list=1&msg=396B3F8F.9244D290@nat.bg参考:女士:ms00 - 051参考:网址:http://www.microsoft.com/technet/security/bulletin/ms00 - 051. - asp参考:报价:1451参考:网址:http://www.securityfocus.com/bid/1451Microsoft Excel 97和2000年允许攻击者执行任意命令通过指定一个恶意使用寄存器. dll。标识功能,又名“Excel登记。ID功能”的弱点。ED_PRI - 2000 - 0637 1投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0654:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:女士:ms00 - 041参考:网址:http://www.microsoft.com/technet/security/bulletin/ms00 - 041. - asp参考:报价:1466参考:网址:http://www.securityfocus.com/bid/1466微软企业管理器允许本地用户获取数据库密码通过数据转换服务(DTS)包注册服务器对话框对话框,又名“DTS密码”的一种变体的弱点。ED_PRI - 2000 - 0654 1投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0670:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000712 cvsweb:远程shell cvs提交者参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0178.html参考:BUGTRAQ: 20000714 MDKSA-2000:019 cvsweb更新参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0196.html参考:DEBIAN: 20000716参考:网址:http://www.debian.org/security/2000/20000719b参考:报价:1469参考:网址:http://www.securityfocus.com/bid/1469cvsweb 1.80中的cvsweb CGI脚本允许远程攻击者以写模式访问CVS存储库执行任意命令通过shell元字符。ED_PRI - 2000 - 0670 1投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0628:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000710宣布Apache:: ASP v1.95 -安全漏洞固定参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0142.html参考:确认:http://www.nodeworks.com/asp/changes.html参考:报价:1457参考:网址:http://www.securityfocus.com/bid/1457源。asp脚本示例Apache asp模块Apache:: 1.93和更早的asp允许远程攻击者修改文件。ED_PRI - 2000 - 0628 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0635:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000711 Akopia MiniVend管道命令执行漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0150.html参考:报价:1449参考:网址:http://www.securityfocus.com/bid/1449view_page。html示例页面MiniVend购物车程序允许远程攻击者通过shell元字符执行任意命令。ED_PRI - 2000 - 0635 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0638:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000711老大哥利用参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0146.html参考:BUGTRAQ: 20000711远程利用在所有当前版本的老大哥参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0147.html参考:确认:http://bb4.com/README.CHANGES参考:报价:1455参考:网址:http://www.securityfocus.com/bid/1455哥哥早1.4 h1和允许远程攻击者读取任意文件通过一个. .(点点)攻击。ED_PRI - 2000 - 0638 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0639:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:CF参考:BUGTRAQ: 20000711老大哥文件名扩展脆弱性参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0171.html参考:报价:1494参考:网址:http://www.securityfocus.com/bid/1494老大哥的默认配置不包括早1.4 h2和适当的访问限制,允许远程攻击者通过使用bdd执行任意命令上传文件的扩展将导致它作为一个CGI脚本执行的web服务器。ED_PRI - 2000 - 0639 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0650:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:CF参考:NTBUGTRAQ: 20000711潜在脆弱性McAfee Netshield和麦咖啡4.5参考:网址:http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0007&L=ntbugtraq&F=&S=&P=2753参考:报价:1458参考:网址:http://www.securityfocus.com/bid/1458麦咖啡4.5和NetShield 4.5的默认安装不安全的注册表键标识AutoUpgrade目录的权限,允许本地用户执行任意命令代替设置。EXE该目录中的特洛伊木马。ED_PRI - 2000 - 0650 2投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0629:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:CF参考:BUGTRAQ: 20000711 Sun的Java Web服务器远程命令执行漏洞参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0163.html参考:MISC:http://www.sun.com/software/jwebserver/faq/jwsca - 2000 - 02. - html参考:报价:1459参考:网址:http://www.securityfocus.com/bid/1459太阳的默认配置Java web server 2.0和更早的允许远程攻击者执行任意命令通过董事会通过将Java代码上传到服务器。html,然后直接调用servlet的JSP编译器。ED_PRI - 2000 - 0629 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0640:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000708 gnu-pop3d (FTGate问题),莎凡特网络服务器,公会FTPd参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0114.html参考:报价:1452参考:网址:http://www.securityfocus.com/bid/1452公会FTPd允许远程攻击者决定文件的存在之外的FTP根通过. .(点点)攻击,它提供了不同的错误消息取决于该文件是否存在。ED_PRI - 2000 - 0640 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0641:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000708 gnu-pop3d (FTGate问题),莎凡特网络服务器,公会FTPd参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0114.html参考:报价:1453参考:网址:http://www.securityfocus.com/bid/1453莎凡特web服务器允许远程攻击者执行任意命令通过一个GET请求。ED_PRI - 2000 - 0641 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0642:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:CF参考:BUGTRAQ: 20000711的DoS WEBactive win65 / NT服务器参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=200007130827.BAA32671@Rage.Resentment.org参考:报价:1497参考:网址:http://www.securityfocus.com/bid/1497WebActive HTTP服务器的默认配置1.00存储web访问日志活动。登录文档根,它允许远程攻击者通过直接请求页面查看日志。ED_PRI - 2000 - 0642 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0648:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000711 WFTPD / WFTPD Pro 2.41 RC10拒绝服务引用:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=e13bvu6 - 0007 d8 - 00 @dwarf.box.sk参考:报价:1456参考:网址:http://www.securityfocus.com/bid/1456WFTPD和WFTPD Pro 2.41允许本地用户导致拒绝服务通过执行重命名(RNTO)命令之前(RNFR)命令重命名。ED_PRI - 2000 - 0648 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0651:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000707 Novell边境经理——任何人都可以冒充一个身份验证的用户参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=06256915.00591E18.00@uprrsmtp2.notes.up.com参考:报价:1440参考:网址:http://www.securityfocus.com/bid/1440在Novell BorderManager ClientTrust项目不正确验证身份验证请求的起源,这可能允许远程攻击者冒充重演另一个用户的身份验证请求和响应端口3024的受害者的机器。ED_PRI - 2000 - 0651 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0660:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000712 Infosec.20000712.worldclient.2.1参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0173.html参考:报价:1462参考:网址:http://www.securityfocus.com/bid/1462WDaemon web服务器WorldClient 2.1允许远程攻击者读取任意文件通过一个. .(点点)攻击。ED_PRI - 2000 - 0660 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0661:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000710远程DoS攻击WircSrv Irc服务器v5.07s脆弱性参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0120.html参考:报价:1448参考:网址:http://www.securityfocus.com/bid/1448WircSrv IRC服务器5.07年代允许远程攻击者造成拒绝服务通过一个长字符串到服务器的端口。ED_PRI - 2000 - 0661 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0669:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000711远程拒绝服务——网络5.0 SP 5参考:网址:http://www.securityfocus.com/templates/archive.pike?list=1&msg=000501bfeab5 c3d0 9330美元d801a8c0@dimuthu.baysidegrp.com.au参考:报价:1467参考:网址:http://www.securityfocus.com/bid/1467网络操作系统5.0允许远程攻击者因洪水导致拒绝服务与随机数据端口40193。ED_PRI - 2000 - 0669 3投票:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:可以发表- 2000 - 0674:最终决定:阶段性裁决:修改:建议:20000803分配:20000802类别:科幻参考:BUGTRAQ: 20000712 ftp。pl脆弱性参考:网址:http://archives.neohapsis.com/archives/bugtraq/2000-07/0177.html参考:报价:1471参考:网址:http://www.securityfocus.com/bid/1471ftp。pl CGI程序虚拟幻想FTP浏览器允许远程攻击者读取目录以外的文档根通过. .(点点)攻击。ED_PRI - 2000 - 0674 3投票: