(提案)集群遗产- misc - 1999 - c - 77的候选人

我提出集群遗产- misc - 1999 c,供编辑部评论和投票。名称:遗产- misc - 1999 c描述:遗产候选人宣布9/1/1999与12/31/1999大小:77年通过修改这封邮件你可能投票的候选人投票,将它寄回给我,或通过使用CVE投票网站。中列出的候选人优先秩序。优先级1和优先级2的候选人都应对不同层次的供应商确认,所以他们应该易于检查和可以信任的,是真实的问题。总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出的等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。3)请注意,“修改”被视为一个“接受”当计算选票。所以如果你没有足够的信息对候选人但你不想等待,使用一个回顾。 ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ====================================================== Candidate: CAN-1999-1047 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1047最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991018挑战5.0 BSDI警告参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94026690521279&w=2参考:BUGTRAQ: 19991019 Re:挑战5.0 BSDI警告参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94036662326185&w=2参考:XF: gauntlet-bsdi-bypass当挑战5.0 BSDI BSDI补丁安装在一个特定的顺序,挑战允许远程攻击者绕过防火墙访问限制,和没有日志活动。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1047 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1109网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1109最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991222 Re: procmail / Sendmail -五个错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94632241202626&w=2参考:BUGTRAQ: 20000113 Re: procmail / Sendmail -五个错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94780566911948&w=2参考:报价:904参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=904Sendmail 8.10.0之前允许远程攻击者造成拒绝服务通过发送一系列ETRN命令然后从服务器断开,而Sendmail继续处理命令连接后终止。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1109 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1111网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1111最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19911109 ImmuniX操作系统安全警报:StackGuard 1.21发布参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94218618329838&w=2参考:报价:786参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=786参考:XF: immunix-stackguard-bo(3524)参考:网址:http://xforce.iss.net/static/3524.php脆弱性在StackGuard 1.21允许远程攻击者绕过随机和终结者金丝雀安全机制通过使用非线性攻击直接修改指针返回地址,而不是使用缓冲区溢出到返回地址条目本身。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1111 2供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1341网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1341最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991022本地用户可以发送伪造数据包参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94061108411308&w=2Linux内核2.3.18或2.2.13pre15之前,滑动和购买力平价选项,允许当地无特权的用户建立IP数据包通过TIOCSETD tty设备上选择。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1341 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1351网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1351最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990924 Kvirc错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93845560631314&w=2目录遍历脆弱性KVIrc IRC客户端0.9.0“听!尼克< soundname >请求”选项启用允许远程攻击者读取任意文件通过一个. .(点点)DCC GET请求。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1351 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1356网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1356最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990902康柏CIM UG覆盖法律注意参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93646669500991&w=2参考:NTBUGTRAQ: 19990902康柏CIM UG覆盖法律注意参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=93637792706047&w=2参考:NTBUGTRAQ: 19990917 Re:康柏CIM UG覆盖法律注意参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=93759822830815&w=2康柏集成维护实用工具用于康柏洞察力经理代理之前SmartStart 4.50修改法定注意标题(LegalNoticeCaption)和文本(LegalNoticeText)在Windows NT,这可能产生一个法律发现违反安全策略。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1356 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1530网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1530最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991108安全缺陷在钴RaQ2 cgiwrap参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94209954200450&w=2参考:BUGTRAQ: 19991109(钴)安全顾问——cgiwrap参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94225629200045&w=2参考:报价:777参考:网址:http://www.securityfocus.com/bid/777cgiwrap 2.0用于钴RaQ RaQ 3我不正确识别用户运行特定的脚本,恶意站点管理员可以查看或修改数据位于另一个虚拟站点在同一个系统上。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1530 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1531网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1531最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991102一些漏洞赢/ UNIX软件参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94157187815629&w=2参考:报价:763参考:网址:http://www.securityfocus.com/bid/763缓冲区溢出在IBM HomePagePrint 1.0.7 Windows98J允许恶意网站查看器的系统上执行任意代码通过一个长IMG_SRC HTML标签。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1531 2供应商确认:是的补丁投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1542网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1542最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991004 RH6.0本地/远程命令执行参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93915641729415&w=2前轮驱动:参考:BUGTRAQ: 19991006 (Re: RH6.0本地/远程命令执行)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93923853105687&w=2参考:XF: linux-rh-rpmmail(3353)参考:网址:http://xforce.iss.net/static/3353.phpRPMMail 1.4允许远程攻击者执行命令之前通过电子邮件和在“邮件”命令shell元字符。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1542 2供应商确认:是的远程投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1548网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1548最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BINDVIEW: 19991124 Cabletron SmartSwitch路由器8000 v2固件。x参考:网址:http://razor.bindview.com/publish/advisories/adv_Cabletron.html参考:报价:821参考:网址:http://www.securityfocus.com/bid/841Cabletron SmartSwitch路由器(SSR) 8000固件2。x只能处理200每秒ARP请求允许拒绝服务攻击成功与大量的ARP请求超过限制。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1548 2供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1550网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1550最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991108 BigIP——bigconf。cgi漏洞参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94217006208374&w=2参考:BUGTRAQ: 19991109 Re: BigIP——bigconf。cgi漏洞参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94217879020184&w=2参考:BUGTRAQ: 19991109参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94225879703021&w=2参考:报价:778参考:网址:http://www.securityfocus.com/bid/778bigconf。配置在F5大/ ip 2.1.2和允许远程攻击者读取任意文件早些时候通过指定的目标文件“文件”参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1550 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2001 - 0679网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2001 - 0679最终决定:阶段性裁决:修改:建议:20010912分配:20010829类别:科幻参考:NTBUGTRAQ: 19991108内扫描VirusWall NT 3.23/3.3缓冲区溢出。参考网址:http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind9911&L=NTBUGTRAQ&P=R2331参考:NTBUGTRAQ: 19991109内扫描VirusWall 3.23/3.3缓冲区溢位参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94216491202063&w=2参考:BUGTRAQ: 19991108 VirusWall 3.23补丁。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94204166130782&w=2参考:NTBUGTRAQ: 19991108 VirusWall 3.23补丁。参考网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94208143007829&w=2参考:XF: viruswall-helo-bo(3465)参考:网址:http://xforce.iss.net/static/3465.php缓冲区溢出在中间扫描VirusWall 3.23和3.3允许远程攻击者通过发送一个长直升机命令执行任意代码到服务器。分析- - - - - - - - - - - - - - - - - ED_PRI - 2001 - 0679 2供应商确认:是的跟踪投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 0926网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 0926最终决定:阶段性裁决:修改:建议:20010912分配:19991208类别:科幻参考:BUGTRAQ: 19990903 Web服务器/可能的DOS攻击/ mime头洪水参考:网址:http://archives.neohapsis.com/archives/bugtraq/1998_3/0742.htmlApache允许远程攻击者进行拒绝服务通过大量的MIME标头。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 0926 3供应商确认:是的内容决定:SF-CODEBASE跟踪表明,人们可以导致服务器慢下来,而不是崩溃。所以,这可能不是一个“真实”的弱点。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1013网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1013最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:报价:673参考:网址:http://www.securityfocus.com/bid/673参考:BUGTRAQ: 19990923 named-xfer洞在AIX (fwd)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93837026726954&w=2named-xfer在AIX 4.1.5和4.2.1允许系统小组的成员准备覆盖系统文件获得root访问通过- f参数和畸形区域文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1013 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1014网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1014最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990913 Solaris 2.7 /usr/bin/mail参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93727925026476&w=2参考:BUGTRAQ: 19990927工作Solaris x86 /usr/bin/mail利用参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93846422810162&w=2参考:XF: sun-usrbinmail-local-bo(3297)参考:网址:http://xforce.iss.net/static/3297.php参考:报价:672参考:网址:http://www.securityfocus.com/bid/672缓冲区溢出在Solaris 2.7和2.7的邮件命令允许本地用户获得特权通过长- m参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1014 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1050网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1050最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991112可以。cgi参考:网址:http://www.securityfocus.com/archive/1/34600参考:BUGTRAQ: 19991116 Re:可以。cgi参考:网址:http://www.securityfocus.com/archive/1/34939参考:报价:798参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=798参考:报价:799参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=799参考:XF: formhandler-cgi-absolute-path(3550)参考:网址:http://xforce.iss.net/static/3550.php目录遍历在马特·莱特可以脆弱。cgi脚本允许远程攻击者读取任意文件通过(1). .(点点)reply_message_attach附件参数,或(2)通过指定文件名作为模板。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1050 3供应商确认:内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1051网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1051最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:CF参考:BUGTRAQ: 19991116 Re:可以。cgi参考:网址:http://www.securityfocus.com/archive/1/34939在马特·莱特可以默认配置。cgi脚本允许任意目录用于附件,只有限制访问/ etc /目录,它允许远程攻击者通过reply_message_attach附件参数读取任意文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1051 3供应商确认:内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1053网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1053最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:VULN-DEV: 19990913留言板perl脚本(长)参考:网址:http://www.securityfocus.com/archive/82/27296参考:VULN-DEV: 19990916 Re:留言板perl脚本(错误修正)参考:网址:http://www.securityfocus.com/archive/82/27560参考:BUGTRAQ: 19991105留言板。Apache pl、草率的SSI处理?(VD # 2)参考:网址:http://www.securityfocus.com/archive/1/33674参考:报价:776参考:网址:http://www.securityfocus.com/bid/776留言板。pl清理用户参与SSI命令通过删除文本之间的“< !——“和”——>“分隔符,允许远程攻击者在留言板时执行任意命令。pl运行在Apache就可能是其他版本,由于Apache允许以外的其他关闭序列“- - >”。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1053 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1058网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1058最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:NTBUGTRAQ: 19991122远程DoS攻击银朱FTP守护进程(VFTPD) v1.23脆弱性参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94337185023159&w=2参考:BUGTRAQ: 19991122偏远DoS攻击银朱FTP守护进程(VFTPD) v1.23脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94329968617085&w=2参考:XF: vermillion-ftp-cwd-overflow(3543)参考:网址:http://xforce.iss.net/static/3543.php参考:报价:818参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=818缓冲区溢出的朱红色的FTP守护进程VFTPD 1.23允许远程攻击者导致拒绝服务,并可能执行任意命令,通过一些长期慢性消耗病的命令。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1058 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1065网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1065最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991104棕榈使用容易DoS攻击同步参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94175465525422&w=2掌上电脑使用管理器同步3.0.4在Windows 98允许远程攻击者引起拒绝服务,并可能执行任意命令,通过一个长字符串端口14238,而经理是在网络模式。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1065 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1066网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1066最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991222地震“蓝精灵”——地震战争跑龙套参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94589559631535&w=2地震1服务器响应一个初始UDP游戏与大量的交通连接请求,它允许远程攻击者使用服务器作为放大器的“蓝精灵”风格攻击另一个主机,通过欺骗连接请求。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1066 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1076网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1076最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991026 Mac OS 9空转锁错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94096348604173&w=2参考:报价:745参考:网址:http://www.securityfocus.com/bid/745闲置锁定功能在MacOS 9允许本地用户绕过闲置会话的密码保护通过选择“退出”选项,选择“取消”选项的对话框应用程序试图验证用户想要注销,攻击者返回到锁定会话。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1076 3供应商确认:是的后续内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1077网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1077最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991101 Re: Mac OS 9空转锁错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94149318124548&w=2参考:报价:756参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=756闲置MacOS 9中锁定功能允许本地攻击者绕过闲置会话的密码保护通过程序员的开关或CMD-PWR键盘序列,这引出了一个调试器,攻击者可以使用禁用锁。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1077 3供应商确认:是的后续内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1082网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1082最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991008 Jana网络服务器利用参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93941794201059&w=2参考:报价:699参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=699目录遍历脆弱性Jana代理web server 1.40允许远程攻击者可以任意文件通过一个“……”(modified dot dot) attack. Analysis ---------------- ED_PRI CAN-1999-1082 3 Vendor Acknowledgement: Content Decisions: SF-LOC Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-1999-1083 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1083最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 20000502安全漏洞Jana HTTP服务器参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=95730430727064&w=2参考:报价:699参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=699目录遍历脆弱性Jana代理web server 1.45允许远程攻击者可以任意文件通过一个. .(点点)攻击。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1083 3供应商确认:内容决定:SF-LOC比……这是一个稍微不同的利用一个为1.40,但版本不同;然而,它可能是同样的错误。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1092网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1092最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:未知参考:BUGTRAQ: 19991117锡的默认权限参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94286179032648&w=2锡1.40创建.tin目录与不安全的权限,它允许本地用户从.inputhistory文件读取密码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1092 3供应商确认:有可能继承用户的umask锡;这不是解决的揭露者。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1110网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1110最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:参考:BUGTRAQ: 19991114 IE 5.0和Windows媒体播放器ActiveX对象允许检查存在的本地文件和目录参考:网址:http://www.securityfocus.com/archive/1/34675参考:报价:793参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=793Windows媒体播放器ActiveX对象用于Internet Explorer 5.0返回一个特定的错误代码文件不存在时,它允许远程恶意网站,以确定文件在客户机上的存在。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1110 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1112网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1112最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991109 iran视图3.07缓冲区溢位参考:网址:http://www.securityfocus.com/archive/1/34066参考:MISC:http://stud4.tuwien.ac.at/ ~ e9227474 / main2.html参考:XF: irfan-view32-bo(3549)参考:网址:http://xforce.iss.net/static/3549.php参考:报价:781参考:网址:http://www.securityfocus.com/bid/781早些时候在IrfanView32 3.07和缓冲区溢出允许攻击者执行任意命令通过一个长字符串“8个基点”的形象后输入一个照相馆图像标题。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1112 3供应商确认:未知在version 3.10中,供应商说,“一些PSD bug是固定的,”和另一个页面显示PSD是照相馆。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1129网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1129最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990901 VLAN安全参考:网址:http://www.securityfocus.com/archive/1/26008参考:MISC:http://www.cisco.com/univercd/cc/td/doc/product/lan/28201900/1928v8x/eescg8x/aleakyv.htm参考:XF: cisco-catalyst-vlan-frames(3294)参考:网址:http://xforce.iss.net/static/3294.php参考:报价:615参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=615Cisco Catalyst 2900个虚拟LAN (VLAN)开关允许远程攻击者向另一个VLAN锻造注入802.1 q帧中继的VLAN标识符标记。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1129 3供应商确认:未知有一些广泛讨论Bugtraq问题是由于是否实现,配置,或802.1 q本身的设计缺陷。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1189网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1189最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991124网景沟通者4.7 -导航器溢出参考:网址:http://www.securityfocus.com/archive/1/36306参考:BUGTRAQ: 19991127网景沟通者4.7 -导航器溢出参考:网址:http://www.securityfocus.com/archive/1/36608参考:报价:822参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=822缓冲区溢出在Netscape Navigator 4.7 /沟通者Windows 95, Windows 98允许远程攻击者导致拒绝服务,并可能执行任意命令,通过论证后多久?字符的URL引用一个asp . cgi, . html”或. pl文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1189 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1190网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1190最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:MISC:http://www.securiteam.com/exploits/E-MailClub__FROM__remote_buffer_overflow.html参考:报价:801参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=801缓冲区溢出的POP3服务器上将系统EmailClub 1.05允许远程攻击者执行任意命令通过一个长”从“头在一封电子邮件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1190 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1226网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1226最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:MISC:http://www.securiteam.com/exploits/Netscape_4_7_and_earlier_vulnerable_to__Huge_Key__DoS.html参考:XF: netscape-huge-key-dos(3436)参考:网址:http://xforce.iss.net/static/3436.phpNetscape 4.7和更早的沟通者允许远程攻击者引起拒绝服务,并可能执行任意命令,通过一个长密钥证书。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1226 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1234网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1234最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991026 Re: LSA脆弱性在NT40 SP5参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94096671308565&w=2参考:XF: msrpc-samr-open-dos(3293)参考:网址:http://xforce.iss.net/static/3293.phpLSA (LSASS.EXE)在Windows NT 4.0允许远程攻击者通过零导致拒绝服务政策处理调用SamrOpenDomain (1), (2) SamrEnumDomainUsers, (3) SamrQueryDomainInfo。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1234 3供应商确认:内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1236网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1236最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:NTBUGTRAQ: 19991001漏洞在互联网邮件服务器的任何地方引用:网址:http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind9910&L=ntbugtraq&F=&S=&P=662参考:报价:731参考:网址:http://www.securityfocus.com/bid/731参考:XF: iams-passwords-plaintext(3285)参考:网址:http://xforce.iss.net/static/3285.php互联网邮件服务器的任何地方2.3.1在明文存储密码对话框。dbf文件,它可以允许本地用户获得特权从msgboxes.dbf提取密码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1236 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1340网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1340最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991104 hylafax-4.0.2当地利用参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94173799532589&w=2参考:报价:765参考:网址:http://www.securityfocus.com/bid/765缓冲区溢出在faxalter hylafax 4.0.2允许本地用户获得特权通过长- m命令行参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1340 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1342网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1342最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:NTBUGTRAQ: 19991017 ICQ ActiveList服务器利用……参考网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94042342010662&w=2ICQ ActiveList服务器允许远程攻击者造成拒绝服务(崩溃)通过畸形数据包,服务器的UDP端口。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1342 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1343网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1343最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991013施乐DocuColor 4 LP交货单参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93986405412867&w=2HTTP服务器施乐DocuColor 4 LP允许远程攻击者造成拒绝服务(挂)通过一个长URL,其中包含大量的。字符。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1343 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1344网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1344最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991005 Auto_FTP v0.02咨询参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93923873006014&w=2Auto_FTP。pl脚本Auto_FTP 0.2在Auto_FTP明文存储用户名和密码。conf配置文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1344 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1345网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1345最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991005 Auto_FTP v0.02咨询参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93923873006014&w=2Auto_FTP。pl脚本Auto_FTP 0.2中使用的共享目录/ tmp / ftp_tmp不安全的权限,它允许本地用户(1)任意文件发送到远程服务器通过将他们的目录,和(2)视图文件被转移。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1345 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1346网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1346最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991007问题redhat 6 Xsession pam.d /远程登录命令。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93942774609925&w=2PAM配置文件在Red Hat Linux 6.1和更早的远程登录命令包括之前限制较少规则更为严格,它允许用户访问主机通过远程登录命令即使远程登录命令已经明确残疾人使用/etc/nologin文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1346 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1347网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1347最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991007问题redhat 6 Xsession pam.d /远程登录命令。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93942774609925&w=2Xsession早些时候在Red Hat Linux 6.1,可以用限制允许本地用户帐户执行.xsession绕过文件通过启动kde, gnome或anotherlevel股。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1347 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1349网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1349最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991006 Omni-NFS / X企业(nfsd.exe) DOS参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93923679004325&w=2NFS守护进程(nfsd.exe) Omni-NFS / X 6.1允许远程攻击者造成拒绝服务(资源枯竭)通过特定的数据包,可能设置了紧急(开始)标志,端口111。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1349 3供应商确认:一个跟踪表明,问题不能重现。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1350网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1350最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:CF参考:BUGTRAQ: 19990929多个供应商参考ARCAD权限问题:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93871933521519&w=2ARCAD Systemhaus 0.078 - 5安装关键项目和对外公开的文件权限,这将允许本地用户权限代替特洛伊木马程序。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1350 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1352网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1352最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990928 Re: [Fwd:真相ssh 1.2.27 vulnerabiltiy]参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93855134409747&w=2mknod在Linux 2.2符号链接,允许本地用户覆盖文件或获得的特权。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1352 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1353网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1353最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990907 MsgCore服务器存储密码以明文参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=93698162708211&w=22.14 Nosque MsgCore明文存储密码:(1)管理员密码AdmPasswd注册表键,和(2)用户密码的用户群。dbf数据文件,允许本地用户获得privielges。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1353 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1357网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1357最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991005时间再次更新这些cgi参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93915331626185&w=2网景沟通者4.04到4.7(可能还有其他版本)在各种UNIX操作系统将0 x8b字符转换为“<”符号,和0 x9b字符“>”符号,这可能允许远程攻击者通过跨站点脚本攻击其他客户(CSS)在CGI程序不过滤这些字符。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1357 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1377网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1377最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:MISC:http://pulhas.org/phrack/55/p55 - 07. - html马特·赖特的下载。cgi 1.0允许远程攻击者读取任意文件通过一个. .(点点)f参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1377 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1454网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1454最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ:“矩阵”屏幕保护程序在Windows 19991004疲软参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93915027622690&w=2Macromedia“黑客帝国”屏幕保护程序在Windows 95的“密码保护”选项启用允许攻击者与物理访问这台机器绕过密码提示按下ESC(逃避)键。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1454 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1469网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1469最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990930 mini-sql缓冲区溢位参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93871926821410&w=2缓冲区溢出在miniSQL w3-auth CGI程序包允许远程攻击者执行任意命令通过一个HTTP请求与(1)一个长URL,或(2)一个长用户代理MIME标头。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1469 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1475网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1475最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991119 ProFTPd——mod_sqlpw。c参考:网址:http://www.securityfocus.com/archive/1/35483参考:报价:812参考:网址:http://www.securityfocus.com/bid/812与mod_sqlpw ProFTPd 1.2编译模块记录用户密码wtmp日志文件,它允许本地用户获取密码和通过阅读wtmp获得特权,例如通过最后一个命令。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1475 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1477网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1477最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990923 Linux GNOME开发参考:网址:http://www.securityfocus.com/archive/1/28717参考:报价:663参考:网址:http://www.securityfocus.com/bid/663参考:XF: gnome-espeaker-local-bo(3349)参考:网址:http://xforce.iss.net/static/3349.php在GNOME库缓冲区溢出1.0.8允许本地用户获得root访问通过长——espeaker论点nethack等项目。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1477 3供应商确认:未知的内容决定:SF-CODEBASE投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1484网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1484最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990924几个ActiveX缓冲区溢出参考:网址:http://www.securityfocus.com/archive/1/28719参考:XF: msn-setup-bbs-activex-bo(3310)参考:网址:http://xforce.iss.net/static/3310.php参考:报价:668参考:网址:http://www.securityfocus.com/vdb/bottom.html?vid=668缓冲区溢出在MSN设置BBS 4.71.0.10 ActiveX控件(setupbbs.ocx)允许远程攻击者通过执行任意命令的方法(1)或(2)bIsNewsServerConfigured vAddNewsServer。万博下载包分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1484 3供应商确认:是的内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1497网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1497最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991221 (w00giving 99 # 11] IMail的密码加密方案参考:网址:http://www.securityfocus.com/archive/1/39329参考:报价:880参考:网址:http://www.securityfocus.com/bid/880Ipswitch IMail 5.0和6.0使用弱加密密码存储在注册表键,它允许本地攻击者读取电子邮件账户的密码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1497 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1500网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1500最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:NTBUGTRAQ: 19991001漏洞在互联网邮件服务器的任何地方引用:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=93880357530599&w=2参考:报价:733参考:网址:http://www.securityfocus.com/bid/733互联网在任何地方POP3邮件服务器2.3.1允许远程攻击者造成拒绝服务(崩溃)通过(1)列表,(2),或(3)UIDL命令使用字母作为参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1500 3供应商确认:未知的内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1508网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1508最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991116 (Fwd:打印机的弱点:美国泰克PhaserLink网络服务器提供管理员密码)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94286041430870&w=2参考:报价:806参考:网址:http://www.securityfocus.com/bid/806840.0和更早的Web服务器在美国泰克PhaserLink打印机允许远程攻击者获得管理员访问通过直接调用ncl_items等非法的url。html和ncl_subjects.html。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1508 3供应商确认:未知(SMC)这个漏洞显然是重新发现(或不固定)和宣传:BUGTRAQ: 20010425美国泰克(施乐)PhaserLink 850网络服务器漏洞(新)http://www.securityfocus.com/archive/1/179875尽管改变的URL。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1509网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1509最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:NTBUGTRAQ: 19991104 Eserv 2.50 Web接口服务器目录遍历脆弱性参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94177470915423&w=2参考:BUGTRAQ: 19991104 Eserv 2.50 Web接口服务器目录遍历脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94183041514522&w=2参考:报价:773参考:网址:http://www.securityfocus.com/bid/773参考:XF: eserv-fileread目录遍历脆弱性Etype Eserv 2.50 web服务器允许远程攻击者读取文件系统中的任何文件通过一个. .在一个URL(点点)。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1509 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1511网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1511最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991110遥控器DoS攻击倍数Artisoft XtraMail v1.11脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94226003804744&w=2参考:报价:791参考:网址:http://www.securityfocus.com/bid/791参考:XF: xtramail-pass-dos(3488)参考:网址:http://xforce.iss.net/static/3488.php缓冲区溢出Xtramail 1.11允许攻击者可能导致拒绝服务(崩溃)和执行任意命令通过(1)长传球命令在POP3服务,(2)一个长直升机命令在SMTP服务,或(3)长控制服务的用户名。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1511 3供应商确认:未知的内容决定:SF-EXEC虽然有多个服务影响不同的命令,他们出现在同一个包,版本,所以CD: SF-EXEC建议结合成一个单一的入口。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1516网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1516最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990902[安全]TenFour TFS SMTP 3.2缓冲区溢位参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93677241318492&w=2缓冲区溢出TenFour TFS网关SMTP邮件服务器3.2允许攻击者邮件服务器崩溃,可能执行任意代码通过提供超过128字节的字符串的邮件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1516 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1517网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1517最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:CF参考:BUGTRAQ: 19991101阿曼达多个供应商本地根妥协参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94148942818975&w=2参考:报价:750参考:网址:http://www.securityfocus.com/bid/750runtar阿曼达备份系统用于各种UNIX操作系统执行焦油使用root特权,它允许用户覆盖或读取任意文件通过提供runtar的目标文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1517 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1519网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1519最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:远程原产BUGTRAQ: 19991117。年代袭击G6 FTP服务器v2.0(β4/5)脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94286244700573&w=2参考:报价:805参考:网址:http://www.securityfocus.com/bid/805参考:XF: g6ftp-username-dos(3513)参考:网址:http://xforce.iss.net/static/3513.phpGene6 G6 FTP服务器2.0允许远程攻击者造成拒绝服务(资源枯竭)通过一个长(1)用户名或密码(2)。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1519 3供应商确认:未知的内容决定:SF-LOC报价:805似乎是唯一一项描述了密码的问题;其他来源的描述用户名。有报道称这个问题为在同一版本和相同类型的问题,CD: SF-LOC表明结合成一个单一的CVE条目。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1521网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1521最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990912许多窗户的POP3 / SMTP服务器软件缓冲区溢出缺陷参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93720402717560&w=2参考:BUGTRAQ: 19990729脆弱性CMail SMTP服务器2.4版:远程可利用的缓冲区引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94121824921783&w=2参考:报价:633参考:网址:http://www.securityfocus.com/bid/633参考:XF: cmail-command-bo(2240)参考:网址:http://xforce.iss.net/static/2240.phpComputalynx CMail 2.4和CMail 2.3 SP2 SMTP服务器很容易受到邮件的缓冲区溢出攻击的命令允许远程攻击者在服务器上执行任意代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1521 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1522网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1522最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991007 Roxen安全警报参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93942579008408&w=2在htmlparse脆弱性。派克在Web服务器Roxen 1.3.11和早些时候,可能与递归解析和推荐人在RXML标签。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1522 3供应商确认:未知,请投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1523网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1523最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991004参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93901161727373&w=2参考:BUGTRAQ: 19991006 Re:样本DOS攻击水鹿http服务器参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93941351229256&w=2参考:XF: sambar-logging-bo(1672)参考:网址:http://xforce.iss.net/static/1672.php缓冲区溢出的水鹿Web服务器4.2.1允许远程攻击者准备导致拒绝服务,并可能执行任意命令,通过一个HTTP GET请求。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1523 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1527网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1527最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991123 NetBeans /福特的Java IDE HTTP脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94338883114254&w=2参考:报价:816参考:网址:http://www.securityfocus.com/bid/816太阳内部的HTTP服务器在Netbeans Java IDE在Netbeans Developer 3.0 Beta和福特Community Edition 1.0测试版不适当限制IP地址作为其配置中指定,允许任意远程攻击者访问服务器。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1527 3供应商确认:未知的内容决定:SF-CODEBASE大参考指出,Netbeans改名为特长,所以两个应用程序可能共享相同的代码库。因此CD: SF-CODEBASE建议把这些结合成一个条目。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1528网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1528最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:未知参考:BUGTRAQ: 19991114 MacOS 9和MacOS网络客户端参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94261444428430&w=2参考:报价:794参考:网址:http://www.securityfocus.com/bid/794ProSoft网络客户端5.12 Macintosh MacOS 9并不会自动记录用户的NDS树当用户注销系统,它允许其他用户的系统访问不受保护的NDS会话。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1528 3供应商确认:未知的抽象:在Bugtraq线程中有一些争论关于是否这是一个错误在这个实现的一般问题之间的交互应用程序的“注销”机制与家长的操作系统。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1529网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1529最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991107内扫描VirusWall NT 3.23/3.3缓冲区溢位参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94201512111092&w=2参考:NTBUGTRAQ: 19991107内扫描VirusWall NT 3.23/3.3缓冲区溢出。参考网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94199707625818&w=2参考:BUGTRAQ: 19991108 Re:内扫描VirusWall NT 3.23/3.3缓冲区溢出。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94210427406568&w=2参考:BUGTRAQ: 19991108 VirusWall 3.23补丁。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94204166130782&w=2参考:NTBUGTRAQ: 19991108 VirusWall 3.23补丁。参考网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94208143007829&w=2参考:BUGTRAQ: 20000417新DOS内扫描NT / 3.32参考:网址:http://www.securityfocus.com/archive/1/55551参考:报价:787参考:网址:http://www.securityfocus.com/bid/787参考:XF: viruswall-helo-bo(3465)参考:网址:http://xforce.iss.net/static/3465.php存在缓冲区溢出在趋势科技的直升机命令内扫描VirusWall SMTP网关3.23/3.3元,这可能允许攻击者执行任意代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1529 3供应商确认:是的后续内容决定:SF-LOC抽象:趋势科技的补丁仅供这个缓冲区溢出部分工作仍然敞开了SMTP网关与过度长直升机命令拒绝服务。我认为这两个问题相同的原始问题的一部分。并不是所有的可能同意。版本——豌豆CD: SF-LOC,至少在我的脑海里,表明“不完全固定错误”应该结合到相同的条目。——Christey投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1532网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1532最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991029信息:收件人vul网景通讯服务器。参考网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94117465014255&w=2参考:报价:748参考:网址:http://www.securityfocus.com/bid/748网景的消息传递服务器3.54,3.55,和3.6允许远程攻击者造成拒绝服务(内存耗尽)通过一系列的长收件人命令,分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1532 3供应商确认:未知的内容决定:SF-CODEBASE检查网景公司的网站我能看出他们为Solaris和消息传递服务器NT。尽管操作系统是不同的,我相信问题是共同的应用程序代码(CD: SF-CODEBASE)。两个bug参与这种剥削。当他们利用他们一起产生DoS。一个是一个无界的SMTP收件人命令缓冲区,另一个内存泄漏的消息传递服务器软件失败为收件人释放分配的内存缓冲区。——豌豆投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1533网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1533最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990926 DoS利用Eicon william Diehl局域网ISDN调制解调器参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93846522511387&w=2参考:报价:665参考:网址:http://www.securityfocus.com/bid/665参考:XF: diva-lan-isdn-dos(3317)参考:网址:http://xforce.iss.net/static/3317.phpEicon天后局域网ISDN调制解调器技术允许远程攻击者造成拒绝服务(挂)通过登录密码参数。htm文件的HTTP服务。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1533 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1534网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1534最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990923多个供应商诺克斯Arkiea本地根/远程DoS参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93837184228248&w=2参考:报价:661参考:网址:http://www.securityfocus.com/bid/661缓冲区溢出(2)和(1)nlservd rnavc在诺克斯软件Arkeia备份产品允许本地用户获得root访问通过长家里环境变量。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1534 3供应商确认:未知的内容决定:SF-EXEC抽象:我写这一个错误,因为相同的C利用工作在两个二进制文件(CD: SF-EXEC)。一个只有改变execl调用的程序名。这认为二进制代码相同或非常相似的错误的方式他们都处理家庭环境变量——豌豆投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1539网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1539最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991110远程DoS攻击QVT /术语“+”4.2 d FTP服务器漏洞参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94225924803704&w=2参考:NTBUGTRAQ: 19991110远程DoS攻击QVT /术语“+”4.2 d FTP服务器漏洞参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94223972910670&w=2参考:报价:796参考:网址:http://www.securityfocus.com/bid/796参考:XF: qvtterm-login-dos(3491)参考:网址:http://xforce.iss.net/static/3491.php缓冲区溢出在QPC的FTP服务器软件的QVT /词+ 4.2 d和4.3版和QVT /净4.3允许远程攻击者导致拒绝服务,并可能执行任意命令,通过一个长(1)用户名或密码(2)。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1539 3供应商确认:未知的内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1540网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1540最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:L0PHT: 19991004参考:网址:http://www.atstake.com/research/advisories/1999/shell-lock.txt参考:BUGTRAQ: 19991005仙人掌软件的shell-lock参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93916168802365&w=2参考:XF: cactus-shell-lock-retrieve-shell-code(3356)参考:网址:http://xforce.iss.net/static/3356.phpshell-lock仙人掌软件壳锁使用弱加密(简单编码),允许攻击者轻易解密和获得源代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1540 3供应商确认:未知的内容决定:DESIGN-WEAK-ENCRYPTION投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1541网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1541最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:L0PHT: 19991004参考:网址:http://www.atstake.com/research/advisories/1999/shell-lock.txt参考:BUGTRAQ: 19991005仙人掌软件的shell-lock参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=93916168802365&w=2参考:XF: cactus-shell-lock-root-privs(3358)参考:网址:http://xforce.iss.net/static/3358.phpshell-lock仙人掌软件壳锁允许本地用户读取或修改解码Shell执行文件之前,通过一个符号链接攻击一个临时文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1541 3供应商确认:未知的内容决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1547网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1547最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19991125 Oracle Web侦听器参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94359982417686&w=2参考:NTBUGTRAQ: 19991125 Oracle Web侦听器参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=94390053530890&w=2参考:报价:841参考:网址:http://www.securityfocus.com/bid/841Oracle Web 2.1侦听器允许远程攻击者绕过访问限制通过替换一个字符的URL HTTP-encoded(十六进制)等价的。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1547 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1549网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1549最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:lynx BUGTRAQ: 19991116 2.8。x -“特殊URL”欺骗保护弱引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=94286509804526&w=2参考:报价:804参考:网址:http://www.securityfocus.com/bid/804猞猁2。x不正确区分内部和外部的HTML,它允许一个本地攻击者阅读“安全”隐藏表单的值从一个临时文件和工艺LYNXOPTIONS: URL导致猞猁修改用户的配置文件,并执行命令。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1549 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1562网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1562最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990905 gftp参考:网址:http://www.securityfocus.com/archive/1/269151.13 gFTP FTP客户端,和其他在2.0.0版本,记录明文的密码(1)日志窗口,或(2)在一个日志文件中。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1562 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1563网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1563最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻/ CF / MP / SA / /未知参考:BUGTRAQ: 19991014 NEUROCOM: Nashuatec打印机,3漏洞发现参考:网址:http://www.securityfocus.com/archive/1/30849参考:BUGTRAQ: 19991116 NEUROCOM: Nashuatec D445/435漏洞更新参考:网址:http://www.securityfocus.com/archive/1/35075Nachuatec D435 D445打印机允许远程攻击者通过ICMP重定向风暴导致拒绝服务。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1563 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 1999 - 1564网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 1999 - 1564最终决定:阶段性裁决:修改:建议:20010912分配:20010831类别:科幻参考:BUGTRAQ: 19990902(与freebsd内核恐慌- 3.2 - 19990830 -稳定)参考:网址:http://www.securityfocus.com/archive/1/26166FreeBSD 3.2和其他版本允许本地用户可能导致拒绝服务(恐慌)有大量的访问NFS v3安装目录从大量的流程。分析- - - - - - - - - - - - - - - - - ED_PRI - 1999 - 1564 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论: