(提案)集群最近- 103 - 41的候选人

我最近提出集群——103年由编辑委员会审查和投票。名称:最近- 103描述:罐宣布2002/08/01和2002/08/15之间尺寸:41通过修改这封邮件你可能投票的候选人投票,将它寄回给我,或通过使用CVE投票网站。中列出的候选人优先秩序。优先级1和优先级2的候选人都应对不同层次的供应商确认,所以他们应该易于检查和可以信任的,是真实的问题。如果你发现任何RECENT-XX集群是不完整的对过程中发现的问题相关的时间框架,请发送信息给我,这样候选人可以被指定。——史蒂夫总结的选票使用(“严重程度”的按升序)- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -接受——选民接受候选人提出等待——选民对候选人没有意见修改选民想要改变一些小细节(例如参考/描述)审查-选民正在审查/研究候选人,或需要更多的信息,重塑候选人必须大幅修改,如分割或合并拒绝候选人不是“漏洞”,或重复等。1)请写你的投票在直线上,从“投票:”开始。如果你想添加评论或细节,在投票后将它们添加到线:线。2)如果你看到任何失踪的引用,请提及他们,使他们可以包括在内。在映射引用帮助极大。3)请注意,“修改”被视为一个“接受”当计算选票。 So if you don't have sufficient information for a candidate but you don't want to NOOP, use a REVIEWING. ********** NOTE ********** NOTE ********** NOTE ********** NOTE ********** Please keep in mind that your vote and comments will be recorded and publicly viewable in the mailing list archives or in other formats. ====================================================== Candidate: CAN-2002-0632 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0632最终决定:阶段性裁决:修改:建议:20020830分配:20020621类别:科幻参考:SGI: 20020804 - 01 - p脆弱性在SGI BDS(批量数据服务)BDSPro 2.4和更早的允许客户在BDS服务器上读取任意文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0632 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0679网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0679最终决定:阶段性裁决:修改:建议:20020830分配:20020709类别:科幻参考:BUGTRAQ: 20020812 ENTERCEPT跳弹咨询:多供应商CDE ToolTalk数据库引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102917002523536&w=2参考:CERT: ca - 2002 - 26参考:网址:http://www.cert.org/advisories/ca - 2002 - 26. - html参考:CERT-VN: VU # 387387参考:网址:http://www.kb.cert.org/vuls/id/387387参考:火山口:综援- 2002 sco.28.1参考:康柏:SSRT2274参考:AIXAPAR: IY32792参考:AIXAPAR: IY32793缓冲区溢出在常见的桌面环境(CDE) ToolTalk RPC数据库服务器(rpc.ttdbserverd)允许远程攻击者执行任意代码通过一个参数_TT_CREATE_FILE过程。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0679 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0700网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0700最终决定:阶段性裁决:修改:建议:20020830分配:20020712类别:科幻参考:女士:ms02 - 041参考:网址:http://www.microsoft.com/technet/security/bulletin/ms02 - 041. - asp缓冲区溢出的一个执行用户身份验证系统功能对微软内容管理服务器(反水雷舰)2001允许攻击者执行代码在本地系统背景下通过验证web页面调用的函数,即“无节制的缓冲MDAC功能可以使SQL Server妥协。”Analysis ---------------- ED_PRI CAN-2002-0700 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2002-0718 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0718最终决定:阶段性裁决:修改:建议:20020830分配:20020722类别:科幻参考:女士:ms02 - 041参考:网址:http://www.microsoft.com/technet/security/bulletin/ms02 - 041. - asp网络编辑命令微软内容管理服务器(反水雷舰)2001允许攻击者进行身份验证和上传可执行内容,通过修改上传的位置,又名“程序执行反水雷舰通过编辑功能”。Analysis ---------------- ED_PRI CAN-2002-0718 1 Vendor Acknowledgement: yes advisory Voting Section -------------- Possible votes: ACCEPT/MODIFY/NOOP/REVIEWING/RECAST/REJECT If ACCEPT or MODIFY, include reason for acceptance: VERIFIED-BY-MY-ORG, ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION, or provide other reason. VOTE: ACCEPT_REASON: COMMENTS: ====================================================== Candidate: CAN-2002-0719 URL:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0719最终决定:阶段性裁决:修改:建议:20020830分配:20020722类别:科幻参考:女士:ms02 - 041参考:网址:http://www.microsoft.com/technet/security/bulletin/ms02 - 041. - asp微软的SQL注入漏洞的功能服务内容管理服务器(反水雷舰)2001年允许远程攻击者执行任意命令通过一个反水雷舰资源请求的图像文件或其他文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0719 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0720网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0720最终决定:阶段性裁决:修改:建议:20020830分配:20020722类别:科幻参考:女士:ms02 - 042参考:网址:http://www.microsoft.com/technet/security/bulletin/ms02 - 042. - asp网络连接管理器的处理程序例程(不合格品)允许本地用户获得特权通过一个复杂的攻击,导致LocalSystem上下文处理程序运行指定的代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0720 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0721网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0721最终决定:阶段性裁决:修改:建议:20020830分配:20020722类别:科幻参考:BUGTRAQ: 20020816 Microsoft SQL Server扩展存储Procdure特权升级漏洞(# NISR15002002A)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102950473002959&w=2参考:NTBUGTRAQ: 20020816 Microsoft SQL Server扩展存储Procdure特权升级漏洞(# NISR15002002A)参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102950792606475&w=2参考:女士:ms02 - 043参考:网址:http://www.microsoft.com/technet/security/bulletin/ms02 - 043. - aspMicrosoft SQL Server 7.0和2000安装弱扩展存储过程的权限与辅助函数有关,这可能允许未经授权的用户,也可能是远程攻击者,用管理员权限运行存储过程通过xp_execresultset (1), (2) xp_printstatements,或(3)xp_displayparamstmt。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0721 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0818网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0818最终决定:阶段性裁决:修改:建议:20020830分配:20020801类别:科幻参考:BUGTRAQ: 20020718 wwwoffle - 2.7 - b和之前这种错误消极的内容长度值参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0194.html参考:SUSE: SuSE-SA: 2002:029参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102821890317683&w=2参考:DEBIAN: dsa - 144参考:网址:http://www.debian.org/security/2002/dsa - 144参考:XF: wwwoffle-neg-length-bo(9619)参考:网址:http://www.iss.net/security_center/static/9619.php参考:报价:5260参考:网址:http://www.securityfocus.com/bid/5260wwwoffled在万维网离线Explorer (WWWOFFLE)允许远程攻击者可能导致拒绝服务和执行任意代码通过一个负面内容长度值。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0818 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0823网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0823最终决定:阶段性裁决:修改:建议:20020830分配:20020802类别:科幻参考:BUGTRAQ: 20020801 Winhelp32远程缓冲区溢出参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102822806329440&w=2参考:NTBUGTRAQ: 20020801 Winhlp32。exe远程BufferOverrun参考:MSKB: Q293338参考:网址:http://support.microsoft.com/default.aspx?scid=kb; en - us; q293338在Winhlp32缓冲区溢出。exe允许远程攻击者通过HTML文档执行任意代码调用HTML帮助ActiveX控件(HHCtrl.ocx)长路径名项参数。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0823 1供应商确认:是的投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0826网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0826最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:ATSTAKE: A080802-1参考:网址:http://www.atstake.com/research/advisories/2002/a080802 - 1. - txt参考:确认:http://www.ipswitch.com/Support/WS_FTP-Server/patch-upgrades.html缓冲区溢出在WS_FTP FTP服务器3.1.1允许远程身份验证的用户通过长网站CPWD命令执行任意代码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0826 1供应商确认:是的、确认:供应商的补丁/升级页面包括一个项目3.1.2“纠正一个网站的安全问题处理的有关CPWD命令……固定缓冲区溢出CPWD命令“投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST, HAS-INDEPENDENT-CONFIRMATION,或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0829网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0829最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:FREEBSD: FreeBSD-SA-02:35。ffs参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102865404413458&w=2整数溢出在Berkeley快速文件系统(FFS)在FreeBSD 4.6.1 RELEASE-p4早些时候,允许本地用户访问任意文件内容在FFS获得特权通过创建一个文件大于所允许的虚拟内存系统。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0829 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0830网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0830最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:FREEBSD: FreeBSD-SA-02:36。nfs参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102865517214722&w=2网络文件系统(NFS)在FreeBSD 4.6.1 RELEASE-p7早些时候,可能还有其他操作系统,允许远程攻击者造成拒绝服务(挂)通过RPC消息以零长度载荷,导致NFS参考前一个有效载荷,进入一个无限循环。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0830 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0831网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0831最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:FREEBSD: FreeBSD-SA-02:37。kqueue参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102865142610126&w=2kqueue机制在FreeBSD 4.3到4.6稳定允许本地用户造成拒绝服务(内核恐慌)通过电话管一端的终止和EVFILT_WRITE过滤器的另一端。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0831 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0845网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0845最终决定:阶段性裁决:修改:建议:20020830分配:20020809类别:科幻参考:BUGTRAQ: 20020808达:太阳(TM)一个/ iPlanet Web服务器4.1和6.0远程缓冲区溢出参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102890933623192&w=2参考:确认:http://www.sun.com/service/support/software/iplanet/alerts/transferencodingalert-23july2002.html参考:XF: iplanet-chunked-encoding-bo(9799)参考:网址:http://www.iss.net/security_center/static/9799.php参考:报价:5433参考:网址:http://www.securityfocus.com/bid/5433缓冲区溢出在太阳/ iPlanet Web Server 4.1和6.0允许远程攻击者通过一个HTTP请求执行任意代码使用分块传输编码。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0845 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0846网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0846最终决定:阶段性裁决:修改:建议:20020830分配:20020809类别:科幻参考:BUGTRAQ: 20020808达:Macromedia Flash冲击波畸形头溢出参考:确认:http://www.macromedia.com/v1/handlers/index.cfm?ID=23293Macromedia Flash冲击波的译码器允许远程攻击者执行任意代码通过一个畸形的SWF头包含更多的数据比指定的长度。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0846 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0847网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0847最终决定:阶段性裁决:修改:建议:20020830分配:20020809类别:科幻参考:DEBIAN: dsa - 145参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102874450402924&w=2参考:确认:http://sourceforge.net/project/shownotes.php?release_id=88790参考:XF: tinyproxy-memory-corruption(9079)参考:网址:http://www.iss.net/security_center/static/9079.php参考:报价:4731参考:网址:http://www.securityfocus.com/bid/4731tinyproxy HTTP代理1.5.0,3,早些时候允许远程攻击者通过内存被释放两次执行任意代码(双重释放)。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0847 1供应商确认:是的咨询确认:供应商的更新日志1.5.0状态:“固定一堆内存泄漏,内存被释放两次的情况下一个潜在的安全问题。”投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0848网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0848最终决定:阶段性裁决:修改:建议:20020830分配:20020809类别:科幻参考:思科:20020807思科VPN 5000系列集中器半径PAP身份验证漏洞参考:网址:http://www.cisco.com/warp/public/707/vpn5k-radius-pap-vuln-pub.shtml思科VPN 5000系列集中器硬件6.0.21.0002和早些时候,5.2.23.0003早些时候,当使用半径与一种挑战的密码身份验证协议(PAP)或挑战,发送明文的用户密码验证重试请求,这可能允许远程攻击者盗取密码通过嗅探。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0848 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0851网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0851最终决定:阶段性裁决:修改:建议:20020830分配:20020810类别:科幻参考:VULNWATCH: 20020809本地根利用参考:网址:http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0068.html参考:SUSE: SuSE-SA: 2002:030参考:XF: isdn4linux-ipppd-format-string(9811)参考:网址:http://www.iss.net/security_center/static/9811.php参考:报价:5437参考:网址:http://www.securityfocus.com/bid/5437格式字符串漏洞在ISDN点对点协议(PPP)守护进程(ipppd) ISDN4Linux (i4l)包允许本地用户获得根权限通过设备名称的格式字符串命令行参数,这不是在调用syslog妥善处理。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0851 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0852网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0852最终决定:阶段性裁决:修改:建议:20020830分配:20020812类别:科幻参考:思科:20020812思科VPN客户端多个漏洞参考:网址:http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml缓冲区溢出在思科虚拟专用网(VPN)端3.5.4早些时候,允许远程攻击者通过(1)引起拒绝服务因特网密钥交换(IKE)与一个大的安全参数指数(SPI)负载,或(2)一个IKE包与大量的有效载荷。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0852 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0853网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0853最终决定:阶段性裁决:修改:建议:20020830分配:20020812类别:科幻参考:思科:20020812思科VPN客户端多个漏洞参考:网址:http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml思科虚拟专用网(VPN)客户3.5.4早些时候,允许远程攻击者造成拒绝服务(CPU消耗)通过一个包和一个零长度负载。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0853 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0856网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0856最终决定:阶段性裁决:修改:建议:20020830分配:20020813类别:科幻参考:国际空间站:20020813远程拒绝服务漏洞在Oracle9i SQL *网参考:网址:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20941参考:确认:http://otn.oracle.com/deploy/security/pdf/2002alert38rev1.pdf参考:XF: oracle-listener-debug-dos(9237)参考:网址:http://www.iss.net/security_center/static/9237.phpSQL *净侦听器Oracle Oracle9i 9.0。x和9.2允许远程攻击者造成拒绝服务(崩溃)通过某些调试调试不妥善处理的请求功能。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0856 1供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0871网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0871最终决定:阶段性裁决:修改:建议:20020830分配:20020816类别:科幻参考:DEBIAN: dsa - 151参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102927065426172&w=2参考:BUGTRAQ: 20020814 GLSA: xinetd参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102935383506155&w=2xinetd 2.3.4泄漏文件描述符的信号管由xinetd启动的服务,可以让这些服务通过管引起拒绝服务。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0871 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0872网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0872最终决定:阶段性裁决:修改:建议:20020830分配:20020816类别:科幻参考:DEBIAN: dsa - 152参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102927221427782&w=2l2tpd 0.67不初始化随机数生成器,它允许远程攻击者劫持会话。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0872 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0873网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0873最终决定:阶段性裁决:修改:建议:20020830分配:20020816类别:科幻参考:BUGTRAQ: 20020813新l2tpd release 0.68参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102925612907148&w=2参考:DEBIAN: dsa - 152参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102927221427782&w=2脆弱性l2tpd 0.67允许远程攻击者覆盖供应商字段通过长值的属性/值对,可能通过缓冲区溢出。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0873 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0970网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0970最终决定:阶段性裁决:修改:建议:20020830分配:20020821类别:科幻参考:BUGTRAQ: 20020812 Re:即SSL脆弱性(Konqueror影响)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102918241005893&w=2参考:DEBIAN: dsa - 155参考:网址:http://www.debian.org/security/2002/dsa - 155SSL功能在KDE 3.0.2 Konqueror,早些时候不验证的基本约束一个中间由ca签名的证书时,远程攻击者可以恶搞可信站点的证书通过中间人攻击。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0970 1供应商确认:是的咨询投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0660网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0660最终决定:阶段性裁决:修改:建议:20020830分配:20020702类别:科幻参考:DEBIAN: dsa - 140参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102858558321355&w=2参考:REDHAT: RHSA-2002:151参考:网址:http://rhn.redhat.com/errata/rhsa - 2002 - 151. - html参考:REDHAT: RHSA-2002:152参考:网址:http://rhn.redhat.com/errata/rhsa - 2002 - 152. - html缓冲区溢出在libpng 1.0.12-3.woody。2和libpng3 1.2.1-1.1.woody。2在Debian Linux 3.0和其他操作系统,可能允许攻击者可能导致拒绝服务和运行任意代码的情况,不同的漏洞比- 2002 - 0728。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0660 3供应商确认:对咨询内容的决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0661网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0661最终决定:阶段性裁决:修改:建议:20020830分配:20020702类别:科幻参考:BUGTRAQ: 20020809 Apache 2.0脆弱性影响非unix平台参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102892744011436&w=2参考:BUGTRAQ: 20020816 Apache 2.0.39目录遍历和路径信息披露错误引用:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102951160411052&w=2参考:确认:http://httpd.apache.org/info/security_bulletin_20020908a.txt目录遍历脆弱性在Apache 2.0 2.0.39在Windows上,OS2, Netware允许远程攻击者读取任意文件和执行命令通过. .(点点)包含\(反斜杠)字符序列。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0661 3供应商确认:对咨询内容的决定:模糊的投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0812网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0812最终决定:阶段性裁决:修改:建议:20020830分配:20020730类别:科幻参考:VULNWATCH: 20020809 [VULNWATCH] Foundstone实验室咨询——信息泄漏在奥里诺科河和康柏在康柏WL310接入点信息泄漏,和奥里诺科河住宅网关访问点的基础上,使用一个系统识别字符串作为默认SNMP读/写社区字符串,它允许远程攻击者获得配置信息通过查询和修改敏感识别字符串。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0812 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0828网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0828最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:BUGTRAQ: 20020805 IE SSL脆弱性参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102866120821995&w=2参考:BUGTRAQ: 20020812 IE SSL利用参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102918200405308&w=2SSL功能Internet Explorer 5、5.5和6不验证的基本约束一个中间由ca签名的证书时,远程攻击者可以恶搞可信站点的证书通过中间人攻击。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0828 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0832网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0832最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:BUGTRAQ: 20020804绕过饼干限制在IE中5 + 6参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102864890006745&w=2Internet Explorer 5、5.6和6允许远程攻击者绕过跨浏览器会话cookie隐私设置和存储信息通过用户数据(storeuserData)特性。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0832 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0833网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0833最终决定:阶段性裁决:修改:建议:20020830分配:20020806类别:科幻参考:BUGTRAQ: 20020805 (55 SNS咨询)尤朵拉5。x Windows缓冲区溢出漏洞参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102858453720304&w=2参考:BUGTRAQ: 20020808 (55 SNS咨询rev.2] Eudora 5。x Windows缓冲区溢出漏洞参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102883538924494&w=2缓冲区溢出Eudora 5.1.1和5.0 - j的窗户,和可能的其他版本,允许远程攻击者执行任意代码通过一个多部分消息,该消息带有一个长字符串边界。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0833 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0849网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0849最终决定:阶段性裁决:修改:建议:20020830分配:20020809类别:科幻参考:BUGTRAQ: 20020808 iDEFENSE安全顾问:iSCSI默认配置文件设置参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102882056105806&w=2参考:BUGTRAQ: 20020808 Re: [VulnWatch] iDEFENSE安全顾问:iSCSI默认配置文件设置参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102891036424424&w=2安装iSCSI Linux-iSCSI iSCSI实现。用全局权限配置文件在某些操作系统上,包括Red Hat Linux测试# 1中,这可能允许本地用户获得特权通过阅读密码明文的家伙。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0849 3供应商确认:未知的内容决定:EX-BETA包含:一些供应商,包括思科和SuSE,都说,这个问题不容易。如果只有脆弱的系统是一个测试版产品,然后CD:从CVE EX-BETA建议排除它。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0854网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0854最终决定:阶段性裁决:修改:建议:20020830分配:20020812类别:科幻参考:SUSE: SuSE-SA: 2002:030缓冲区溢出在ISDN点对点协议(PPP)守护进程(ipppd) i4l包在SUSE 7.3, 8.0,和可能的其他操作系统,允许本地用户获得特权。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0854 3供应商确认:对咨询内容的决定:模糊,SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0857网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0857最终决定:阶段性裁决:修改:建议:20020830分配:20020815类别:科幻参考:BUGTRAQ: 20020814甲骨文侦听器控制格式字符串漏洞(# NISR14082002)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102933735716634&w=2参考:确认:http://otn.oracle.com/deploy/security/pdf/2002alert40rev1.pdf格式字符串漏洞在Oracle侦听器控制效用(lsnrctl) Oracle 9.2和9.0,8.1,和7.3.4,允许远程攻击者在Oracle DBA系统上执行任意代码,格式字符串到侦听器中的某些条目。奥拉配置文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0857 3供应商确认:对咨询内容的决定:SF-LOC投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0858网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0858最终决定:阶段性裁决:修改:建议:20020830分配:20020815类别:科幻参考:BUGTRAQ: 20020812漏洞在Oracle参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102918005402808&w=2catsnmp安装Oracle 9 i和我与默认dbsnmp dbsnmp用户密码,它允许攻击者执行限制数据库操作和可能获得其他特权。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0858 3供应商确认:未知discloser-claimed内容决定:CF-PASS投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0870网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0870最终决定:阶段性裁决:修改:建议:20020830分配:20020816类别:科幻参考:思科:20020814思科11000系列内容服务开关网络管理漏洞参考:网址:http://www.cisco.com/warp/public/707/arrowpoint-webmgmt-vuln-pub.shtml思科的原创补丁内容服务开关11000系列认证绕过漏洞(cve - 2001 - 0622)是不完整的,它仍然允许远程攻击者获得更多特权直接请求web管理URL而不是浏览界面,可能通过原始攻击的变种,如被思科CSCdw08549错误ID。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0870 3供应商确认:对咨询内容的决定:BADPATCH,模糊,SF-LOC包含/抽象:CD: SF-LOC表明,如果一个问题出现在一个版本不表现出另一个问题,那么这两个问题应该分裂。咨询时模糊是否有两个独立的故障点,一个新的思科错误ID的存在表明,有;此外,管理员固定他们的系统对cve - 2001 - 0622,仍然是脆弱的,这进一步表明分裂(每个新CD BADPATCH)。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0874网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0874最终决定:阶段性裁决:修改:建议:20020830分配:20020816类别:科幻参考:DEBIAN: dsa - 150参考:网址:http://www.debian.org/security/2002/dsa - 150在交换4.8.6脆弱性,4.8.3和其他版本,在INET模式下运行时,允许远程攻击者读取任意文件。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0874 3供应商确认:对咨询内容的决定:模糊的投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0974网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0974最终决定:阶段性裁决:修改:建议:20020830分配:20020821类别:科幻参考:BUGTRAQ: 20020815删除任意文件使用帮助和支持中心(MSRC 1198 dg)参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102942549832077&w=2帮助和支持中心的Windows XP允许远程攻击者删除任意文件通过一个链接hcp:协议访问uplddrvinfo.htm。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0974 3供应商确认:未知discloser-claimed投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 0980网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 0980最终决定:阶段性裁决:修改:建议:20020830分配:20020821类别:科幻参考:BUGTRAQ: 20020815愚蠢的行为:Internet Explorer 5.5 - 6.0参考:网址:http://marc.theaimsgroup.com/?l=bugtraq&m=102942234427691&w=2参考:VULN-DEV: 20020815愚蠢行为:Internet Explorer 5.5 - 6.0参考:网址:http://marc.theaimsgroup.com/?l=vuln-dev&m=102943486811091&w=2参考:NTBUGTRAQ: 20020815愚蠢行为:Internet Explorer 5.5 - 6.0参考:网址:http://marc.theaimsgroup.com/?l=ntbugtraq&m=102937705527922&w=2Internet Explorer 5.5和6.0的Web文件夹组件写一个错误消息到一个已知位置在临时文件夹中,它允许远程攻击者执行任意代码注入到错误消息,然后指的错误消息文件通过mhtml: URL。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 0980 3供应商确认:未知投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1005网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1005最终决定:阶段性裁决:修改:建议:20020830分配:20020827类别:科幻参考:BUGTRAQ: 20020804咨询:ArGoSoft邮件服务器Pro 1.8.1.7 DoS参考:网址:http://archives.neohapsis.com/archives/bugtraq/2002-07/0515.html参考:报价:5395参考:网址:http://www.securityfocus.com/bid/5395参考:XF: argosoft-autoresponse-dos(9759)参考:网址:http://www.iss.net/security_center/static/9759.phpArGoSoft邮件服务器1.8.1.7早些时候,允许一个邮箱用户造成拒绝服务(CPU消耗)转发电子邮件给用户同时启用了回信,这创造了一个inifinite循环。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1005 3供应商确认:投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论:= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =候选人:- 2002 - 1032网址:http://cve.mitre.org/cgi - bin/cvename.cgi?name=can - 2002 - 1032最终决定:阶段性裁决:修改:建议:20020830分配:20020827类别:科幻参考:确认:http://www.keyfocus.net/kfws/support/缓冲区溢出在KeyFocus (KF) web服务器1.0.5早些时候,允许远程攻击者可能导致拒绝服务和执行任意代码通过一个HTTP头畸形。分析- - - - - - - - - - - - - - - - - ED_PRI - 2002 - 1032 3供应商确认:是的更新日志内容决定:模糊的确认:供应商的更改日志1.0.6,2002年8月2日表示:“安全漏洞——畸形头。安全漏洞存在于所有以前的版本,黑客使用一个特殊的http头畸形可能导致缓冲区溢出”。投票部分- - - - - - - - - - - - - - - -可能的选票:接受/修改/等待/审查/重塑/拒绝如果接受或修改,包括接受的理由:VERIFIED-BY-MY-ORG ACKNOWLEDGED-BY-VENDOR, VERIFIED-BY-SOMEONE-I-TRUST HAS-INDEPENDENT-CONFIRMATION或提供其他原因。投票:ACCEPT_REASON:评论: