CVE_or_CAN_Entry | SANS_Top_Twenty_Identification | Description |
CVE-2001-0241 | W1: IIS Weaknesses | "Buffer overflow in Internet Printing ISAPI extension in Windows 2000allows remote attackers to gain root privileges via a long printrequest that is passed to the extension through IIS 5.0." |
CVE-2001-0333 | W1: IIS Weaknesses | "Directory traversal vulnerability in IIS 5.0 and earlier allows remoteattackers to execute arbitrary commands by encoding .. (dot dot) and""\"" characters twice." |
CVE-2001-0500 | W1: IIS Weaknesses | Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files. |
CAN-2002-0079 | W1: IIS Weaknesses | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. |
CVE-2000-0884 | W1: IIS Weaknesses | "IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the ""Web Server Folder Traversal"" vulnerability." |
CVE-2000-0886 | W1: IIS Weaknesses | "IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the ""Web Server File Request Parsing"" vulnerability." |
CAN-2002-0071 | W1: IIS Weaknesses | Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. |
CAN-2002-0147 | W1: IIS Weaknesses | "Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka ""Microsoft-discovered variant of Chunked Encoding buffer overrun.""" |
CAN-2002-0150 | W1: IIS Weaknesses | "Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values." |
CAN-2002-0364 | W1: IIS Weaknesses | "Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka ""Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."" " |
CAN-2002-0149 | W1: IIS Weaknesses | "Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names." |
CVE-1999-0191 | W1: IIS Weaknesses | IIS newdsn.exe CGI script allows remote users to overwrite files. |
CVE-2001-0151 | W1: IIS Weaknesses | "IIS 5.0 allows remote attackers to cause a denial of service via aseries of malformed WebDAV requests." |
CAN-1999-0736 | W1: IIS Weaknesses | The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. |
CVE-1999-0278 | W1: IIS Weaknesses | "In IIS, remote attackers can obtain source code for ASP files by appending ""::$DATA"" to the URL." |
CAN-2002-0073 | W1: IIS Weaknesses | "The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request." |
CVE-2000-0778 | W1: IIS Weaknesses | "IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a ""Translate: f"" header, aka the ""Specialized Header"" vulnerability." |
CVE-1999-0874 | W1: IIS Weaknesses | "Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions." |
CVE-2000-0226 | W1: IIS Weaknesses | Microsoft IIS 4.0 Chunked Encoding Denial of Service |
CAN-1999-1457 | W1: IIS Weaknesses | Microsoft IIS 4.0 fpcount.exe Buffer Overflow |
CAN-1999-1556 | W1: IIS Weaknesses | Microsoft IIS 4.0/5.0 File Permission Canonicalization Vulnerability |
CVE-2000-0002 | W1: IIS Weaknesses | "IIS 5.0 uses relative paths to find system files that will runin-process, which allows local users to gain privileges via a Trojanhorse file, aka the ""System file listing privilege elevation""vulnerability." |
CVE-2000-0012 | W1: IIS Weaknesses | Microsoft IIS Nimda Worm; System Compromise Indicator |
CVE-1999-0264 | W1: IIS Weaknesses | htmlscript CGI program allows remote read access to files. |
CAN-1999-0509 | W1: IIS Weaknesses | "Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands." |
CVE-1999-0237 | W1: IIS Weaknesses | Remote execution of arbitrary commands through Guestbook CGI program. |
CVE-1999-1011 | W2: MDAC RDS Exploit | "The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands." |
CAN-2002-0056 | W3: MSSQL Server Weaknesses | "Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to executearbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc connection." |
CAN-2002-0649 | W3: MSSQL Server Weaknesses | "Multiple buffer overflows in SQL Server 2000 Resolution Service allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption." |
CAN-2001-0542 | W3: MSSQL Server Weaknesses | "Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackerswith access to SQL Server to execute arbitrary code through thefunctions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE:the C runtime format string vulnerability reported in MS01-060 isidentified by CAN-2001-0879." |
CAN-2000-1081 | W3: MSSQL Server Weaknesses | "The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the ""Extended Stored Procedure Parameter Parsing"" vulnerability." |
CVE-1999-0999 | W3: MSSQL Server Weaknesses | Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet. |
CAN-2002-0624 | W3: MSSQL Server Weaknesses | "Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka ""Unchecked Buffer in Password Encryption Procedure.""" |
CAN-2002-0154 | W3: MSSQL Server Weaknesses | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. |
CAN-2002-0186 | W3: MSSQL Server Weaknesses | "Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka ""Unchecked Buffer in SQLXML ISAPI Extension.""" |
CAN-2002-0154 | W3: MSSQL Server Weaknesses | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. |
CAN-2000-0017 | W3: MSSQL Server Weaknesses | Microsoft SQL Weak Database Password |
CVE-2000-0040 | W3: MSSQL Server Weaknesses | Microsoft SQL Server 'Hello' Buffer Overflow; Remote Command Execution |
CAN-1999-0519 | W4: Unprotected Windows Shares | "A NETBIOS/SMB share password is the default, null, or missing." |
CVE-2000-0979 | W4: Unprotected Windows Shares | "File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the ""Share Level Password"" vulnerability." |
CAN-2000-1079 | W4: Unprotected Windows Shares | NAI:20000829 Windows NetBIOS Unsolicited Cache Corruption |
CVE-2000-0044 | W4: Unprotected Windows Shares | NetBIOS Brute Force; Remote User Access |
CVE-2000-0045 | W5: Info Leakage Via Null Session | NetBIOS Null Session ; Extended Enumeration |
CAN-1999-0506 | W7: Nonexistent or Weak Passwords | "A Windows Ndomain user or administrator account has a default, null, blank, or missing password." |
CAN-1999-0504 | W7: Nonexistent or Weak Passwords | "A Windows NT local user or administrator account has a default, null, blank, or missing password." |
CVE-2000-0222 | W7: Nonexistent or Weak Passwords | "The installation for Windows 2000 does not activate the Administrator password until the system has rebooted, which allows remote attackers to connect to the ADMIN$ share without a password until the reboot occurs." |
CVE-2000-0065 | W7: Nonexistent or Weak Passwords | "Domain Administrator password guessed A Domain Administrator user account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network." |
CVE-2001-0154 | W8: Internet Explorer Weaknesses | "HTML e-mail feature in Internet Explorer 5.5 and earlier allowsattackers to execute attachments by setting an unusual MIME type forthe attachment, which Internet Explorer does not process correctly." |
CVE-2000-0127 | W8: Internet Explorer Weaknesses | "Internet Explorer 6.0 allows remote attackers to execute arbitrarycode by modifying the Content-Disposition and Content-Type headerfields in a way that causes Internet Explorer to believe that the fileis safe to open without prompting the user, aka the ""File ExecutionVulnerability.""" |
CVE-2000-0128 | W8: Internet Explorer Weaknesses | "Internet Explorer 5.5 and 6.0 allows remote attackers to cause theFile Download dialogue box to misrepresent the name of the file in thedialogue in a way that could fool users into thinking that the filetype is safe to download." |
CAN-2000-0133 | W9: Remote Registry Access | The registry in Windows NT can be accessed remotely by users who are not administrators. |
CVE-1999-0977 | U1: Buffer Overflow in RPC Svcs | Buffer overflow in Solaris sadmind allows remote attackers to gain root privileges using a NETMGT_PROC_SERVICE request. |
CVE-1999-0018 | U1: Buffer Overflow in RPC Svcs | Buffer overflow in statd allows root privileges. |
CVE-2000-0666 | U1: Buffer Overflow in RPC Svcs | "rpc.statd in the nfs-utils package in various Linux distributions does not properly cleanse untrusted format strings, which allows remote attackers to gain root privileges." |
CVE-1999-0002 | U1: Buffer Overflow in RPC Svcs | "BufferoverflowinNFSmountdgivesrootaccesstoremoteattackers,mostlyinLinuxsystems." |
CVE-2001-0803 | U1: Buffer Overflow in RPC Svcs | "Buffer overflow in the client connection routine of libDtSvc.so.1 inCDE Subprocess Control Service (dtspcd) allows remote attackers toexecute arbitrary commands" |
CVE-1999-0493 | U1: Buffer Overflow in RPC Svcs | "rpc.statd allows remote attackers to forward RPC calls to the local operating system via the SM_MON and SM_NOTIFY commands, which in turn could be used to remotely exploit other bugs such as in automountd." |
CAN-2002-0573 | U1: Buffer Overflow in RPC Svcs | Format string vulnerability in RPC wall daemon (rpc.rwalld) for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed. |
CVE-2001-0717 | U1: Buffer Overflow in RPC Svcs | "Format string vulnerability in ToolTalk database serverrpc.ttdbserverd allows remote attackers to execute arbitrary commandsvia format string specifiers that are passed to the syslog function." |
CVE-1999-0003 | U1: Buffer Overflow in RPC Svcs | Execute commands as root via buffer over flow in Tooltalk database server (rpc.ttdbserverd) |
CVE-1999-0019 | U1: Buffer Overflow in RPC Svcs | "Delete or create a file via rpc.statd, due to invalid information." |
CVE-1999-0208 | U1: Buffer Overflow in RPC Svcs | rpc.ypupdated (NIS) allows remote users to execute arbitrary commands. |
CVE-1999-0696 | U1: Buffer Overflow in RPC Svcs | Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd) |
CVE-1999-0693 | U1: Buffer Overflow in RPC Svcs | Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges. |
CVE-1999-0008 | U1: Buffer Overflow in RPC Svcs | "Buffer overflow in NIS+, in Sun's rpc.nisd program" |
CVE-2001-0779 | U1: Buffer Overflow in RPC Svcs | "Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7and 8 allows remote attackers to gain root access via a long username." |
CAN-2002-0033 | U1: Buffer Overflow in RPC Svcs | BUGTRAQ:20020505 [LSD] Solaris cachefsd remote buffer overflow vulnerability Reference: URL:http://archives.neohapsis.com/archives/bugtraq/2002-05/0026.html |
CAN-2002-0391 | U1: Buffer Overflow in RPC Svcs | Sun Solaris RPC xdr_array Buffer Overflow |
CAN-2002-0677 | U1: Buffer Overflow in RPC Svcs | "CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure." |
CAN-2002-0679 | U1: Buffer Overflow in RPC Svcs | BUGTRAQ:20020812 ENTERCEPT RICOCHET ADVISORY: Multi-Vendor CDE ToolTalk Database Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102917002523536&w=2 |
CVE-1999-0207 | U1: Buffer Overflow in RPC Svcs | CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure. |
CVE-1999-0219 | U1: Buffer Overflow in RPC Svcs | CDE Subprocess Control Server daemon (dtspcd) is running. CDE Subprocess Control Server daemon (dtspcd) is running on this system. A buffer overflow condition exists in the connection negotiation routine within dtpscd. A remote attacker can generate a specially-crafted CDE client request to overflow exploit code onto the heap. The attacker can use this exploit code to execute arbitrary commands on the target system. |
CAN-1999-0243 | U1: Buffer Overflow in RPC Svcs | RPC cmsd ; Dangerous Service with Critical Vuln History |
CVE-1999-0247 | U1: Buffer Overflow in RPC Svcs | RPC dmispd ; Dangerous Service with Critical Vuln History |
CVE-1999-0502 | U1: Buffer Overflow in RPC Svcs | RPC kcmsd ; Dangerous Service with Critical Vuln History |
CAN-1999-0505 | U1: Buffer Overflow in RPC Svcs | RPC mountd ; Dangerous Service with Critical Vuln History |
CAN-1999-0508 | U1: Buffer Overflow in RPC Svcs | RPC nlockmgr ; Dangerous Service with Critical Vuln History |
CAN-1999-0562 | U1: Buffer Overflow in RPC Svcs | RPC sadmind ; Dangerous Service with Critical Vuln History |
CAN-1999-0607 | U1: Buffer Overflow in RPC Svcs | RPC ttdbserverd ; Dangerous Service with Critical Vuln History |
CVE-1999-0608 | U1: Buffer Overflow in RPC Svcs | RPC ypbind ; Dangerous Service with Critical Vuln History |
CAN-1999-0610 | U1: Buffer Overflow in RPC Svcs | RPC yppasswdd ; Dangerous Service with Critical Vuln History |
CAN-2002-0392 | U2: Apache Weaknesses | "Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers tocause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size." |
CAN-2002-0061 | U2: Apache Weaknesses | "Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shellinterpreter, typically cmd.exe." |
CVE-1999-0021 | U2: Apache Weaknesses | Arbitrary command execution via buffer overflow in Count.cgi (wwwcount) cgi-bin program. |
CVE-1999-0172 | U2: Apache Weaknesses | FormMail CGI program allows remote execution of commands. |
CVE-1999-0266 | U2: Apache Weaknesses | The info2www CGI script allows remote file access or remote command execution. |
CVE-1999-0067 | U2: Apache Weaknesses | CGI phf program allows remote command execution through shell metacharacters. |
CVE-1999-0260 | U2: Apache Weaknesses | The jj CGI program allows command execution via shell metacharacters. |
CVE-1999-0262 | U2: Apache Weaknesses | faxsurvey CGI script on Linux allows remote command execution via shell metacharacters. |
CVE-2000-0010 | U2: Apache Weaknesses | WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter. |
CVE-1999-0174 | U2: Apache Weaknesses | The view-source CGI program allows remote attackers to read any file on the system that is internally accessible by the web server. |
CVE-1999-0066 | U2: Apache Weaknesses | AnyForm CGI remote execution |
CVE-1999-0146 | U2: Apache Weaknesses | The campas CGI program provided with some NCSA web servers allows an attacker to read arbitrary files. |
CVE-2000-0208 | U2: Apache Weaknesses | The htdig (ht://Dig) CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks (`) in parameters to htsearch. |
CVE-2000-0287 | U2: Apache Weaknesses | The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter. |
CVE-2000-0941 | U2: Apache Weaknesses | "Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the ""whois"" parameter." |
CAN-2000-0832 | U2: Apache Weaknesses | Htgrep CGI program allows remote attackers to read arbitrary files by specifying the full pathname in the hdr parameter. |
CVE-1999-0070 | U2: Apache Weaknesses | test-cgi program allows an attacker to list files on the server |
CVE-2002-0082 | U2: Apache Weaknesses | "The mod_ssl dbm and shm session cache code before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session." |
CVE-1999-0708 | U2: Apache Weaknesses | The mailto CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the emailadd form field. |
CVE-1999-0751 | U2: Apache Weaknesses | "Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file." |
CAN-2002-0656 | U2: Apache Weaknesses | "Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3." |
CAN-2002-0655 | U2: Apache Weaknesses | "OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code." |
CVE-2001-1141 | U2: Apache Weaknesses | BUGTRAQ:20010710 OpenSSL Security Advisory: PRNG weakness in versions up to 0.9.6a |
CAN-2002-0657 | U2: Apache Weaknesses | BUGTRAQ:20020730 OpenSSL Security Altert - Remote Buffer Overflows: |
CAN-1999-0509 | U2: Apache Weaknesses | "Perl, sh, csh, or other shell interpreters are installed in the cgi-bin directory on a WWW site, which allows remote attackers to execute arbitrary commands." |
CVE-1999-0237 | U2: Apache Weaknesses | Remote execution of arbitrary commands through Guestbook CGI program. |
CVE-1999-0264 | U2: Apache Weaknesses | htmlscript CGI program allows remote read access to files. |
CVE-2001-0144 | U3: SSH Weaknesses | "CORE SDI SSH1 CRC-32 compensation attack detector allows remoteattackers to execute arbitrary commands on an SSH server or client viaan integer overflow." |
CVE-2002-0083 | U3: SSH Weaknesses | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. |
CAN-2002-0639 | U3: SSH Weaknesses | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication. |
CVE-2001-0553 | U3: SSH Weaknesses | "SSH Secure Shell 3.0.0 on Unix systems does not properly perform password authentication to the sshd2 daemon, which allows local users to gain access to accounts with short password fields, such as locked accounts that use ""NP"" in the password field." |
CAN-2002-0640 | U3: SSH Weaknesses | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt). |
CVE-2001-0361 | U3: SSH Weaknesses | BUGTRAQ:20010207 [CORE SDI ADVISORY] SSH1 session key recovery vulnerability |
CAN-2002-0575 | U3: SSH Weaknesses | "Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges." |
CVE-2001-0060 | U3: SSH Weaknesses | BUGTRAQ:20001218 Stunnel format bug |
CVE-2001-0080 | U3: SSH Weaknesses | CISCO:20001213 Cisco Catalyst SSH Protocol Mismatch Vulnerability |
CVE-2002-0002 | U3: SSH Weaknesses | BUGTRAQ:20011227 Stunnel: Format String Bug in versions <3.22 |
CAN-2002-0575 | U3: SSH Weaknesses | "Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges." |
CVE-1999-0789 | U3: SSH Weaknesses | OpenSSH Login Vulnerability and UseLogin Vulnerability |
CVE-1999-0800 | U3: SSH Weaknesses | "ssh-keygen in ssh 1.2.27 - 1.2.30 with Secure-RPC can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private key file." |
CAN-2002-0656 | U3: SSH Weaknesses | "Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3." |
CAN-2002-0655 | U3: SSH Weaknesses | "OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code." |
CVE-2001-1141 | U3: SSH Weaknesses | BUGTRAQ:20010710 OpenSSL Security Advisory: PRNG weakness in versions up to 0.9.6a |
CAN-2002-0657 | U3: SSH Weaknesses | BUGTRAQ:20020730 OpenSSL Security Altert - Remote Buffer Overflows: |
CAN-2002-0013 | U4: SNMP Weaknesses | "Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest, (2) GetNextRequest, and (3) SetRequest messages, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor." |
CVE-2002-0799 | U4: SNMP Weaknesses | Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges. |
CAN-2002-0012 | U4: SNMP Weaknesses | "Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor." |
CAN-2002-0048 | U4: SNMP Weaknesses | SUSE:SuSE-SA:2002:004 Reference: URL:http://lists.suse.com/archives/suse-security-announce/2002-Jan/0003. html |
CAN-2002-0796 | U4: SNMP Weaknesses | BUGTRAQ:20020604 Entercept Ricochet Security Advisory: Solaris snmpdx Vulnerabilities Reference: URL:http://marc.theaimsgroup.com/?l=bugtraq&m=102321107714554&w=2 |
CAN-2002-0012 | U4: SNMP Weaknesses | "Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor." |
CVE-1999-0834 | U4: SNMP Weaknesses | "SNMP agents in 3Com AirConnect AP-4111 and Symbol 41X1 Access Point allow remote attackers to obtain the WEP encryption key by reading it from a MIB when the value should be write-only, via (1) dot11WEPDefaultKeyValue in the dot11WEPDefaultKeysTable of the IEEE 802.11b MIB, or (2) ap128bWepKeyValue in the ap128bWEPKeyTable in the Symbol MIB." |
CVE-1999-0368 | U5: FTP Weaknesses | "Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto." |
CVE-2001-0550 | U5: FTP Weaknesses | "wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a ""~{"" argument to commands such as CWD, which is not properly handled by the glob function." |
CVE-1999-0080 | U5: FTP Weaknesses | "wu-ftp FTP server allows root access via ""site exec"" command." |
CVE-1999-0878 | U5: FTP Weaknesses | Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via MAPPING_CHDIR. |
CVE-1999-0879 | U5: FTP Weaknesses | Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via macro variables in a message file. |
CVE-1999-0950 | U5: FTP Weaknesses | Buffer overflow in WFTPD FTP server allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories. |
CAN-2001-0249 | U5: FTP Weaknesses | "Heap overflow in FTP daemon in Solaris 8 allows remote attackers toexecute arbitrary commands by creating a long pathname and calling theLIST command, which uses glob to generate long strings." |
CAN-1999-0527 | U5: FTP Weaknesses | "The permissions for system-critical data in an anonymous FTP account are inappropriate. For example, the root directory is writeable by world, a real password file is obtainable, or executable commands such as ""ls"" can be overwritten." |
CAN-1999-0911 | U5: FTP Weaknesses | "Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories." |
CVE-1999-0955 | U5: FTP Weaknesses | Race condition in wu-ftpd and BSDI ftpd allows remote attackers gain root access via the SITE EXEC command. |
CVE-2000-0573 | U5: FTP Weaknesses | "The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command." |
CVE-2001-0187 | U5: FTP Weaknesses | "Format string vulnerability in wu-ftp 2.6.1 and earlier, when runningwith debug mode enabled, allows remote attackers to execute arbitrarycommands via a malformed argument that is recorded in a PASV portassignment." |
CAN-2001-0935 | U5: FTP Weaknesses | "Vulnerability in wu-ftpd 2.6.0, and possibly earlier versions, whichis unrelated to the ftpglob bug described in CAN-2001-0550." |
CVE-1999-0880 | U5: FTP Weaknesses | "Denial of service in WU-FTPD via the SITE NEWER command, which does not free memory properly." |
CAN-2000-0574 | U5: FTP Weaknesses | "FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of servic" |
CAN-2001-0247 | U5: FTP Weaknesses | "Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3." |
CVE-2001-0053 | U5: FTP Weaknesses | "One-byte buffer overflow in replydirname function in BSD-based ftpdallows remote attackers to gain root privileges." |
CVE-2001-0318 | U5: FTP Weaknesses | Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory (cwd). |
CAN-2001-0248 | U5: FTP Weaknesses | "Buffer overflow in FTP server in HPUX 11 allows remote attackers toexecute arbitrary commands by creating a long pathname and calling theSTAT command, which uses glob to generate long strings." |
CVE-1999-0896 | U5: FTP Weaknesses | CWD ~root command in ftpd allows root access. |
CAN-1999-0913 | U5: FTP Weaknesses | getcwd() file descriptor leak in FTP |
CVE-1999-0934 | U5: FTP Weaknesses | IBM AIX FTPD Buffer Overflow |
CVE-1999-0951 | U5: FTP Weaknesses | SunFTP Server Buffer Overflow Vulnerability |
CVE-1999-0978 | U5: FTP Weaknesses | "Buffer overflow in bftpd 1.0.13 allows remote attackers to cause adenial of service and possibly execute arbitrary commands via a longSITE CHOWN command." |
CAN-1999-1154 | U5: FTP Weaknesses | "Directory traversal vulnerability in SunFTP build 9 allows remoteattackers to read arbitrary files via .. (dot dot) characters invarious commands, including (1) GET, (2) MKDIR, (3) RMDIR, (4) RENAME,or (5) PUT." |
CVE-1999-1177 | U5: FTP Weaknesses | "postinst installation script for Proftpd in Debian 2.2 does notproperly change the ""run as uid/gid root"" configuration when the userenables anonymous access, which causes the server to run at a higherprivilege than intended." |
CVE-1999-0170 | U6: Trust Relationships | "Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list." |
CVE-1999-0113 | U6: Trust Relationships | Some implementations of rlogin allow root access if given a -froot parameter. |
CVE-1999-0627 | U6: Trust Relationships | "The rexd service is running, which uses weak authentication that can allow an attacker to execute commands." |
CVE-1999-0180 | U6: Trust Relationships | in.rshd allows users to login with a NULL username and execute commands. |
CAN-1999-0651 | U6: Trust Relationships | The rsh/rlogin service is running. |
CAN-1999-1179 | U6: Trust Relationships | NFS Exported Directories Mountable by Unauthorized Users |
CAN-1999-1278 | U6: Trust Relationships | "NFS writable ""An NFS export was found to be writable by anyone. An attacker could modify any file on this system.""" |
CAN-1999-1376 | U6: Trust Relationships | "Rsh vulnerable in hosts.equiv Sites that have a '+' or other wildcard character in the /etc/hosts.equiv, /etc/hosts.lpd, and .rhosts files can be accessed from remote computer without the attacker having to know any system passwords." |
CVE-2001-0353 | U7: LPD Buffer Overflow | ISS:20010619 Remote Buffer Overflow Vulnerability in Solaris Print Protocol Daemon |
CVE-1999-0206 | U8: Sendmail Weaknesses | MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. |
CVE-1999-0203 | U8: Sendmail Weaknesses | "In Sendmail, attackers can gain root privileges via SMTP by specifying an improper ""mail from"" address and an invalid ""rcpt to"" address that would cause the mail to bounce to a program." |
CVE-1999-0204 | U8: Sendmail Weaknesses | "Sendmail 8.6.9 allows remote attackers to execute root commands, using ident." |
CVE-1999-0047 | U8: Sendmail Weaknesses | MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. |
CVE-2001-0236 | U8: Sendmail Weaknesses | "Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allowsremote attackers to execute arbitrary commands via a long ""indication""event." |
CAN-1999-0512 | U8: Sendmail Weaknesses | "Mail relay is enabled, allowing abuse by spammers." |
CVE-1999-0130 | U8: Sendmail Weaknesses | Local users can start Sendmail in daemon mode and gain root privileges. |
CVE-1999-0131 | U8: Sendmail Weaknesses | Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users. |
CAN-1999-1377 | U8: Sendmail Weaknesses | "Sendmail 8.10.0 through 8.11.5, and 8.12.0 beta, allows local users tomodify process memory and possibly gain privileges via a large valuein the 'category' part of debugger (-d) command line arguments, whichis interpreted as a negative number." |
CVE-1999-0009 | U9: Bind Weaknesses | InversequerybufferoverflowinBIND4.9andBIND8Releases. |
CVE-1999-0833 | U9: Bind Weaknesses | Buffer overflow in BIND 8.2 via NXT records. |
CVE-2001-0010 | U9: Bind Weaknesses | "Buffer overflow in transaction signature (TSIG) handling code in BIND8 allows remote attackers to gain root privileges." |
CVE-2001-0011 | U9: Bind Weaknesses | "Buffer overflow in nslookupComplain function in BIND 4 allows remoteattackers to gain root privileges." |
CVE-2001-0013 | U9: Bind Weaknesses | "Format string vulnerability in nslookupComplain function in BIND 4allows remote attackers to gain root privileges." |
CVE-2001-0011 | U9: Bind Weaknesses | "Buffer overflow in nslookupComplain function in BIND 4 allows remoteattackers to gain root privileges." |
CVE-1999-0024 | U9: Bind Weaknesses | "DNS cache poisoning via BIND, by predictable query IDs." |
CVE-2001-0012 | U9: Bind Weaknesses | "BIND 4 and BIND 8 allow remote attackers to access sensitiveinformation such as environment variables." |
CVE-1999-0837 | U9: Bind Weaknesses | Denial of service in BIND by improperly closing TCP sessions via so_linger. |
CVE-1999-0848 | U9: Bind Weaknesses | "Denial of service in BIND named via consuming more than ""fdmax"" file descriptors." |
CVE-1999-0849 | U9: Bind Weaknesses | Denial of service in BIND named via maxdname. |
CAN-2002-0400 | U9: Bind Weaknesses | ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL. |
CAN-2002-0400 | U9: Bind Weaknesses | ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL. |
CAN-1999-0662 | U10: Weak or Passwords | "A Unix account has a default, null, blank, or missing password" |