Weekly Vulnerabilities Reports > May 21 to 27, 2001

Overview

10 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 3 high severity vulnerabilities. This weekly summary report vulnerabilities in 7 products from 6 vendors including Beck IPC Gmbh, Microsoft, HP, Aclogic, and Anybus. Vulnerabilities are notably categorized as and "Improper Restriction of Excessive Authentication Attempts".

  • 7 reported vulnerabilities are remotely exploitables.
  • 10 reported vulnerabilities are exploitable by an anonymous user.
  • Beck IPC Gmbh has the most reported vulnerabilities, with 5 reported vulnerabilities.
  • Anybus has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-05-24 CVE-2001-1339 Anybus Improper Restriction of Excessive Authentication Attempts vulnerability in Anybus Ipc@Chip Firmware

Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks.
9.8

3 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-05-24 CVE-2001-1428 Beck IPC Gmbh Unspecified vulnerability in Beck IPC Gmbh IPC AT Chip Embedded-Webserver

The (1) FTP and (2) Telnet services in Beck GmbH IPC@Chip are shipped with a default password, which allows remote attackers to gain unauthorized access.
7.5
2001-05-24 CVE-2001-0749 Beck IPC Gmbh Unspecified vulnerability in Beck IPC Gmbh IPC AT Chip Embedded-Webserver

Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root.
7.5
2001-05-22 CVE-2001-0551 HP Unspecified vulnerability in HP Hp-Ux

Buffer overflow in CDE Print Viewer (dtprintinfo) allows local users to execute arbitrary code by copying text from the clipboard into the Help window.
7.2

6 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-05-27 CVE-2001-1335 Aclogic Directory Traversal vulnerability in Aclogic Cesarftp 0.98B

Directory traversal vulnerability in CesarFTP 0.98b and earlier allows remote authenticated users (such as anonymous) to read arbitrary files via a GET with a filename that contains a ...%5c (modified dot dot).
5.0
2001-05-24 CVE-2001-1341 Beck IPC Gmbh Information Disclosure vulnerability in Beck IPC GmbH IPC@CHIP Network

The Beck GmbH IPC@Chip embedded web server installs the chipcfg.cgi program by default, which allows remote attackers to obtain sensitive network information via a request to the program.
5.0
2001-05-24 CVE-2001-1338 Beck IPC Gmbh Unspecified vulnerability in Beck IPC Gmbh IPC AT Chip Telnetd Server

Beck IPC GmbH IPC@CHIP TelnetD server generates different responses when given valid and invalid login names, which allows remote attackers to determine accounts on the system.
5.0
2001-05-21 CVE-2001-1337 Beck IPC Gmbh Unspecified vulnerability in Beck IPC Gmbh IPC AT Chip Embedded-Webserver

Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to cause a denial of service via a long HTTP request.
5.0
2001-05-24 CVE-2001-1347 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Windows 2000 allows local users to cause a denial of service and possibly gain privileges by setting a hardware breakpoint that is handled using global debug registers, which could cause other processes to terminate due to an exception, and allow hijacking of resources such as named pipes.
4.6
2001-05-24 CVE-2001-1327 Berkeley Softworks Local Security vulnerability in Pmake

pmake before 2.1.35 in Turbolinux 6.05 and earlier is installed with setuid root privileges, which could allow local users to gain privileges by exploiting vulnerabilities in pmake or programs that are used by pmake.
4.6

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS