Weekly Vulnerabilities Reports > July 16 to 22, 2001

Overview

84 new vulnerabilities reported during this period, including 10 critical vulnerabilities and 42 high severity vulnerabilities. This weekly summary report vulnerabilities in 78 products from 50 vendors including Microsoft, Oracle, IBM, Redhat, and SUN. Vulnerabilities are notably categorized as "Unrestricted Upload of File with Dangerous Type", and "Improper Authentication".

  • 65 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 84 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 19 reported vulnerabilities.
  • Microsoft has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

10 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-07-21 CVE-2001-1370 Phplib Team Remote Script Execution vulnerability in Multiple Vendor PHPLIB

prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib.

10.0
2001-07-21 CVE-2001-0534 Lucent
Merit
Remote Buffer Overflow vulnerability in Lucent RADIUS

Multiple buffer overflows in RADIUS daemon radiusd in (1) Merit 3.6b and (2) Lucent 2.1-2 RADIUS allow remote attackers to cause a denial of service or execute arbitrary commands.

10.0
2001-07-21 CVE-2001-0500 Microsoft Buffer Overflow vulnerability in Microsoft products

Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.

10.0
2001-07-21 CVE-2001-0499 Oracle Buffer Overflow vulnerability in Oracle 8i TNS Listener

Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4) TRC_FILE, (5) SAVE_CONFIG, or (6) RELOAD.

10.0
2001-07-21 CVE-2001-0353 SUN Remote Buffer Overflow vulnerability in Multiple Vendor lpd

Buffer overflow in the line printer daemon (in.lpd) for Solaris 8 and earlier allows local and remote attackers to gain root privileges via a "transfer job" routine.

10.0
2001-07-20 CVE-2001-1355 Netwin Buffer Overflow vulnerability in Netwin NWAuth

Buffer overflows in NetWin Authentication Module (NWAuth) 3.0b and earlier, as implemented in DMail, SurgeFTP, and possibly other packages, could allow attackers to execute arbitrary code via long arguments to (1) the -del command or (2) the -lookup command.

10.0
2001-07-19 CVE-2001-1367 Phpslice Remote Security vulnerability in Phpslice

The checkAccess function in PHPSlice 0.1.4, and all other versions between 0.1.1 and 0.1.6, does not properly verify the administrative access level, which could allow remote attackers to gain privileges.

10.0
2001-07-19 CVE-2001-1363 Phpwebsite Development Team Remote Security vulnerability in Phpwebsite

Vulnerability in phpWebSite before 0.7.9 related to running multiple instances in the same domain, which may allow attackers to gain administrative privileges.

10.0
2001-07-19 CVE-2001-1264 HP Unspecified vulnerability in HP Hp-Ux and Vvos

Vulnerability in mkacct in HP-UX 11.04 running Virtualvault Operating System (VVOS) 4.0 and 4.5 allows attackers to elevate privileges.

10.0
2001-07-21 CVE-2001-0537 Cisco Improper Authentication vulnerability in Cisco IOS

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

9.3

42 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-07-22 CVE-2001-0987 Nathan Neulinger Cross-Site Scripting vulnerability in CGIWrap

Cross-site scripting vulnerability in CGIWrap before 3.7 allows remote attackers to execute arbitrary Javascript on other web clients by causing the Javascript to be inserted into error messages that are generated by CGIWrap.

7.5
2001-07-21 CVE-2001-1257 Horde Unspecified vulnerability in Horde IMP

Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email.

7.5
2001-07-21 CVE-2001-0514 Atmel
Linksys
Netgear
SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network.
7.5
2001-07-21 CVE-2001-0347 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Information disclosure vulnerability in Microsoft Windows 2000 telnet service allows remote attackers to determine the existence of user accounts such as Guest, or log in to the server without specifying the domain name, via a malformed userid.

7.5
2001-07-21 CVE-2001-0341 Microsoft Buffer Overflow vulnerability in Microsoft products

Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.

7.5
2001-07-21 CVE-2001-0340 Microsoft Unrestricted Upload of File With Dangerous Type vulnerability in Microsoft Exchange Server 2000/5.5

An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.

7.5
2001-07-21 CVE-2001-0002 Microsoft Unspecified vulnerability in Microsoft Internet Explorer and Windows Script Host

Internet Explorer 5.5 and earlier allows remote attackers to obtain the physical location of cached content and open the content in the Local Computer Zone, then use compiled HTML help (.chm) files to execute arbitrary programs.

7.5
2001-07-21 CVE-2000-0891 IBM Unspecified vulnerability in IBM Lotus Notes

A default ECL in Lotus Notes before 5.02 allows remote attackers to execute arbitrary commands by attaching a malicious program in an email message that is automatically executed when the user opens the email.

7.5
2001-07-20 CVE-2001-1265 IBM Directory Traversal vulnerability in IBM Alphaworks Tftp Server 1.21

Directory traversal vulnerability in IBM alphaWorks Java TFTP server 1.21 allows remote attackers to conduct unauthorized operations on arbitrary files via a ..

7.5
2001-07-19 CVE-2001-1365 OSI Codes INC Remote Security vulnerability in Intragnat

Vulnerability in IntraGnat before 1.4.

7.5
2001-07-19 CVE-2001-1364 Project Purple Remote Security vulnerability in Autodns

Vulnerability in autodns.pl for AutoDNS before 0.0.4 related to domain names that are not fully qualified.

7.5
2001-07-19 CVE-2001-1362 Horsburgh Remote Security vulnerability in Npulse

Vulnerability in the server for nPULSE before 0.53p4.

7.5
2001-07-19 CVE-2001-1361 Twig Development Team Remote Security vulnerability in Twig

Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.

7.5
2001-07-18 CVE-2001-1030 Caldera
Immunix
Mandrakesoft
Squid
Redhat
Trustix
Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_proxy off settings are used, which allows attackers to bypass the ACLs and conduct unauthorized activities such as port scanning.
7.5
2001-07-17 CVE-2001-1279 LBL Buffer Overflow vulnerability in LBL Tcpdump 3.6.2

Buffer overflow in print-rx.c of tcpdump 3.x (probably 3.6x) allows remote attackers to cause a denial of service and possibly execute arbitrary code via AFS RPC packets with invalid lengths that trigger an integer signedness error, a different vulnerability than CVE-2000-1026.

7.5
2001-07-17 CVE-2001-1242 Steve Grimm Directory Traversal vulnerability in Steve Grimm Un-CGI

Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a ..

7.5
2001-07-17 CVE-2001-1241 Steve Grimm Unspecified vulnerability in Steve Grimm Un-Cgi

Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "#!" and the desired program name.

7.5
2001-07-17 CVE-2001-0980 Caldera Unspecified vulnerability in Caldera Openlinux Server and Openlinux Workstation

docview before 1.0-15 allows remote attackers to execute arbitrary commands via shell metacharacters that are processed when converting a man page to a web page.

7.5
2001-07-17 CVE-2001-0974 Oracle Unspecified vulnerability in Oracle Internet Directory 2.1.1/3.0.1

Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1321 Oracle Denial-Of-Service vulnerability in Internet Directory 2.1.1/3.0.1

Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER values, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1320 PGP Buffer Overflow vulnerability in PGP Keyserver 7.0

Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1318 Qualcomm Unspecified vulnerability in Qualcomm Eudora Worldmail Server 2.0

Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1317 Teamware Denial-Of-Service vulnerability in Teamware Office

Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for certain BER object types, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1316 Teamware Buffer Overflow vulnerability in Teamware Office LDAP

Buffer overflows in Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1315 Critical Path Denial-Of-Service vulnerability in Critical Path Injoin Directory Server and Livecontent Directory

Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed BER encodings, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1314 Critical Path Unspecified vulnerability in Critical Path Injoin Directory Server and Livecontent Directory

Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1313 IBM Denial-Of-Service vulnerability in IBM Lotus Domino R5 5.0.7A

Lotus Domino R5 before R5.0.7a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via miscellaneous packets with semi-valid BER encodings, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1312 IBM Unspecified vulnerability in IBM Lotus Domino R5 5.0.7A

Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1311 IBM Buffer Overflow vulnerability in IBM Lotus Domino R5 5.0.7A

Buffer overflows in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1310 IBM Denial of Service vulnerability in IBM Secureway Directory 3.2.1

IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, via invalid encodings for the L field of a BER encoding, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1309 IBM Denial of Service vulnerability in IBM Secureway Directory 3.2.1

Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1308 SUN Unspecified vulnerability in SUN Iplanet Directory Server

Format string vulnerabilities in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1307 SUN Buffer Overflow vulnerability in iPlanet Directory Server

Buffer overflows in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-1306 SUN Denial-Of-Service vulnerability in Iplanet Directory Server

iPlanet Directory Server 4.1.4 and earlier (LDAP) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid BER length of length fields, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-16 CVE-2001-0975 Oracle Buffer Overflow vulnerability in Oracle Internet Directory 2.1.1/3.0.1

Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite.

7.5
2001-07-21 CVE-2001-0349 Microsoft Privilege Escalation vulnerability in Microsoft Windows 2000 Telnet

Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the first of two variants of this vulnerability.

7.2
2001-07-21 CVE-2001-0344 Microsoft Unspecified vulnerability in Microsoft SQL Server 2000/7.0

An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.

7.2
2001-07-19 CVE-2001-1374 DON Libes
Conectiva
Redhat
expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd.
7.2
2001-07-19 CVE-2001-1360 Mostang Local Security vulnerability in Sane

Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.

7.2
2001-07-17 CVE-2001-1182 HP Local Security vulnerability in HP-Ux 10.20/11.00/11.11

Vulnerability in login in HP-UX 11.00, 11.11, and 10.20 allows restricted shell users to bypass certain security checks and gain privileges.

7.2
2001-07-17 CVE-2001-1179 Xfree86 Project Local Security vulnerability in Xfree86 Project X11R6 3.3.2

xman allows local users to gain privileges by modifying the MANPATH to point to a man page whose filename contains shell metacharacters.

7.2
2001-07-16 CVE-2001-1181 HP Local Security vulnerability in HP Hp-Ux 11.11

Dynamically Loadable Kernel Module (dlkm) static kernel symbol table in HP-UX 11.11 is not properly configured, which allows local users to gain privileges.

7.2

28 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-07-17 CVE-2001-1177 Samsung Unspecified vulnerability in Samsung Ml-85G GDI Printer Driver and Ml-85P Printer Driver

ml85p in Samsung ML-85G GDI printer driver before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

6.2
2001-07-22 CVE-2001-1010 Sambar Unspecified vulnerability in Sambar Server 4.4/5.0

Directory traversal vulnerability in pagecount CGI script in Sambar Server before 5.0 beta 5 allows remote attackers to overwrite arbitrary files via a ..

5.0
2001-07-21 CVE-2001-0518 Oracle Unspecified vulnerability in Oracle Oracle9I

Oracle listener before Oracle 9i allows attackers to cause a denial of service by repeatedly sending the first portion of a fragmented Oracle command without sending the remainder of the command, which causes the listener to hang.

5.0
2001-07-21 CVE-2001-0517 Oracle Unspecified vulnerability in Oracle Oracle8I 8.1.6/8.1.7

Oracle listener in Oracle 8i on Solaris allows remote attackers to cause a denial of service via a malformed connection packet with a maximum transport data size that is set to 0.

5.0
2001-07-21 CVE-2001-0516 Oracle Unspecified vulnerability in Oracle Oracle8I and Oracle9I

Oracle listener between Oracle 9i and Oracle 8.0 allows remote attackers to cause a denial of service via a malformed connection packet that contains an incorrect requester_version value that does not match an expected offset to the data.

5.0
2001-07-21 CVE-2001-0515 Oracle Unspecified vulnerability in Oracle Database Server and Oracle8I

Oracle Listener in Oracle 7.3 and 8i allows remote attackers to cause a denial of service via a malformed connection packet with a large offset_to_data value.

5.0
2001-07-21 CVE-2001-0513 Oracle Unspecified vulnerability in Oracle Oracle9I

Oracle listener process on Windows NT redirects connection requests to another port and creates a separate thread to process the request, which allows remote attackers to cause a denial of service by repeatedly connecting to the Oracle listener but not connecting to the redirected port.

5.0
2001-07-21 CVE-2001-0503 Microsoft Unspecified vulnerability in Microsoft Netmeeting 3.01

Microsoft NetMeeting 3.01 with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service via a malformed string to the NetMeeting service port, aka a variant of the "NetMeeting Desktop Sharing" vulnerability.

5.0
2001-07-21 CVE-2001-0498 Oracle Unspecified vulnerability in Oracle Oracle8I

Transparent Network Substrate (TNS) over Net8 (SQLNet) in Oracle 8i 8.1.7 and earlier allows remote attackers to cause a denial of service via a malformed SQLNet connection request with a large offset in the header extension.

5.0
2001-07-21 CVE-2001-0352 3Com
Symbol
SNMP agents in 3Com AirConnect AP-4111 and Symbol 41X1 Access Point allow remote attackers to obtain the WEP encryption key by reading it from a MIB when the value should be write-only, via (1) dot11WEPDefaultKeyValue in the dot11WEPDefaultKeysTable of the IEEE 802.11b MIB, or (2) ap128bWepKeyValue in the ap128bWEPKeyTable in the Symbol MIB.
5.0
2001-07-21 CVE-2001-0348 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Microsoft Windows 2000 telnet service allows attackers to cause a denial of service (crash) via a long logon command that contains a backspace.

5.0
2001-07-21 CVE-2001-0346 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Handle leak in Microsoft Windows 2000 telnet service allows attackers to cause a denial of service by starting a large number of sessions and terminating them.

5.0
2001-07-21 CVE-2001-0345 Microsoft Sessions DoS vulnerability in Microsoft Windows 2000 Telnet

Microsoft Windows 2000 telnet service allows attackers to prevent idle Telnet sessions from timing out, causing a denial of service by creating a large number of idle sessions.

5.0
2001-07-21 CVE-2001-0018 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Windows 2000 domain controller in Windows 2000 Server, Advanced Server, or Datacenter Server allows remote attackers to cause a denial of service via a flood of malformed service requests.

5.0
2001-07-19 CVE-2001-1366 Netscript Project Information Disclosure vulnerability in Netscript

netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information.

5.0
2001-07-18 CVE-2001-1373 Zonelabs Unspecified vulnerability in Zonelabs Zonealarm

MailSafe in Zone Labs ZoneAlarm 2.6 and earlier and ZoneAlarm Pro 2.6 and 2.4 does not block prohibited file types with long file names, which allows remote attackers to send potentially dangerous attachments.

5.0
2001-07-18 CVE-2001-1303 Checkpoint Unspecified vulnerability in Checkpoint Firewall-1 4.0/4.1

The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication.

5.0
2001-07-17 CVE-1999-1569 ID Software Denial of Service vulnerability in ID Software Quake 1.9

Quake 1 and NetQuake servers allow remote attackers to cause a denial of service (resource exhaustion or forced disconnection) via a flood of spoofed UDP connection packets, which exceeds the server's player limit.

5.0
2001-07-16 CVE-2001-1319 Microsoft Denial of Service vulnerability in Microsoft Exchange 5.5 LDAP

Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite.

5.0
2001-07-16 CVE-2001-0977 Mandrakesoft
Openldap
Debian
Redhat
Denial of Service vulnerability in OpenLDAP

slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field.

5.0
2001-07-21 CVE-2001-0502 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Running Windows 2000 LDAP Server over SSL, a function does not properly check the permissions of a user request when the directory principal is a domain user and the data attribute is the domain password, which allows local users to modify the login password of other users.

4.6
2001-07-21 CVE-2001-0501 Microsoft Unspecified vulnerability in Microsoft Word

Microsoft Word 2002 and earlier allows attackers to automatically execute macros without warning the user by embedding the macros in a manner that escapes detection by the security scanner.

4.6
2001-07-21 CVE-2001-0497 ISC Local Security vulnerability in BIND

dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG), which allows attackers to obtain the keys and perform dynamic DNS updates.

4.6
2001-07-21 CVE-2001-0350 Microsoft Local Security vulnerability in Windows 2000 Server

Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the second of two variants of this vulnerability.

4.6
2001-07-20 CVE-2001-1354 Netwin Weak Password Encryption vulnerability in Netwin NWAuth

NetWin Authentication module (NWAuth) 2.0 and 3.0b, as implemented in SurgeFTP, DMail, and possibly other packages, uses weak password hashing, which could allow local users to decrypt passwords or use a different password that has the same hash value as the correct password.

4.6
2001-07-19 CVE-2001-1375 Conectiva
Redhat
tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory.
4.6
2001-07-19 CVE-2001-1172 Omnisecure Local Security vulnerability in Omnisecure Httprotect 1.1.1

OmniSecure HTTProtect 1.1.1 allows a superuser without omnish privileges to modify a protected file by creating a symbolic link to that file.

4.6
2001-07-16 CVE-2001-1238 Microsoft Unspecified vulnerability in Microsoft Windows 2000 and Windows 2000 Terminal Services

Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Process tab which could allow local users to install Trojan horses that cannot be stopped with the Task Manager.

4.6

4 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-07-21 CVE-2001-1258 Horde Local 'prefs.lang' vulnerability in Horde IMP

Horde Internet Messaging Program (IMP) before 2.2.6 allows local users to read IMP configuration files and steal the Horde database password by placing the prefs.lang file containing PHP code on the server.

3.6
2001-07-21 CVE-2000-0892 U WIN
Caldera
Information Disclosure vulnerability in U Win

Some telnet clients allow remote telnet servers to request environment variables from the client that may contain sensitive information, or remote web servers to obtain the information via a telnet: URL.

2.6
2001-07-21 CVE-2001-0351 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Microsoft Windows 2000 telnet service allows a local user to make a certain system call that allows the user to terminate a Telnet session and cause a denial of service.

2.1
2001-07-18 CVE-2001-1302 Microsoft Unspecified vulnerability in Microsoft Windows 2000

The change password option in the Windows Security interface for Windows 2000 allows attackers to use the option to attempt to change passwords of other users on other systems or identify valid accounts by monitoring error messages, possibly due to a problem in the NetuserChangePassword function.

2.1