Weekly Vulnerabilities Reports > July 30 to August 5, 2001

Overview

35 new vulnerabilities reported during this period, including 2 critical vulnerabilities and 8 high severity vulnerabilities. This weekly summary report vulnerabilities in 31 products from 27 vendors including Lotus, Microsoft, Suse, SUN, and Phpbb Group. Vulnerabilities are notably categorized as .

  • 21 reported vulnerabilities are remotely exploitables.
  • 35 reported vulnerabilities are exploitable by an anonymous user.
  • Lotus has the most reported vulnerabilities, with 5 reported vulnerabilities.
  • Netwin has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

2 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-08-04 CVE-2001-1356 Netwin Weak Password Encryption vulnerability in SurgeFTP

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allows remote attackers to conduct brute force password guessing attacks against the administrator account on port 7021.

10.0
2001-08-02 CVE-2001-0609 Infodrom Unspecified vulnerability in Infodrom Cfingerd 1.4.0/1.4.1/1.4.2

Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog function.

10.0

8 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-08-02 CVE-2001-1130 Suse Unspecified vulnerability in Suse Linux

Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a ..

7.5
2001-08-02 CVE-2001-1118 Roxen Remote File Access vulnerability in Roxen

A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.

7.5
2001-08-02 CVE-2001-0619 Lucent Remote Security vulnerability in ORiNOCO

The Lucent Closed Network protocol can allow remote attackers to join Closed Network networks which they do not have access to.

7.5
2001-08-02 CVE-2001-0618 Lucent Remote Security vulnerability in Orinoco Rg-1000

Orinoco RG-1000 wireless Residential Gateway uses the last 5 digits of the 'Network Name' or SSID as the default Wired Equivalent Privacy (WEP) encryption key.

7.5
2001-08-02 CVE-2001-0596 Netscape Information Disclosure vulnerability in Netscape Navigator 'about:' Domain

Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript.

7.5
2001-07-31 CVE-2001-1060 Phpmyadmin Unspecified vulnerability in PHPmyadmin

phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php.

7.5
2001-07-30 CVE-2001-1056 Linux Unspecified vulnerability in Linux Kernel

IRC DCC helper in the ip_masq_irc IP masquerading module 2.2 allows remote attackers to bypass intended firewall restrictions by causing the target system to send a "DCC SEND" request to a malicious server which listens on port 6667, which may cause the module to believe that the traffic is a valid request and allow the connection to the port specified in the DCC SEND request.

7.5
2001-08-02 CVE-2001-0597 Zetetic Enterprises Unspecified vulnerability in Zetetic Enterprises Strip 0.3/0.4

Zetetic Secure Tool for Recalling Important Passwords (STRIP) 0.5 and earlier for the PalmOS allows a local attacker to recover passwords via a brute force attack.

7.2

21 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-08-03 CVE-2001-1119 TI KAN Symbolic Link vulnerability in TI KAN Xmcd 2.6.0/3.0.0/3.0.1

cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack.

6.2
2001-08-03 CVE-2001-1304 Nullsoft Denial-Of-Service vulnerability in Nullsoft Shoutcast Server 1.8.2

Buffer overflow in SHOUTcast Server 1.8.2 allows remote attackers to cause a denial of service (crash) via several HTTP requests with a long (1) user-agent or (2) host HTTP header.

5.0
2001-08-02 CVE-2001-0604 Lotus Denial-Of-Service vulnerability in Domino R5 Server

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via URL requests (>8Kb) containing a large number of '/' characters.

5.0
2001-08-02 CVE-2001-0603 Lotus Denial-Of-Service vulnerability in Domino R5 Server

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeatedly sending large (> 10Kb) amounts of data to the DIIOP - CORBA service on TCP port 63148.

5.0
2001-08-02 CVE-2001-0602 Lotus Denial-Of-Service vulnerability in Domino R5 Server

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeated (>400) URL requests for DOS devices.

5.0
2001-08-02 CVE-2001-0601 Lotus Denial-Of-Service vulnerability in Domino R5 Server

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters.

5.0
2001-08-02 CVE-2001-0600 Lotus Denial-Of-Service vulnerability in Domino R5 Server

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via repeated URL requests with the same HTTP headers, such as (1) Accept, (2) Accept-Charset, (3) Accept-Encoding, (4) Accept-Language, and (5) Content-Type.

5.0
2001-08-02 CVE-2001-0599 Sybase Buffer Overflow vulnerability in Sybase Adaptive Server Anywhere 6.0.3.2747

Sybase Adaptive Server Anywhere Database Engine 6.0.3.2747 and earlier as included with Symantec Ghost 6.5 allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to port 2638.

5.0
2001-08-02 CVE-2001-0598 Symantec Unspecified vulnerability in Symantec Norton Ghost

Symantec Ghost 6.5 and earlier allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to the Ghost Configuration Server on port 1347, which triggers an error that is not properly handled.

5.0
2001-08-02 CVE-2001-0592 Watchguard Denial-Of-Service vulnerability in Firebox Ii

Watchguard Firebox II prior to 4.6 allows a remote attacker to create a denial of service in the kernel via a large stream (>10,000) of malformed ICMP or TCP packets.

5.0
2001-08-02 CVE-2001-0590 Apache Unspecified vulnerability in Apache Tomcat

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e.

5.0
2001-07-30 CVE-2001-1057 Wolfram Research Denial Of Service vulnerability in Mathematica License Manager Connected Port

The License Manager (mathlm) for Mathematica 4.0 and 4.1 allows remote attackers to cause a denial of service (resource exhaustion) by connecting to port 16286 and not disconnecting, which prevents users from making license requests.

5.0
2001-07-30 CVE-2001-1055 Microsoft Denial of Service vulnerability in Windows ARP

The Microsoft Windows network stack allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed ARP request packets with random source IP and MAC addresses, as demonstrated by ARPNuke.

5.0
2001-08-03 CVE-2001-1472 Phpbb Group Remote SQL Query Manipulation vulnerability in PHPbb Group PHPbb 1.4.0/1.4.1

SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.

4.6
2001-08-02 CVE-2001-1116 Identix Authentication Bypass vulnerability in Identix BioLogon Client Biometric

Identix BioLogon 2.03 and earlier does not lock secondary displays on a multi-monitor system running Windows 98 or ME, which allows an attacker with physical access to the system to bypass authentication through a secondary display.

4.6
2001-08-02 CVE-2001-0623 Sendfile Local Security vulnerability in Sendfile

sendfiled, as included with Simple Asynchronous File Transfer (SAFT), on various Linux systems does not properly drop privileges when sending notification emails, which allows local attackers to gain privileges.

4.6
2001-08-02 CVE-2001-0610 KDE
Suse
Local Security vulnerability in Linux

kfm as included with KDE 1.x can allow a local attacker to gain additional privileges via a symlink attack in the kfm cache directory in /tmp.

4.6
2001-08-02 CVE-2001-0595 SUN Buffer Overflow vulnerability in SUN Sunos 5.7/5.8

Buffer overflow in the kcsSUNWIOsolf.so library in Solaris 7 and 8 allows local attackers to execute arbitrary commands via the KCMS_PROFILES environment variable, e.g.

4.6
2001-08-02 CVE-2001-0594 SUN Buffer Overflow vulnerability in SUN Solaris and Sunos

kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument.

4.6
2001-08-02 CVE-2001-0573 IBM Unspecified vulnerability in IBM AIX 4

lsfs in AIX 4.x allows a local user to gain additional privileges by creating Trojan horse programs named (1) grep or (2) lslv in a certain directory that is under the user's control, which cause lsfs to access the programs in that directory.

4.6
2001-07-31 CVE-2001-1471 Phpbb Group Remote Arbitrary Command Execution vulnerability in phpBB Page Header

prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.

4.6

4 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2001-07-30 CVE-2001-1059 Vmware Unspecified vulnerability in VMWare Workstation 2.0

VMWare creates a temporary file vmware-log.USERNAME with insecure permissions, which allows local users to read or modify license information.

3.6
2001-08-03 CVE-2001-1122 Microsoft Unspecified vulnerability in Microsoft Windows NT 4.0

Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in 'SPECIAL' mode.

2.1
2001-08-02 CVE-2001-0624 QNX Denial-Of-Service vulnerability in QNX 2.4

QNX 2.4 allows a local user to read arbitrary files by directly accessing the mount point for the FAT disk partition, e.g.

2.1
2001-08-02 CVE-2001-0620 Iplanet Local Security vulnerability in Calendar Server

iPlanet Calendar Server 5.0p2 and earlier allows a local attacker to gain access to the Netscape Admin Server (NAS) LDAP database and read arbitrary files by obtaining the cleartext administrator username and password from the configuration file, which has insecure permissions.

2.1