Weekly Vulnerabilities Reports > July 22 to 28, 2002

Overview

70 new vulnerabilities reported during this period, including 14 critical vulnerabilities and 29 high severity vulnerabilities. This weekly summary report vulnerabilities in 60 products from 48 vendors including Microsoft, Pingtel, RED M, SUN, and SGI. Vulnerabilities are notably categorized as .

  • 56 reported vulnerabilities are remotely exploitables.
  • 70 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 8 reported vulnerabilities.
  • RED M has the most reported critical vulnerabilities, with 4 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

14 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-07-26 CVE-2002-0702 ISC Remote Format String vulnerability in ISC DHCPD NSUPDATE

Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response.

10.0
2002-07-26 CVE-2002-0450 Talentsoft Buffer Overflow vulnerability in Talentsoft Web+ Server 4.6/5.0

Buffer overflow in Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long Web Markup Language (wml) file name to (1) webplus.dll or (2) webplus.exe.

10.0
2002-07-26 CVE-2002-0449 Talentsoft Buffer Overflow vulnerability in Talentsoft Web+ Server 4.6/5.0

Buffer overflow in webpsvc.exe for Talentsoft Web+ 5.0 and earlier allows remote attackers to execute arbitrary code via a long argument to webplus.exe program, which triggers the overflow in webpsvc.exe.

10.0
2002-07-26 CVE-2002-0437 Stefan Frings Unspecified vulnerability in Stefan Frings SMS Server Tools 1.4.6/1.4.7

Smsd in SMS Server Tools (SMStools) before 1.4.8 allows remote attackers to execute arbitrary commands via shell metacharacters (backquotes) in message text, as described with the term "string format vulnerability" by some sources.

10.0
2002-07-26 CVE-2002-0436 SUN Unspecified vulnerability in SUN Solaris and Sunos

sscd_suncourier.pl CGI script in the Sun Sunsolve CD pack allows remote attackers to execute arbitrary commands via shell metacharacters in the email address parameter.

10.0
2002-07-26 CVE-2002-0434 Marcus S Xenakis Unspecified vulnerability in Marcus S. Xenakis Directory.PHP

Marcus S.

10.0
2002-07-26 CVE-2002-0432 Citadel Buffer Overflow vulnerability in Citadel UX 5.90

Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.

10.0
2002-07-26 CVE-2002-0405 Transsoft Denial of Service vulnerability in Transsoft Broker FTP Server 5.0

Buffer overflow in Transsoft Broker FTP Server 5.0 evaluation allows remote attackers to cause a denial of service and possibly execute arbitrary code via a CWD command with a large number of .

10.0
2002-07-26 CVE-2002-0398 RED M Denial of Service vulnerability in Red-M 1050AP LAN Access Point PPP

Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.

10.0
2002-07-26 CVE-2002-0395 RED M Remote Security vulnerability in 1050Ap Lan Acess Point

The TFTP server for Red-M 1050 (Bluetooth Access Point) can not be disabled and makes it easier for remote attackers to crack the administration password via brute force methods.

10.0
2002-07-26 CVE-2002-0394 RED M Remote Security vulnerability in 1050Ap Lan Acess Point

Red-M 1050 (Bluetooth Access Point) uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords.

10.0
2002-07-26 CVE-2002-0393 RED M Denial of Service vulnerability in Red-M 1050AP Lan Access Point Web Administration Interface

Buffer overflow in Red-M 1050 (Bluetooth Access Point) management web interface allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long administration password.

10.0
2002-07-26 CVE-2002-0369 Microsoft Buffer Overflow vulnerability in Microsoft .Net Framework 1.0

Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.

10.0
2002-07-23 CVE-2002-0667 Pingtel Unspecified vulnerability in Pingtel Xpressa 1.2.5/1.2.7.4

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone.

10.0

29 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-07-26 CVE-2002-0717 PHP Denial-Of-Service vulnerability in PHP 4.2.0/4.2.1

PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed.

7.5
2002-07-26 CVE-2002-0714 Squid Unspecified vulnerability in Squid

FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses.

7.5
2002-07-26 CVE-2002-0713 Squid Buffer Overflow vulnerability in Squid MSNT Auth Helper

Buffer overflows in Squid before 2.4.STABLE6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (1) via the MSNT auth helper (msnt_auth) when using denyusers or allowusers files, (2) via the gopher client, or (3) via the FTP server directory listing parser when HTML output is generated.

7.5
2002-07-26 CVE-2002-0703 Gisle AAS Unspecified vulnerability in Gisle AAS Digest-Md5

An interaction between the Perl MD5 module (perl-Digest-MD5) and Perl could produce incorrect MD5 checksums for UTF-8 data, which could prevent a system from properly verifying the integrity of the data.

7.5
2002-07-26 CVE-2002-0663 Symantec Buffer Overflow vulnerability in Symantec Norton Personal Firewall/Internet Security 2001

Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large outgoing HTTP request.

7.5
2002-07-26 CVE-2002-0444 Microsoft Unspecified vulnerability in Microsoft Windows 2000 Terminal Services

Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g.

7.5
2002-07-26 CVE-2002-0440 Trend Micro Unspecified vulnerability in Trend Micro Interscan Viruswall 3.51/3.6

Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.

7.5
2002-07-26 CVE-2002-0439 Caupo NET Unspecified vulnerability in Caupo.Net Cauposhop

Cross-site scripting vulnerability in CaupoShop 1.30a and earlier, and possibly CaupoShopPro, allows remote attackers to execute arbitrary Javascript and steal credit card numbers or delete items by injecting the script into new customer information fields such as the message field.

7.5
2002-07-26 CVE-2002-0396 RED M Unspecified vulnerability in Red-M 1050Ap LAN Acess Point

The web management server for Red-M 1050 (Bluetooth Access Point) does not use session-based credentials to authenticate users, which allows attackers to connect to the server from the same IP address as a user who has already established a session.

7.5
2002-07-26 CVE-2002-0032 Yahoo Unspecified vulnerability in Yahoo Messenger 5.0

Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.

7.5
2002-07-26 CVE-2002-0014 University OF Washington Unspecified vulnerability in University of Washington Pine

URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).

7.5
2002-07-23 CVE-2002-1599 Daniel Barron Unspecified vulnerability in Daniel Barron Dansguardian

DansGuardian before 2.4.5-1 allows remote attackers to bypass content filtering rules via hex-encoded URLs.

7.5
2002-07-23 CVE-2002-0688 Zope Remote Method vulnerability in Zope 2.4.0/2.5.1

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.

7.5
2002-07-23 CVE-2002-0686 Iplanet Buffer Overflow vulnerability in Iplanet web Server 4.1/6.0

Buffer overflow in the search component for iPlanet Web Server (iWS) 4.1 and Sun ONE Web Server 6.0 allows remote attackers to execute arbitrary code via a long argument to the NS-rel-doc-name parameter.

7.5
2002-07-23 CVE-2002-0685 PGP Unspecified vulnerability in PGP Desktop Security, Freeware and Personal Security

Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0.4, Personal Security 7.0.3, and Freeware 7.0.3, allows remote attackers to modify the heap and gain privileges via a large, malformed mail message.

7.5
2002-07-23 CVE-2002-0683 Pacific Software Remote Command Execution vulnerability in Pacific Software Carello 1.3

Directory traversal vulnerability in Carello 1.3 allows remote attackers to execute programs on the server via a ..

7.5
2002-07-23 CVE-2002-0682 Apache Cross-Site Scripting vulnerability in Apache Tomcat 4.0.3

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

7.5
2002-07-23 CVE-2002-0681 Goahead Software Cross-Site Scripting vulnerability in GoAhead WebServer Error Page

Cross-site scripting vulnerability in GoAhead Web Server 2.1 allows remote attackers to execute script as other web users via script in a URL that generates a "404 not found" message, which does not quote the script.

7.5
2002-07-23 CVE-2002-0677 Caldera
XI Graphics
SGI
Compaq
HP
IBM
SUN
CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTH_UNIX procedure call, which is used as a table index by the _TT_ISCLOSE procedure.
7.5
2002-07-23 CVE-2002-0671 Pingtel Unspecified vulnerability in Pingtel Xpressa 1.2.5/1.2.7.4

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing.

7.5
2002-07-23 CVE-2002-0670 Pingtel Remote Security vulnerability in Xpressa 1.2.5/1.2.7.4

The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows remote attackers to steal and easily decode the passwords via sniffing.

7.5
2002-07-23 CVE-2002-0668 Pingtel Remote Security vulnerability in Xpressa 1.2.5/1.2.7.4

The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls.

7.5
2002-07-23 CVE-2002-0641 Microsoft Buffer Overflow vulnerability in Microsoft Msde and SQL Server

Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.

7.5
2002-07-23 CVE-2002-0624 Microsoft Unspecified vulnerability in Microsoft Msde and SQL Server

Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain control of the database and execute arbitrary code via SQL Server Authentication, aka "Unchecked Buffer in Password Encryption Procedure."

7.5
2002-07-26 CVE-2002-0716 SCO Unspecified vulnerability in SCO Openserver 5.0.5/5.0.6

Format string vulnerability in crontab for SCO OpenServer 5.0.5 and 5.0.6 allows local users to gain privileges via format string specifiers in the file name argument.

7.2
2002-07-26 CVE-2002-0442 Caldera Local Buffer Overflow vulnerability in Caldera OpenServer dlv_audit

Buffer overflow in dlvr_audit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.

7.2
2002-07-23 CVE-2002-0678 Caldera
XI Graphics
SGI
Compaq
HP
IBM
SUN
Symbolic Link vulnerability in Multiple Vendor CDE ToolTalk Database Server

CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the _TT_TRANSACTION RPC procedure.

7.2
2002-07-23 CVE-2002-0674 Pingtel Unspecified vulnerability in Pingtel Xpressa 1.2.5/1.2.7.4

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator session, which could allow other users to perform administrator actions if the administrator does not explicitly end the authentication.

7.2
2002-07-23 CVE-2002-0642 Microsoft Unspecified vulnerability in Microsoft Msde and SQL Server

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key."

7.2

25 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-07-26 CVE-2002-0715 Squid Information Disclosure vulnerability in Squid Proxy Authentication Credential Forwarding

Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password.

5.0
2002-07-26 CVE-2002-0704 Linux Unspecified vulnerability in Linux Kernel

The Network Address Translation (NAT) capability for Netfilter ("iptables") 1.2.6a and earlier leaks translated IP addresses in ICMP error messages.

5.0
2002-07-26 CVE-2002-0448 Xerver Request Denial Of Service vulnerability in Xerver

Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many "C:/" sequences.

5.0
2002-07-26 CVE-2002-0447 Xerver Directory Traversal vulnerability in Xerver

Directory traversal vulnerability in Xerver Free Web Server 2.10 and earlier allows remote attackers to list arbitrary directories via a ..

5.0
2002-07-26 CVE-2002-0446 Black TIE Project Path Disclosure vulnerability in Black TIE Project Black TIE Project 0.4B/0.5/0.5B

categorie.php3 in Black Tie Project (BTP) 0.4b through 0.5b allows remote attackers to determine the absolute path of the web server via an invalid category ID (cid) parameter, which leaks the pathname in an error message.

5.0
2002-07-26 CVE-2002-0445 PHP Firstpost Path Disclosure vulnerability in PHP Firstpost PHP Firstpost 0.1

article.php in PHP FirstPost 0.1 allows allows remote attackers to obtain the full pathname of the server via an invalid post number in the post parameter, which leaks the pathname in an error message.

5.0
2002-07-26 CVE-2002-0441 Jerrett Taylor Directory Traversal vulnerability in Jerrett Taylor PHP Imglist 1.1/1.2/1.2.1

Directory traversal vulnerability in imlist.php for Php Imglist allows remote attackers to read arbitrary code via a ..

5.0
2002-07-26 CVE-2002-0438 Zyxel Denial Of Service vulnerability in Zyxel Zywall10

ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address, which causes the firewall to disable the LAN interface.

5.0
2002-07-26 CVE-2002-0433 PI3 Remote Security vulnerability in PI3 Pi3Web 2.0.0

Pi3Web 2.0.0 allows remote attackers to view restricted files via an HTTP request containing a "*" (wildcard or asterisk) character.

5.0
2002-07-26 CVE-2002-0431 Dave Lawrence Denial of Service vulnerability in Dave Lawrence Xtux 20010601

XTux allows remote attackers to cause a denial of service (CPU consumption) via random inputs in the initial connection.

5.0
2002-07-26 CVE-2002-0410 Aeromail Unspecified vulnerability in Aeromail

send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.

5.0
2002-07-26 CVE-2002-0409 Microsoft Remote Security vulnerability in Microsoft .Net Framework 1.0

orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.

5.0
2002-07-26 CVE-2002-0408 Lotus Information Disclosure vulnerability in Lotus Domino Banner

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message.

5.0
2002-07-26 CVE-2002-0407 Lotus Path Disclosure vulnerability in Lotus Domino MS-DOS Device

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as (1) a request with a .pl or .java extension, or (2) a request containing a large number of periods, which causes htcgibin.exe to leak the pathname in an error message.

5.0
2002-07-26 CVE-2002-0406 Menasoft Denial of Service vulnerability in Menasoft Sphereserver 0.99F/0.99I

Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials, which prevents other users from being able to log in.

5.0
2002-07-26 CVE-2002-0397 RED M Information Disclosure vulnerability in 1050Ap Lan Acess Point

Red-M 1050 (Bluetooth Access Point) publicizes its name, IP address, and other information in UDP packets to a broadcast address, which allows any system on the network to obtain potentially sensitive information about the Access Point device by monitoring UDP port 8887.

5.0
2002-07-23 CVE-2002-0687 Zope Remote Denial Of Service vulnerability in Zope 2.5.1

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.

5.0
2002-07-23 CVE-2002-0680 Goahead Software
Orange Software
Montavista Software
Directory Traversal vulnerability in GoAhead WebServer

Directory traversal vulnerability in GoAhead Web Server 2.1 allows remote attackers to read arbitrary files via a URL with an encoded / (%5C) in a ..

5.0
2002-07-26 CVE-2002-0443 Microsoft Unspecified vulnerability in Microsoft Windows 2000

Microsoft Windows 2000 allows local users to bypass the policy that prohibits reusing old passwords by changing the current password before it expires, which does not enable the check for previous passwords.

4.6
2002-07-26 CVE-2002-0358 SGI Unspecified vulnerability in SGI Mediamail

MediaMail and MediaMail Pro in SGI IRIX 6.5.16 and earlier allows local users to force the program to dump core via certain arguments, which could allow the users to read sensitive data or gain privileges.

4.6
2002-07-26 CVE-2002-0031 Yahoo Buffer Overflow vulnerability in Yahoo Messenger 5.0

Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call, (2) sendim, (3) getimv, (4) chat, (5) addview, or (6) addfriend.

4.6
2002-07-23 CVE-2002-0675 Pingtel Unspecified vulnerability in Pingtel Xpressa 1.2.5/1.2.7.4

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unauthorized users to upgrade the phone.

4.6
2002-07-23 CVE-2002-0673 Pingtel Cross-Site Request Forgery vulnerability in Xpressa 1.2.5/1.2.7.4

The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out the current user and re-register the phone using MyPingtel Sign-In to gain remote access and perform unauthorized actions.

4.6
2002-07-23 CVE-2002-0672 Pingtel Local Security vulnerability in Xpressa 1.2.5/1.2.7.4

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to restore the phone to factory defaults without authentication via a menu option, which sets the administrator password to null.

4.6
2002-07-23 CVE-2002-0643 Microsoft Unspecified vulnerability in Microsoft Data Engine and SQL Server

The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."

4.6

2 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-07-23 CVE-2002-0701 Freebsd
Openbsd
ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
2.1
2002-07-26 CVE-2002-0435 GNU Unspecified vulnerability in GNU Fileutils 4.0/4.1/4.1.6

Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted, which causes fileutils to chdir to a ".." directory that is higher than expected, possibly up to the root file system.

1.2