Weekly Vulnerabilities Reports > September 2 to 8, 2002
Overview
24 new vulnerabilities reported during this period, including 2 critical vulnerabilities and 12 high severity vulnerabilities. This weekly summary report vulnerabilities in 30 products from 18 vendors including Microsoft, Cisco, Oracle, HP, and SGI. Vulnerabilities are notably categorized as .
- 17 reported vulnerabilities are remotely exploitables.
- 24 reported vulnerabilities are exploitable by an anonymous user.
- Microsoft has the most reported vulnerabilities, with 4 reported vulnerabilities.
- Microsoft has the most reported critical vulnerabilities, with 1 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
2 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2002-09-05 | CVE-2002-0721 | Microsoft | Unspecified vulnerability in Microsoft Data Engine and SQL Server Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt. | 10.0 |
2002-09-05 | CVE-2002-0679 | Caldera XI Graphics Compaq HP IBM SUN | Buffer overflow in Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) allows remote attackers to execute arbitrary code via an argument to the _TT_CREATE_FILE procedure. | 10.0 |
12 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2002-09-05 | CVE-2002-0872 | L2Tpd | Unspecified vulnerability in L2Tpd l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions. | 7.5 |
2002-09-05 | CVE-2002-0870 | Cisco | Remote Security vulnerability in CSS11000 Content Services Switch The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete, which still allows remote attackers to gain additional privileges by directly requesting the web management URL instead of navigating through the interface, possibly via a variant of the original attack, as identified by Cisco bug ID CSCdw08549. | 7.5 |
2002-09-05 | CVE-2002-0859 | Microsoft | Buffer Overflow vulnerability in Microsoft JET and SQL Server Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code. | 7.5 |
2002-09-05 | CVE-2002-0858 | Oracle | Remote Security vulnerability in Oracle9i Developer Edition catsnmp in Oracle 9i and 8i is installed with a dbsnmp user with a default dbsnmp password, which allows attackers to perform restricted database operations and possibly gain other privileges. | 7.5 |
2002-09-05 | CVE-2002-0857 | Oracle | Unspecified vulnerability in Oracle Database Server and Oracle8I Format string vulnerabilities in Oracle Listener Control utility (lsnrctl) for Oracle 9.2 and 9.0, 8.1, and 7.3.4, allow remote attackers to execute arbitrary code on the Oracle DBA system by placing format strings into certain entries in the listener.ora configuration file. | 7.5 |
2002-09-05 | CVE-2002-0855 | GNU | Cross-Site Scripting vulnerability in GNU Mailman 2.0.12 Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature. | 7.5 |
2002-09-02 | CVE-2002-1605 | HP | Unspecified vulnerability in HP Hp-Ux and Tru64 Buffer overflow in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows attackers to execute arbitrary code via a long _XKB_CHARSET environment variable to (1) dxpause, (2) dxconsole, or (3) dtsession. | 7.5 |
2002-09-02 | CVE-2002-1604 | HP | Local Buffer Overflow vulnerability in HP Tru64 NLSPATH Environment Variable Multiple buffer overflows in HP Tru64 UNIX allow local and possibly remote attackers to execute arbitrary code via a long NLSPATH environment variable to (1) csh, (2) dtsession, (3) dxsysinfo, (4) imapd, (5) inc, (6) uucp, (7) uux, (8) rdist, or (9) deliver. | 7.5 |
2002-09-05 | CVE-2002-0854 | Suse | Local Security vulnerability in Linux 7.3/8.0 Buffer overflows in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the i4l package on SuSE 7.3, 8.0, and possibly other operating systems, may allow local users to gain privileges. | 7.2 |
2002-09-05 | CVE-2002-0851 | Isdn4Linux | Unspecified vulnerability in Isdn4Linux 3.1Pre1 Format string vulnerability in ISDN Point to Point Protocol (PPP) daemon (ipppd) in the ISDN4Linux (i4l) package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog. | 7.2 |
2002-09-05 | CVE-2002-0720 | Microsoft | Unspecified vulnerability in Microsoft Windows 2000 and Windows 2000 Terminal Services A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code. | 7.2 |
2002-09-05 | CVE-2002-0093 | Compaq | Buffer Overflow vulnerability in Tru64 IPCS Buffer overflow in ipcs for HP Tru64 UNIX 4.0f through 5.1a may allow attackers to execute arbitrary code, a different vulnerability than CVE-2001-0423. | 7.2 |
8 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2002-09-05 | CVE-2002-0874 | Redhat | Denial-Of-Service vulnerability in Interchange Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files. | 5.0 |
2002-09-05 | CVE-2002-0873 | L2Tpd | Remote Security vulnerability in l2tpd Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attribute/value pair, possibly via a buffer overflow. | 5.0 |
2002-09-05 | CVE-2002-0856 | Oracle | Denial Of Service vulnerability in Oracle Listener Malformed Debugging Command SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature. | 5.0 |
2002-09-05 | CVE-2002-0853 | Cisco | Denial Of Service vulnerability in Cisco VPN Client Zero Length IKE Packet Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a zero-length payload. | 5.0 |
2002-09-05 | CVE-2002-0852 | Cisco | Denial-Of-Service vulnerability in VPN Client for Linux Buffer overflows in Cisco Virtual Private Network (VPN) Client 3.5.4 and earlier allows remote attackers to cause a denial of service via (1) an Internet Key Exchange (IKE) with a large Security Parameter Index (SPI) payload, or (2) an IKE packet with a large number of valid payloads. | 5.0 |
2002-09-05 | CVE-2002-0654 | Apache | Unspecified vulnerability in Apache Http Server Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked. | 5.0 |
2002-09-05 | CVE-2002-0632 | SGI | Unspecified vulnerability in SGI Irix Vulnerability in SGI BDS (Bulk Data Service) BDSPro 2.4 and earlier allows clients to read arbitrary files on a BDS server. | 5.0 |
2002-09-05 | CVE-2002-0725 | Microsoft | Unspecified vulnerability in Microsoft Windows 2000 and Windows 2000 Terminal Services NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file. | 4.6 |
2 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2002-09-05 | CVE-2002-0875 | SGI Debian | Vulnerability in FAM 2.6.8, 2.6.6, and other versions allows unprivileged users to obtain the names of files whose access is restricted to the root group. | 2.1 |
2002-09-05 | CVE-2002-0871 | Xinetd | Denial Of Service vulnerability in Xinetd Open File Descriptor xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe. | 2.1 |