Weekly Vulnerabilities Reports > December 15 to 21, 2003

Overview

43 new vulnerabilities reported during this period, including 2 critical vulnerabilities and 23 high severity vulnerabilities. This weekly summary report vulnerabilities in 51 products from 34 vendors including SAP, GNU, Microsoft, HP, and Quagga. Vulnerabilities are notably categorized as "Resource Management Errors", and "Improper Input Validation".

  • 31 reported vulnerabilities are remotely exploitables.
  • 43 reported vulnerabilities are exploitable by an anonymous user.
  • SAP has the most reported vulnerabilities, with 8 reported vulnerabilities.
  • GNU has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

2 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2003-12-15 CVE-2003-0972 GNU Unspecified vulnerability in GNU Screen

Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.

10.0
2003-12-15 CVE-2003-0968 Freeradius Remote Security vulnerability in FreeRADIUS

Stack-based buffer overflow in SMB_Logon_Server of the rlm_smb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute.

10.0

23 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2003-12-15 CVE-2003-0976 Novell Remote Security vulnerability in Novell Netware 6.5

NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not properly enforce sys:\etc\exports when hostname aliases from sys:etc\hosts file are used, which could allow users to mount file systems when XNFS should deny the host.

7.5
2003-12-15 CVE-2003-0974 Applied Watch Technologies Authentication Bypass vulnerability in Applied Watch Technologies Applied Watch Command Center 1.0

Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as (1) add new users to a console, as demonstrated using appliedsnatch.c, or (2) add spurious IDS rules to sensors, as demonstrated using addrule.c.

7.5
2003-12-15 CVE-2003-0962 Andrew Tridgell
Redhat
Engardelinux
Slackware
Remote Heap Overflow vulnerability in RSync Daemon Mode Undisclosed

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

7.5
2003-12-15 CVE-2003-0960 Openca Unspecified vulnerability in Openca

OpenCA before 0.9.1.4 does not use the correct certificate in a chain to check the serial, which could cause OpenCA to accept revoked or expired certificates.

7.5
2003-12-15 CVE-2003-0951 HP Remote Security vulnerability in HP Hp-Ux 11.23

Partition Manager (parmgr) in HP-UX B.11.23 does not properly validate certificates that are provided by the cimserver, which allows attackers to obtain sensitive data or gain privileges.

7.5
2003-12-15 CVE-2003-0950 Peoplesoft Unspecified vulnerability in Peoplesoft Peopletools

PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file.

7.5
2003-12-15 CVE-2003-0946 Clam Anti Virus Denial-Of-Service vulnerability in Clam Anti-Virus Clamav 0.60/0.60P

Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before 0.65, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the email address argument of a "MAIL FROM" command.

7.5
2003-12-15 CVE-2003-0945 SAP Remote Security vulnerability in Sap Db

The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities.

7.5
2003-12-15 CVE-2003-0944 SAP Remote Security vulnerability in Sap Db

Buffer overflow in the WAECHO default service in web-tools in SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a URL with a long requestURI.

7.5
2003-12-15 CVE-2003-0943 SAP Information Disclosure vulnerability in Sap Db

web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via (1) waecho, (2) Web SQL Interface (websql), or (3) Web Database Manager (webdbm).

7.5
2003-12-15 CVE-2003-0942 SAP Remote Security vulnerability in Sap Db

Buffer overflow in Web Agent Administration service in web-tools for SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a long Name parameter to waadmin.wa.

7.5
2003-12-15 CVE-2003-0941 SAP Remote Security vulnerability in Sap Db

web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.

7.5
2003-12-15 CVE-2003-0939 SAP Remote Security vulnerability in Sap Db

eo420_GetStringFromVarPart in veo420.c for SAP database server (SAP DB) 7.4.03.27 and earlier may allow remote attackers to execute arbitrary code via a connect packet with a 256 byte segment to the niserver (aka serv.exe) process on TCP port 7269, which prevents the server from NULL terminating the string and leads to a buffer overflow.

7.5
2003-12-15 CVE-2003-0822 Microsoft Unspecified vulnerability in Microsoft products

Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.

7.5
2003-12-15 CVE-2003-0821 Microsoft Unspecified vulnerability in Microsoft Word and Works

Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.

7.5
2003-12-15 CVE-2003-0820 Microsoft Buffer Overflow vulnerability in Microsoft Word and Works

Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.

7.5
2003-12-15 CVE-2003-0812 Microsoft Remote Buffer Overflow vulnerability in Microsoft Windows 2000 and Windows XP

Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API.

7.5
2003-12-15 CVE-2003-0961 Linux Unspecified vulnerability in Linux Kernel

Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privileges.

7.2
2003-12-15 CVE-2003-0948 Wireless Tools Local ARGV Command Line Buffer Overflow vulnerability in IWConfig

Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable.

7.2
2003-12-15 CVE-2003-0947 Wireless Tools Local Security vulnerability in iwconfig

Buffer overflow in iwconfig, when installed setuid, allows local users to execute arbitrary code via a long OUT environment variable.

7.2
2003-12-15 CVE-2003-0938 SAP Local Security vulnerability in Sap Db

vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.

7.2
2003-12-15 CVE-2003-0936 Symantec Unspecified vulnerability in Symantec Pcanywhere 10.0/10.5/11.0

Symantec PCAnywhere 10.x and 11, when started as a service, allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe.

7.2
2003-12-15 CVE-2003-0089 HP Local Buffer Overrun vulnerability in HP-UX Software Distributor Lang Environment Variable

Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.

7.2

17 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2003-12-15 CVE-2003-0975 Apple Unspecified vulnerability in Apple mac OS X, mac OS X Server and Safari

Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.

5.0
2003-12-15 CVE-2003-0973 Apache Unspecified vulnerability in Apache MOD Python

Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.

5.0
2003-12-15 CVE-2003-0971 GNU Unspecified vulnerability in GNU Privacy Guard

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.

5.0
2003-12-15 CVE-2003-0970 SUN Denial-Of-Service vulnerability in SUN Fire B1600

The Network Management Port on Sun Fire B1600 systems allows remote attackers to cause a denial of service (packet loss) via ARP packets, which cause all ports to become temporarily disabled.

5.0
2003-12-15 CVE-2003-0967 Freeradius Unspecified vulnerability in Freeradius

rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.

5.0
2003-12-15 CVE-2003-0940 SAP Directory Traversal vulnerability in Sap Db

Directory traversal vulnerability in sqlfopenc for web-tools in SAP DB before 7.4.03.30 allows remote attackers to read arbitrary files via ..

5.0
2003-12-15 CVE-2003-0824 Microsoft Unspecified vulnerability in Microsoft products

Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.

5.0
2003-12-15 CVE-2003-0795 GNU
Quagga
SGI
Improper Input Validation vulnerability in multiple products

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

5.0
2003-12-15 CVE-2003-0628 Peoplesoft Unspecified vulnerability in Peoplesoft Peopletools

PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value.

5.0
2003-12-15 CVE-2003-0327 Sybase Unspecified vulnerability in Sybase Adaptive Server Enterprise 12.5

Sybase Adaptive Server Enterprise (ASE) 12.5 allows remote attackers to cause a denial of service (hang) via a remote password array with an invalid length, which triggers a heap-based buffer overflow.

5.0
2003-12-15 CVE-2003-0859 GNU
Quagga
SGI
Redhat
Intel
The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
4.9
2003-12-15 CVE-2003-0856 Stephen Hemminger Unspecified vulnerability in Stephen Hemminger Iproute

iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface.

4.9
2003-12-15 CVE-2003-0955 Openbsd Local Malformed Binary Execution Denial of Service vulnerability in Openbsd 3.3/3.4

OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow.

4.6
2003-12-15 CVE-2003-0937 SCO Unspecified vulnerability in SCO Open Unix and Unixware

SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the "as" address space file for a process ID (PID) by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program, which leaves the descriptor open to the user.

4.6
2003-12-15 CVE-2003-0932 Omega RPG Unspecified vulnerability in Omega-Rpg 0.9.0Pa9

Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable.

4.6
2003-12-15 CVE-2003-0914 ISC
Nixu
Compaq
Freebsd
HP
IBM
Netbsd
SCO
SUN
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
4.3
2003-12-15 CVE-2003-0629 Peoplesoft Unspecified vulnerability in Peoplesoft Peopletools

Cross-site scripting (XSS) vulnerability in PeopleSoft IScript environment for PeopleTools 8.43 and earlier allows remote attackers to insert arbitrary web script via a certain HTTP request to IScript.

4.3

1 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2003-12-15 CVE-2003-0858 GNU
Quagga
Resource Management Errors vulnerability in multiple products

Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.

2.1