Weekly Vulnerabilities Reports > December 15 to 21, 2003
Overview
42 new vulnerabilities reported during this period, including 2 critical vulnerabilities and 23 high severity vulnerabilities. This weekly summary report vulnerabilities in 51 products from 35 vendors including SAP, Microsoft, GNU, HP, and Quagga. Vulnerabilities are notably categorized as "Resource Management Errors", "Improper Input Validation", and "Classic Buffer Overflow".
- 31 reported vulnerabilities are remotely exploitables.
- 42 reported vulnerabilities are exploitable by an anonymous user.
- SAP has the most reported vulnerabilities, with 8 reported vulnerabilities.
- GNU has the most reported critical vulnerabilities, with 1 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
2 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2003-12-15 | CVE-2003-0972 | GNU | Unspecified vulnerability in GNU Screen Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow. | 10.0 |
2003-12-15 | CVE-2003-0968 | Freeradius | Remote Security vulnerability in FreeRADIUS Stack-based buffer overflow in SMB_Logon_Server of the rlm_smb experimental module for FreeRADIUS 0.9.3 and earlier allows remote attackers to execute arbitrary code via a long User-Password attribute. | 10.0 |
23 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2003-12-15 | CVE-2003-0976 | Novell | Remote Security vulnerability in Novell Netware 6.5 NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not properly enforce sys:\etc\exports when hostname aliases from sys:etc\hosts file are used, which could allow users to mount file systems when XNFS should deny the host. | 7.5 |
2003-12-15 | CVE-2003-0974 | Applied Watch Technologies | Authentication Bypass vulnerability in Applied Watch Technologies Applied Watch Command Center 1.0 Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as (1) add new users to a console, as demonstrated using appliedsnatch.c, or (2) add spurious IDS rules to sensors, as demonstrated using addrule.c. | 7.5 |
2003-12-15 | CVE-2003-0962 | Andrew Tridgell Redhat Engardelinux Slackware | Remote Heap Overflow vulnerability in RSync Daemon Mode Undisclosed Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail. | 7.5 |
2003-12-15 | CVE-2003-0960 | Openca | Unspecified vulnerability in Openca OpenCA before 0.9.1.4 does not use the correct certificate in a chain to check the serial, which could cause OpenCA to accept revoked or expired certificates. | 7.5 |
2003-12-15 | CVE-2003-0951 | HP | Remote Security vulnerability in HP Hp-Ux 11.23 Partition Manager (parmgr) in HP-UX B.11.23 does not properly validate certificates that are provided by the cimserver, which allows attackers to obtain sensitive data or gain privileges. | 7.5 |
2003-12-15 | CVE-2003-0950 | Peoplesoft | Unspecified vulnerability in Peoplesoft Peopletools PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the insufficiently random (system time) name of the directory used to store the file, and directly requesting that file. | 7.5 |
2003-12-15 | CVE-2003-0946 | Clam Anti Virus | Denial-Of-Service vulnerability in Clam Anti-Virus Clamav 0.60/0.60P Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before 0.65, allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the email address argument of a "MAIL FROM" command. | 7.5 |
2003-12-15 | CVE-2003-0945 | SAP | Remote Security vulnerability in Sap Db The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities. | 7.5 |
2003-12-15 | CVE-2003-0944 | SAP | Remote Security vulnerability in Sap Db Buffer overflow in the WAECHO default service in web-tools in SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a URL with a long requestURI. | 7.5 |
2003-12-15 | CVE-2003-0943 | SAP | Information Disclosure vulnerability in Sap Db web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via (1) waecho, (2) Web SQL Interface (websql), or (3) Web Database Manager (webdbm). | 7.5 |
2003-12-15 | CVE-2003-0942 | SAP | Remote Security vulnerability in Sap Db Buffer overflow in Web Agent Administration service in web-tools for SAP DB before 7.4.03.30 allows remote attackers to execute arbitrary code via a long Name parameter to waadmin.wa. | 7.5 |
2003-12-15 | CVE-2003-0941 | SAP | Remote Security vulnerability in Sap Db web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa. | 7.5 |
2003-12-15 | CVE-2003-0939 | SAP | Remote Security vulnerability in Sap Db eo420_GetStringFromVarPart in veo420.c for SAP database server (SAP DB) 7.4.03.27 and earlier may allow remote attackers to execute arbitrary code via a connect packet with a 256 byte segment to the niserver (aka serv.exe) process on TCP port 7269, which prevents the server from NULL terminating the string and leads to a buffer overflow. | 7.5 |
2003-12-15 | CVE-2003-0822 | Microsoft | Unspecified vulnerability in Microsoft products Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. | 7.5 |
2003-12-15 | CVE-2003-0821 | Microsoft | Unspecified vulnerability in Microsoft Word and Works Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model. | 7.5 |
2003-12-15 | CVE-2003-0820 | Microsoft | Buffer Overflow vulnerability in Microsoft Word and Works Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack. | 7.5 |
2003-12-15 | CVE-2003-0812 | Microsoft | Remote Buffer Overflow vulnerability in Microsoft Windows 2000 and Windows XP Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API. | 7.5 |
2003-12-15 | CVE-2003-0961 | Linux | Unspecified vulnerability in Linux Kernel Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privileges. | 7.2 |
2003-12-15 | CVE-2003-0948 | Wireless Tools | Local ARGV Command Line Buffer Overflow vulnerability in IWConfig Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable. | 7.2 |
2003-12-15 | CVE-2003-0947 | Wireless Tools Project | Classic Buffer Overflow vulnerability in Wireless Tools Project Wireless Tools Buffer overflow in iwconfig, when installed setuid, allows local users to execute arbitrary code via a long OUT environment variable. | 7.2 |
2003-12-15 | CVE-2003-0938 | SAP | Local Security vulnerability in Sap Db vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure. | 7.2 |
2003-12-15 | CVE-2003-0936 | Symantec | Unspecified vulnerability in Symantec Pcanywhere 10.0/10.5/11.0 Symantec PCAnywhere 10.x and 11, when started as a service, allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe. | 7.2 |
2003-12-15 | CVE-2003-0089 | HP | Local Buffer Overrun vulnerability in HP-UX Software Distributor Lang Environment Variable Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify. | 7.2 |
16 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2003-12-15 | CVE-2003-0975 | Apple | Unspecified vulnerability in Apple mac OS X, mac OS X Server and Safari Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain. | 5.0 |
2003-12-15 | CVE-2003-0973 | Apache | Unspecified vulnerability in Apache MOD Python Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string. | 5.0 |
2003-12-15 | CVE-2003-0971 | GNU | Unspecified vulnerability in GNU Privacy Guard GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature. | 5.0 |
2003-12-15 | CVE-2003-0970 | SUN | Denial-Of-Service vulnerability in SUN Fire B1600 The Network Management Port on Sun Fire B1600 systems allows remote attackers to cause a denial of service (packet loss) via ARP packets, which cause all ports to become temporarily disabled. | 5.0 |
2003-12-15 | CVE-2003-0967 | Freeradius | Unspecified vulnerability in Freeradius rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute. | 5.0 |
2003-12-15 | CVE-2003-0940 | SAP | Directory Traversal vulnerability in Sap Db Directory traversal vulnerability in sqlfopenc for web-tools in SAP DB before 7.4.03.30 allows remote attackers to read arbitrary files via .. | 5.0 |
2003-12-15 | CVE-2003-0824 | Microsoft | Unspecified vulnerability in Microsoft products Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. | 5.0 |
2003-12-15 | CVE-2003-0795 | GNU Quagga SGI | Improper Input Validation vulnerability in multiple products The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference. | 5.0 |
2003-12-15 | CVE-2003-0628 | Peoplesoft | Unspecified vulnerability in Peoplesoft Peopletools PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value. | 5.0 |
2003-12-15 | CVE-2003-0327 | Sybase | Unspecified vulnerability in Sybase Adaptive Server Enterprise 12.5 Sybase Adaptive Server Enterprise (ASE) 12.5 allows remote attackers to cause a denial of service (hang) via a remote password array with an invalid length, which triggers a heap-based buffer overflow. | 5.0 |
2003-12-15 | CVE-2003-0859 | GNU Quagga SGI Redhat Intel | The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface. | 4.9 |
2003-12-15 | CVE-2003-0856 | Stephen Hemminger | Unspecified vulnerability in Stephen Hemminger Iproute iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface. | 4.9 |
2003-12-15 | CVE-2003-0955 | Openbsd | Local Malformed Binary Execution Denial of Service vulnerability in Openbsd 3.3/3.4 OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow. | 4.6 |
2003-12-15 | CVE-2003-0932 | Omega RPG | Unspecified vulnerability in Omega-Rpg 0.9.0Pa9 Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable. | 4.6 |
2003-12-15 | CVE-2003-0914 | ISC Nixu Compaq Freebsd HP IBM Netbsd SCO SUN | ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value. | 4.3 |
2003-12-15 | CVE-2003-0629 | Peoplesoft | Unspecified vulnerability in Peoplesoft Peopletools Cross-site scripting (XSS) vulnerability in PeopleSoft IScript environment for PeopleTools 8.43 and earlier allows remote attackers to insert arbitrary web script via a certain HTTP request to IScript. | 4.3 |
1 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2003-12-15 | CVE-2003-0858 | GNU Quagga | Resource Management Errors vulnerability in multiple products Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface. | 2.1 |