Section: .. / advisories / cert /
|
See the CERT website for more information.
|
| /// File Name: |
CA-95:16.wu-ftpd.vul |
Description:
|
This advisory describes a vulnerability in the wu-fptd SITE EXEC command and provides solutions for both Linux users and others.
| | File Size: | 13838 | | Last Modified: | Sep 14 07:48:39 1999 |
| MD5 Checksum: | 75e31876631fbf4054469904a5686ed3 |
|
| /// File Name: |
CA-95:09.Solaris.ps.vul |
Description:
|
This advisory describes a vulnerability in Solaris that can be exploited if the permissions on the /tmp and /var/tmp directories are set incorrectly.
| | File Size: | 13835 | | Last Modified: | Sep 14 07:48:28 1999 |
| MD5 Checksum: | 65b36a02be742c26067752c254b2f4ba |
|
| /// File Name: |
CA-2000-21.naptha |
Description:
|
CERT Advisory CA-2000-21 Denial-of-Service Vulnerabilities in TCP/IP Stacks. A variety of denial-of-service vulnerabilities has been explored and documented by BindView's RAZOR Security Team. These vulnerabilities allow attackers to consume limited resources on victim machines. BindView's RAZOR Security Team has referred to these vulnerabilities as Naptha vulnerabilities.
| | Homepage: | http://www.cert.org | | File Size: | 13634 | | Last Modified: | Dec 6 00:28:44 2000 |
| MD5 Checksum: | 41ac0c93a5aefbb69e2d123ae5c3f22b |
|
| /// File Name: |
CA-96.06.cgi_example_code |
Description:
|
This advisory describes a problem with example CGI code, as found in
| | File Size: | 13572 | | Last Modified: | Sep 14 07:48:46 1999 |
| MD5 Checksum: | 958b610082eec2ac8a1f42656fa7df54 |
|
| /// File Name: |
CA-97.18.at |
Description:
|
This advisory addresses a buffer overflow condition in some versions of the at(1) program. Patch information and a workaround are provided.
| | File Size: | 13543 | | Last Modified: | Sep 14 07:49:34 1999 |
| MD5 Checksum: | 073629019b6c17c0178bc309d7b0af0d |
|
| /// File Name: |
CA-98.11.tooltalk |
Description:
|
This advisory was originally released on August 31, 1998, as NAI-29, developed by Network Associates, Inc. (NAI). It reports a vulnerability in ToolTalk RPC Service.
| | File Size: | 13486 | | Last Modified: | Sep 14 07:50:04 1999 |
| MD5 Checksum: | 267ea0e3664f28819382ca960b3710a4 |
|
| /// File Name: |
CA-95:17.rpc.ypupdated.vul |
Description:
|
This advisory describes a vulnerability in the rpc.ypupdated program, for which an exploitation program has been posted to several newsgroups. The advisory includes vendor information and a workaround.
| | File Size: | 13439 | | Last Modified: | Sep 14 07:48:40 1999 |
| MD5 Checksum: | 5aa3b22aefdb2606fbc498669eed6b6a |
|
| /// File Name: |
CA-96.19.expreserve |
Description:
|
** This advisory supersedes CA-93:09 and CA-93:09a. ** It provides information about a vulnerability in the expreserve utility. A workaround and vendor information are included.
| | File Size: | 13398 | | Last Modified: | Sep 14 07:49:03 1999 |
| MD5 Checksum: | 8d3886d64c9be44bbdb359769b9e509d |
|
| /// File Name: |
CA-93:10.anonymous.FTP.activity |
Description:
|
This advisory provides an updated version of the anonymous FTP configuration guidelines that is available from the CERT Coordination Center.
| | File Size: | 12841 | | Last Modified: | Sep 14 07:47:31 1999 |
| MD5 Checksum: | 85dbc64f1d9066e3a74b14338e0460dc |
|
| /// File Name: |
CA-2000-18.PGP |
Description:
|
There is a serious problem in the handling of certificates when encrypting with PGP versions 5.5.x through 6.5.3. The vulnerability lies within PGP's handling of Additional Decryption Keys (ADK) allowing a malicious user to insert an additional public key into the unsigned part of the user's public key-certificate. The malicious user may then be able to recover the plaintext of any encrypted text sent to the victim using the altered certificate.
| | Homepage: | http://www.cert.org | | File Size: | 12832 | | Last Modified: | Aug 25 18:17:34 2000 |
| MD5 Checksum: | a893bf7bbb7dfabcdccf6b67cda14bcc |
|
| /// File Name: |
CA-97.26.statd |
Description:
|
This advisory reports a vulnerability that exists in the statd(1M) program, available on a variety of Unix platforms.
| | File Size: | 12745 | | Last Modified: | Sep 14 07:49:48 1999 |
| MD5 Checksum: | 97a8497ec33b2a69a3d4a842a74a45d7 |
|
| /// File Name: |
CA-2000-07.ua.activex |
Description:
|
CERT Advisory CA-2000-07 - Severe Microsoft Office 2000 UA ActiveX Control Vulnerability. Arbitrary code can be executed without any warnings by simply viewing an HTML document via a web page, newsgroup posting, or email message. Systems with Internet Explorer and Microsoft Office 2000 components are vulnerable, including Word 2000, Excel 2000, PowerPoint 2000, Access 2000, Photodraw 2000, FrontPage 2000, Project 2000, Outlook 2000, Publisher 2000, and Works 2000 Suite.
| | Homepage: | http://www.cert.org | | File Size: | 12738 | | Last Modified: | May 25 03:28:41 2000 |
| MD5 Checksum: | 740d01f4d5a95b7e71cc0a08f2958086 |
|
| /// File Name: |
CA-2000-08.netscape |
Description:
|
CERT Advisory CA-2000-08 - Inconsistent Warning Messages in Netscape Navigator. A flaw exists in Netscape Navigator that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. Within one Netscape session, if a user clicks on "continue" in response to a "hostname does not match name in certificate" error, then that certificate is incorrectly validated for future use in the Netscape session, regardless of the hostname or IP address of other servers that use the certificate.
| | Homepage: | http://www.cert.org | | File Size: | 12566 | | Last Modified: | May 26 23:28:40 2000 |
| MD5 Checksum: | 4156df58e4f9c04a2d7e7b7f304881a2 |
|
| /// File Name: |
CA-2003-07.sendmail |
Description:
|
CERT Advisory CA-2003-07 - Sendmail prior to 8.12.8 has a remote root vulnerability which can be exploited by a malicious mail message, allowing non-vulnerable MTA's to relay the exploit message to unpatched MTA's on an internal network. A successful attack against an unpatched sendmail system will not leave any messages in the logs. All Sendmail Pro, Sendmail Switch, and Sendmail for NT are also vulnerable. Fix available here.
| | Homepage: | http://www.cert.org | | File Size: | 12357 | | Related CVE(s): | CAN-2002-1337 | | Last Modified: | Mar 4 06:06:00 2003 |
| MD5 Checksum: | 137522a297a47bd898379d3ef460199c |
|
| /// File Name: |
CA-96.27.hp_sw_install |
Description:
|
This advisory describes a vulnerability in Hewlett-Packard SD-UX that may allow local users to gain root privileges. A workaround is included.
| | File Size: | 12311 | | Last Modified: | Sep 14 07:49:13 1999 |
| MD5 Checksum: | 1b27c3c2249ae1e5db0efc2d690bd391 |
|
| /// File Name: |
CA-99-03-FTP-Buffer-Overflows |
Description:
|
This is a Netect, Inc. advisory regarding remote buffer overflows in various FTP servers leads to potential root compromise.
| | File Size: | 12262 | | Last Modified: | Sep 14 07:50:08 1999 |
| MD5 Checksum: | 603bfc69ba7dc315e205b12a5551a836 |
|
| /// File Name: |
CA-94:09.bin.login.vulnerability |
Description:
|
This advisory addresses a vulnerability in /bin/login of all IBM AIX 3 systems, and Linux systems. A workaround and patch information are included in this advisory.
| | File Size: | 12011 | | Last Modified: | Sep 14 07:47:56 1999 |
| MD5 Checksum: | 929e2c044c9fb32eb0e6296e9cc9716c |
|
| /// File Name: |
CA-2003-02.cvs |
Description:
|
CERT Advisory CA-2003-02 - Systems running CVS Home project versions of CVS prior to 1.11.5 allow non-authenticated remote attackers with read only access to execute arbitrary code. Vendor status information available here.
| | Homepage: | http://www.cert.org | | File Size: | 11935 | | Last Modified: | Jan 23 09:25:39 2003 |
| MD5 Checksum: | 96bcee114c70021a72d131f47f8011d4 |
|
| /// File Name: |
CA-99-17.dos |
Description:
|
CERT Advisory CA-99-17 - Denial-of-Service Tools. Recently, new techniques for executing denial-of-service attacks have been made public. MacOS 9 can be abused by an intruder to generate a large volume of traffic directed at a victim in response to a small amount of traffic produced by an intruder. This allows an intruder to use MacOS 9 as a "traffic amplifier," and flood victims with traffic. A tool similar to Tribe FloodNet (TFN), called Tribe FloodNet 2K (TFN2K) was released.
| | File Size: | 11875 | | Last Modified: | Dec 31 05:34:32 1999 |
| MD5 Checksum: | c2ba50110e62d6a677fa3253ee45344e |
|
| /// File Name: |
IN-2000-01.htm |
Description:
|
CERT Incident Note - Windows Trinoo tool.
| | Homepage: | http://www.cert.org/ | | File Size: | 11868 | | Last Modified: | Feb 25 02:30:04 2000 |
| MD5 Checksum: | 73102bfe104e8d31c1cb5bc4a59ef904 |
|
| /// File Name: |
CA-2002-23.openssl |
Description:
|
CERT Advisory CA-2002-23 - OpenSSL prior to 0.9.6e, up to and including pre-release 0.9.7-beta2 contains four remotely exploitable buffer overflows. Overflows exist during the SSLv2 handshake process, SSLv3 handshake process, Kerberos SSLv3 handshakes, and holding of ASCII representations of integers. Denial of service vulnerabilities exist in the handing of ASN.1 encoding. Version 0.9.6e of OpenSSL is recommended.
| | Homepage: | http://www.cert.org | | File Size: | 11749 | | Last Modified: | Jul 31 08:10:20 2002 |
| MD5 Checksum: | 5a3c9112a299983104f3207c37a604b8 |
|
| /// File Name: |
CA-97.10.nls |
Description:
|
This advisory reports a buffer overflow condition that affects some libraries using the Natural Language Service (NLS). Vendor vulnerability and patch information are included.
| | File Size: | 11589 | | Last Modified: | Sep 14 07:49:23 1999 |
| MD5 Checksum: | b4a1f10dd458571eabd0262f7ec267f6 |
|
| /// File Name: |
CA-99-04-Melissa-Macro-Virus.txt |
Description:
|
Any mail handling system could experience performance problems or a denial of service as a result of the propagation of this macro virus.
| | File Size: | 11588 | | Last Modified: | Sep 14 07:50:09 1999 |
| MD5 Checksum: | 3d53d0f8af4b663ea9d9d54aa6907fa0 |
|
| /// File Name: |
CA-2002-19.resolver |
Description:
|
CERT Advisory CA-2002-19 - A buffer overflow vulnerability exists in multiple implementations of DNS resolver libraries (libc and libbind) allows remote attackers who are able to send malicious DNS responses to exploit this vulnerability to execute arbitrary code or cause a denial of service. Most versions of BIND, FreeBSD, NetBSD, and OpenBSD are vulnerable.
| | Homepage: | http://www.cert.org | | File Size: | 11562 | | Last Modified: | Jun 29 20:14:30 2002 |
| MD5 Checksum: | f43e323b7d300233377911efea2586a9 |
|
| /// File Name: |
CA-2000-20.bind |
Description:
|
CERT Advisory CA-2000-20 - Name servers running ISC bind v8.2 through 8.2.2-P6 contains two denial of service vulnerabilities. The first vulnerability is referred to by the ISC as the "zxfr bug" and affects ISC BIND version 8.2.2, patch levels 1 through 6. The second vulnerability, the "srv bug", affects ISC BIND versions 8.2 through 8.2.2-P6. More information about these vulnerabilities available here.
| | Homepage: | http://www.cert.org | | File Size: | 11495 | | Last Modified: | Nov 14 03:32:39 2000 |
| MD5 Checksum: | fc3ac876330d29b24b986176e0d22625 |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
