CVE Vulnerability Catalog

A format string vulnerability in the logging function of ypbind 3.3, while running in debug mode, leaks file descriptors and allows an attacker to cause a denial of service.

The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.

CVE-2000-1014 describes a format string vulnerability in the search97.cgi script of the SCO help HTTP server for Unixware 7, allowing remote attackers to execute arbitrary commands via format characters in the queryText parameter.

The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, allowing remote attackers to gain Slashcode privileges and possibly execute arbitrary commands.

Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.

Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows remote attackers to execute arbitrary commands via a long LogFileName parameter in HTML source code.

Buffer overflow in the cu program in HP-UX 11.0 may allow local users to gain privileges via a long -l command line argument.

The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, allowing remote attackers to execute restricted commands by sending a DATA command before sending the restricted commands.

iCal 2.1 Patch 2 installs many files with world-writeable permissions, allowing local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse.

Buffer overflow in CiscoSecure ACS Server 2.4(2) and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a large TACACS+ packet.

Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet.

The csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory.

Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via long 'RCPT TO,' 'SAML FROM,' or 'SOML FROM' commands.

The csstart program in iCal 2.1 Patch 2 searches the current working directory for the cshttpd program, allowing local users to gain root privileges by creating a Trojan Horse cshttpd program in that directory and calling csstart from there.

Check Point Firewall-1 versions 3.0 through 4.1 generate different error messages for invalid usernames and passwords, allowing remote attackers to determine valid usernames and guess passwords via brute force attacks.

Buffer overflows in TYPSoft FTP Server 0.78 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary commands via a long USER, PASS, or CWD command.

Format string vulnerabilities in the ssh program in OpenBSD (and possibly other BSD-based operating systems) allow attackers to gain root privileges.

Buffer overflow in the catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.

CVE-2000-1010 describes a format string vulnerability in talkd in OpenBSD and possibly other BSD-based operating systems, allowing remote attackers to execute arbitrary commands via a user name containing format characters.

In Red Hat Linux 6.2, there is a vulnerability that relies on the pathname specified by the RSH environmental variable. This allows local users to gain root privileges by modifying the RSH variable to point to a Trojan horse program.