CVE Vulnerability Catalog

Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.

mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with its process ID, which limits the space of possible seeds and makes it easier for attackers to conduct brute force password attacks.

CVE-2001-1425 affects the challenge-response authentication for the EXPERT user on Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134. Remote attackers can gain privileges by directly computing the response based on information provided by the device during login.

Alcatel Speed Touch ADSL modem with specific firmware versions has a blank default password, allowing remote attackers to gain unauthorized access.

Alcatel Speed Touch devices running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 have a TFTP server running without a password, allowing remote attackers to change firmware versions or the device's configurations.

CVE-2001-0181 describes a vulnerability in the error logging code of the DHCP server and client in Caldera Linux that allows remote attackers to execute arbitrary commands.

CVE-2001-0187 describes a format string vulnerability in wu-ftp version 2.6.1 and earlier when running in debug mode. This allows remote attackers to execute arbitrary commands via a malformed argument recorded in a PASV port assignment.

Buffer overflow in ReiserFS 3.5.28 in SuSE Linux allows local users to cause a denial of service and possibly execute arbitrary commands by via a long directory name.

The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program.

Buffer overflow in Shoutcast Distributed Network Audio Server (DNAS) version 1.7.1 allows remote attackers to cause a denial of service and potentially execute arbitrary commands via a long description.

Versions of sash before 3.4-4 in Debian GNU/Linux do not properly clone the /etc/shadow file, making it world-readable. This could allow local users to gain privileges via password cracking.

ipfw and ip6fw in FreeBSD 4.2 and earlier allow remote attackers to bypass access restrictions by setting the ECE flag in a TCP packet, which makes the packet appear to be part of an established connection.

Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file.

Buffer overflow in bing allows remote attackers to execute arbitrary commands via a long hostname, which is copied to a small buffer after a reverse DNS lookup using the gethostbyaddr function.

Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier, and possibly other operating systems, allows local users to gain privileges by executing cu with a long program name (arg0).

The Watchguard Firebox II firewall allows users with read-only access to gain read-write access and administrative privileges by accessing a file that contains hashed passphrases.

Buffer overflow in micq client 0.4.6 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long Description field.

The setuid doroot program in Voyant Sonata 3.x executes arbitrary command line arguments, allowing local users to gain root privileges.

CVE-2001-0197 describes a format string vulnerability in the print_client function in icecast version 1.3.8beta2 and earlier, allowing remote attackers to execute arbitrary commands.

Buffer overflow in wwwwais allows remote attackers to execute arbitrary commands via a long QUERY_STRING (HTTP GET request).