CVE Vulnerability Catalog

CVE-2001-1078 describes a format string vulnerability in the flog function of eXtremail version 1.1.9 and earlier, allowing remote attackers to gain root privileges via format specifiers in SMTP and POP3 commands.

CVE-2001-1080 affects AIX 4.3.x and 5.1 systems, where the diagrpt program uses the DIAGDATADIR environment variable to locate and execute certain programs. This allows local users to gain privileges by modifying the variable to point to a Trojan horse program.

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, allowing local users to bypass resource limits (rlimits) set in pam.d.

Buffer overflows in BSD-based FTP servers allow remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence. This affects the functions g_opendir, g_lstat, g_stat, and the glob0 buffer used in glob functions glob2 and glob3.

IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, allowing remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port.

Buffer overflow in Trend Micro Virus Buster 2001 version 8.02 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long 'From' header.

Buffer overflow in Savant 3.0 web server allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long Host HTTP header.

Cisco Content Services (CSS) switch products 11800 and earlier, aka Arrowpoint, allow local users to gain privileges by entering debug mode.

Configuration error in Axent Raptor Firewall 6.5 allows remote attackers to use the firewall as a proxy to access internal web resources when the http.noproxy Rule is not set.

Configuration error in Argus PitBull LX allows root users to bypass specified access control restrictions. This can lead to denial of service or execution of arbitrary commands by modifying kernel variables in /proc/sys.

The vulnerability in Computer Associates CCC\Harvest 5.0 for Windows NT/2000 is due to the use of weak password encryption. A remote attacker can exploit this weakness to gain unauthorized privileges in the application.

The vulnerability in udirectory.pl in Microburst Technologies uDirectory 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the category_file field.

Buffer overflow in ntpd ntp daemon (version 4.0.99k and earlier) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.

The web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request containing "%2e" (dot dot) characters.

Buffer overflow in the tip tool in Solaris 8 and earlier allows local users to execute arbitrary commands via a long HOME environmental variable.

Buffer overflow in Silent Runner Collector (SRC) 1.6.1 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long SMTP HELO command.

The perfmon program in Solaris allows local users to create arbitrary files as root via the Logging File option in the GUI.

Gene6 G6 FTP Server version 2.0 (also known as BPFTP Server 2.10) allows attackers to read file attributes outside of the web root via the SIZE and MDTM commands when the 'show relative paths' option is not enabled.

SonicWALL Tele2 and SOHO firewalls with firmware 6.0.0.0 using IPSEC with IKE pre-shared keys do not support full 128-byte IKE pre-shared keys, limiting to 48-byte keys. This allows a remote attacker to perform brute force attacks on the pre-shared keys with significantly fewer resources.

The HTTP server in Compaq web-enabled management software can be used as a generic proxy server, allowing remote attackers to bypass access restrictions via the management port, 2301.