Monthly Archive: September 1999

Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share. Date published : 1999-09-29 http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q140818

Buffer overflow in the win-c-sample program (win-c-sample.exe) in the WebSite web server 1.1e allows remote attackers to execute arbitrary code via a long query string. Date published : 1999-09-29 http://www.securityfocus.com/bid/2078 http://archives.neohapsis.com/archives/bugtraq/1997_1/0021.html

The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs. Date published : 1999-09-29

The Webgais program allows a remote user to execute arbitrary commands. Date published : 1999-09-29

The convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by the web server. Date published : 1999-09-29

The view-source CGI program allows remote attackers to read arbitrary files via a .. (dot dot) attack. Date published : 1999-09-29

FormMail CGI program can be used by web servers other than the host server that the program resides on. Date published : 1999-09-29

FormMail CGI program allows remote execution of commands. Date published : 1999-09-29

Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list. Date published : 1999-09-29

The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly bypassing authentication that would otherwise have taken place. For...

In SunOS, NFS file handles could be guessed, giving unauthorized access to the exported file system. Date published : 1999-09-29

NFS allows users to use a "cd .." command to access other directories besides the exported file system. Date published : 1999-09-29

A race condition in the Solaris ps command allows an attacker to overwrite critical files. Date published : 1999-09-29

The "established" keyword in some Cisco IOS software allowed an attacker to bypass filtering. Date published : 1999-09-29