Monthly Archive: February 2000

search.cgi in the SolutionScripts Home Free package allows remote attackers to view directories via a .. (dot dot) attack. Date published : 2000-02-04 http://www.securityfocus.com/bid/921

Buffer overflow in Winamp client allows remote attackers to execute commands via a long entry in a .pls file. Date published : 2000-02-04 http://www.securityfocus.com/bid/925

Buffer overflow in Yahoo Pager/Messenger client allows remote attackers to cause a denial of service via a long URL within a message. Date published : 2000-02-04

Buffer overflow in ICQ 99b 1.1.1.1 client allows remote attackers to execute commands via a malformed URL within an ICQ message. Date published : 2000-02-04 http://www.securityfocus.com/bid/929

glFtpD includes a default glftpd user account with a default password and a UID of 0. Date published : 2000-02-04

resend command in Majordomo allows local users to gain privileges via shell metacharacters. Date published : 2000-02-04 http://www.securityfocus.com/bid/902

Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function. Date published : 2000-02-04

Lotus Domino HTTP server allows remote attackers to determine the real path of the server via a request to a non-existent script in /cgi-bin. Date published : 2000-02-04 http://www.securityfocus.com/bid/881

IMail POP3 daemon uses weak encryption, which allows local users to read files. Date published : 2000-02-04

Buffer overflow in Linux linuxconf package allows remote attackers to gain root privileges via a long parameter. Date published : 2000-02-04

Buffer overflow in Internet Anywhere POP3 Mail Server allows remote attackers to cause a denial of service or execute commands via a long username. Date published : 2000-02-04 http://www.securityfocus.com/bid/730

FTPPro allows local users to read sensitive information, which is stored in plain text. Date published : 2000-02-04

HP-UX aserver program allows local users to gain privileges via a symlink attack. Date published : 2000-02-04