Monthly Archive: May 2001

Akopia Interchange 4.5.3 through 4.6.3 installs demo stores with a default group account :backup with no password, which allows a remote attacker to gain administrative access via the demo stores (1) barry, (2) basic,...

fcheck prior to 2.57.59 calls the file signature checking program insecurely, which can allow a local user to run arbitrary commands via a file name that contains shell metacharacters. Date published : 2001-05-24 http://marc.info/?l=bugtraq&m=98521301510554&w=2...

Buffer overflow in lpsched on DGUX version R4.20MU06 and MU02 allows a local attacker to obtain root access via a long command line argument (non-existent printer name). Date published : 2001-05-24 http://marc.info/?l=bugtraq&m=98511407131984&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/6258

Mirabilis ICQ WebFront Plug-in ICQ2000b Build 3278 allows a remote attacker to create a denial of service via HTTP URL requests containing a large number of % characters. Date published : 2001-05-24 http://www.securityfocus.com/bid/2664 http://marc.info/?l=bugtraq&m=98847544303438&w=2

Directory traversal vulnerability in help.cgi in Ikonboard 2.1.7b and earlier allows a remote attacker to read arbitrary files via a .. (dot dot) attack in the helpon parameter. Date published : 2001-05-24 http://www.securityfocus.com/bid/2471 http://archives.neohapsis.com/archives/bugtraq/2001-03/0124.html

Format string vulnerability in Sierra Half-Life build 1573 and earlier allows a remote attacker to execute arbitrary code via the map command. Date published : 2001-05-24 http://archives.neohapsis.com/archives/bugtraq/2001-03/0111.html https://exchange.xforce.ibmcloud.com/vulnerabilities/6220

Buffer overflows in Sierra Half-Life build 1573 and earlier allow remote attackers to execute arbitrary code via (1) a long map command, (2) a long exec command, or (3) long input in a configuration...

Novell Groupwise 5.5 (sp1 and sp2) allows a remote user to access arbitrary files via an implementation error in Groupwise system policies. Date published : 2001-05-24 http://marc.info/?l=bugtraq&m=98185226715517&w=2

TheNet CheckBO 1.56 allows remote attackers to cause a denial of service via a flood of characters to the TCP ports which it is listening on. Date published : 2001-05-24 http://www.securityfocus.com/bid/2634 http://www.securityfocus.com/archive/1/178061

The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of service via a series of requests. Date published : 2001-05-24 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026

Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information...

Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi. Date...

TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one...

Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send...