CERT/CC AdvisoriesCERT advisories have become a core component of US-CERT's Technical Cyber Security Alerts.
In recent weeks there have been several mass-mailing viruses released on the Internet. It is important for users to understand the risks posed by these pieces of malicious code and the steps necessary to protect their systems from virus infection.
A number of vulnerabilities have been discovered in various implementations of the multimedia telephony protocol H.323. Voice over Internet Protocol (VoIP) and video conferencing equipment and software can use these protocols to communicate over a variety of computer networks.
A buffer overflow vulnerability exists in Microsoft's Windows Workstation Service (WKSSVC.DLL).
A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
There are multiple vulnerabilities in Microsoft Windows and Microsoft Exchange, the most serious of which could allow remote attackers to execute arbitrary code.
There are multiple vulnerabilities in different implementations of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. These vulnerabilities occur primarily in Abstract Syntax Notation One (ASN.1) parsing code. The most serious vulnerabilities may allow a remote attacker to execute arbitrary code. The common impact is denial of service.
A vulnerability in sendmail could allow a remote attacker to execute arbitrary code with the privileges of the sendmail daemon, typically root.
There is a remotely exploitable vulnerability in a general buffer management function in versions of OpenSSH prior to 3.7. This may allow a remote attacker to corrupt heap memory which could cause a denial-of-service condition. It may also be possible for an attacker to execute arbitrary code.
Microsoft has published a bulletin describing three vulnerabilities that affect numerous versions of Microsoft Windows. Two of these vulnerabilities are remotely exploitable buffer overflows that may allow an attacker to execute arbitrary code with system privileges. The third vulnerability may allow a remote attacker to cause a denial of service.
Microsoft Internet Explorer (IE) contains multiple vulnerabilities, the most serious of which could allow a remote attacker to execute arbitrary code with the privileges of the user running IE.
The CERT/CC has received a report that the system housing the primary FTP servers for the GNU software project was compromised.
The CERT/CC is receiving reports of widespread activity related to a new piece of malicious code known as W32/Blaster. This worm appears to exploit known vulnerabilities in the Microsoft Remote Procedure Call (RPC) Interface.
The CERT/CC is receiving reports of widespread scanning and exploitation of two recently discovered vulnerabilities in Microsoft Remote Procedure Call (RPC) Interface.
A set of integer overflows exists in a DirectX library included in Microsoft Windows. An attacker could exploit this vulnerability to execute arbitrary code or to cause a denial of service.
An exploit has been posted publicly for the vulnerability described in VU#411332, which was announced in
A buffer overflow vulnerability exists in Microsoft's Remote Procedure Call (RPC) implementation. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
A vulnerability in many versions of Cisco IOS could allow an intruder to execute a denial-of-service attack against a vulnerable device.
A buffer overflow vulnerability exists in a shared HTML conversion library included in Microsoft Windows. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
There are two vulnerabilities in the Snort Intrusion Detection System, each in a separate preprocessor module. Both vulnerabilities allow remote attackers to execute arbitrary code with the privileges of the user running Snort, typically root.
There is a vulnerability in sendmail that may allow remote attackers to gain the privileges of the sendmail daemon, typically root.
Multiple vulnerabilities have been reported to affect Lotus Notes clients and Domino servers. Multiple reporters, the close timing, and some ambiguity caused confusion about what releases are vulnerable. We are issuing this advisory to help clarify the details of the vulnerabilities, the versions affected, and the patches that resolve these issues.
There is an integer overflow in the xdrmem_getbytes() function distributed as part of the Sun Microsystems XDR library. This overflow can cause remotely exploitable buffer overflows in multiple applications, leading to the execution of arbitrary code. Although the library was originally distributed by Sun Microsystems, multiple vendors have included the vulnerable code in their own implementations.
Released March 17, 2003
A buffer overflow vulnerability exists in the Win32 API libraries shipped with all versions of Microsoft Windows 2000. This vulnerability, which is being actively exploited on WebDAV-enabled IIS 5.0 servers, will allow a remote attacker to execute arbitrary code on unpatched systems. Sites running Microsoft Windows 2000 should apply a patch or disable WebDAV services as soon as possible.
In recent weeks, the CERT/CC has observed an increase in the number of reports of systems running Windows 2000 and XP compromised due to poorly protected file shares.
There is a vulnerability in sendmail that may allow remote attackers to gain the privileges of the sendmail daemon, typically root.
Numerous vulnerabilities have been reported in multiple vendors' implementations of the Session Initiation Protocol. These vulnerabilities may allow an attacker to gain unauthorized privileged access, cause denial-of-service attacks, or cause unstable system behavior.
Multiple vulnerabilities exist in Oracle software that may lead to execution of arbitrary code; the ability to read, modify, or delete information stored in underlying Oracle databases; or denial of service. All of these vulnerabilites were discovered by Next Generation Security Software Ltd.
The CERT/CC has received reports of self-propagating malicious code that exploits multiple vulnerabilities in the Resolution Service of Microsoft SQL Server 2000. The propagation of this worm has caused varied levels of network degradation across the Internet, in addition to the compromise of vulnerable machines.
A buffer overflow vulnerability in the Microsoft Windows Locator service could allow a remote attacker to execute arbitrary code or cause the Windows Locator service to fail. This service is enabled and running by default on Windows 2000 domain controllers and Windows NT 4.0 domain controllers.
A "double-free" vulnerability in the Concurrent Versions System (CVS) server could allow an unauthenticated, remote attacker with read-only access to execute arbitrary code, alter program operation, read sensitive information, or cause a denial of service.
The Internet Software Consortium (ISC) has discovered several buffer overflow vulnerabilities in their implementation of DHCP (ISC DHCPD). These vulnerabilities may allow remote attackers to execute arbitrary code on affected systems. At this time, we are not aware of any exploits.
A buffer overflow vulnerability exists in the Microsoft Windows Shell. An attacker can exploit this vulnerability by enticing a victim to read a malicious email message, visit a malicious web page, or browse to a folder containing a malicious .MP3 or .WMA file. The attacker can then execute arbitrary code with the privileges of the victim.
Multiple vendors' implementations of the secure shell (SSH) transport layer protocol contain vulnerabilities that could allow a remote attacker to execute arbitrary code with the privileges of the SSH process or cause a denial of service. The vulnerabilities affect SSH clients and servers, and they occur before user authentication takes place.
A remotely exploitable vulnerability has been discovered in Sun Cobalt RaQ 4 Server Appliances running Sun's Security Hardening Package (SHP). Exploitation of this vulnerability may allow remote attackers to execute arbitrary code with superuser privileges.
The Solaris X Window Font Service (XFS) daemon (fs.auto) contains a remotely exploitable buffer overflow vulnerability that could allow an attacker to execute arbitrary code or cause a denial of service.
A vulnerability in the Microsoft Data Access Components (MDAC) could lead to remote execution of code with the privileges of the current process or user.
Alcatel has recently discovered a serious vulnerability in AOS version 5.1.1. Exploitation of this vulnerability can lead to full administrative control of the device running AOS.
Multiple vulnerabilities with varying impacts have been found in BIND, the popular domain name server and client library software package from the Internet Software Consortium (ISC).
The CERT/CC has received reports that several of the released source code distributions of the libpcap and tcpdump packages were modified by an intruder and contain a Trojan horse. We strongly encourage sites that use, redistribute, or mirror the libpcap or tcpdump packages to immediately verify the integrity of their distribution.
Multiple Kerberos distributions contain a remotely exploitable buffer overflow in the Kerberos administration daemon. A remote attacker could exploit this vulnerability to gain root privileges on a vulnerable system.
The CERT/CC has received confirmation that some copies of the source code for the Sendmail package were modified by an intruder to contain a Trojan horse. Sites that employ, redistribute, or mirror the Sendmail package should immediately verify the integrity of their distribution.
The CERT/CC has received reports of self-propagating malicious code which exploits a vulnerability (VU#102795) in OpenSSL. This malicious code has been referred to as Apache/mod_ssl worm, linux.slapper.worm and bugtraq.c worm.
The Common Desktop Environment (CDE) ToolTalk RPC database server contains a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code or cause a denial of service.
There is an integer overflow present in the xdr_array() function distributed as part of the Sun Microsystems XDR library. This overflow has been shown to lead to remotely exploitable buffer overflows in multiple applications, leading to the execution of arbitrary code. Although the library was originally distributed by Sun Microsystems, multiple vendors have included the vulnerable code in their own implementations.
The CERT/CC has received confirmation that some copies of the source code for the OpenSSH package were modified by an intruder and contain a Trojan horse. We strongly encourage sites which employ, redistribute, or mirror the OpenSSH package to immediately verify the integrity of their distribution.
There are four remotely exploitable buffer overflows in OpenSSL. There are also encoding problems in the ASN.1 library used by OpenSSL. Several of these vulnerabilities could be used by a remote attacker to execute arbitrary code on the target system. All could be used to create denial of service.
The Microsoft SQL Server contains several serious vulnerabilities that allow remote attackers to obtain sensitive information, alter database contents, compromise SQL servers, and, in some configurations, compromise server hosts.
A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server.
Two vulnerabilities have been discovered in the Common Desktop Environment (CDE) ToolTalk RPC database server. The first vulnerability could be used by a remote attacker to delete arbitrary files, cause a denial of service, or possibly execute arbitrary code or commands. The second vulnerability could allow a local attacker to overwrite arbitrary files with contents of the attacker's choice.
Buffer overflow vulnerabilities exist in multiple implementations of DNS resolver libraries. Operating systems and applications that utilize vulnerable DNS resolver libraries may be affected.
There are two related vulnerabilities in the challenge response handling code in OpenSSH versions 2.3.1p1 through 3.3. They may allow a remote intruder to execute arbitrary code as the user running sshd (often root). The first vulnerability affects OpenSSH versions 2.9.9 through 3.3, that have the challenge response option enabled, and use SKEY or BSD_AUTH authentication. The second vulnerability affects PAM modules using interactive keyboard authentication in OpenSSH versions 2.3.1p1 through 3.3, regardless of the challenge response option setting.
There is a remotely exploitable vulnerability in the handling of large chunks of data in web servers that are based on Apache source code. This vulnerability is present by default in configurations of Apache web servers versions 1.3 through 1.3.24 and versions 2.0 through 2.0.36. The impact of this vulnerability is dependent upon the software version and the hardware platform the server is running on.
There are multiple vulnerabilities in Yahoo! Messenger. Attackers that are able to exploit these vulnerabilities may be able to execute arbitrary code with the privileges of the victim user.
A denial-of-service vulnerability exists in version 9 of the Internet Software Consortium's (ISC) Berkeley Internet Name Domain (BIND) server. ISC BIND versions 8 and 4 are not affected. Exploiting this vulnerability will cause the BIND server to shut down.
A remotely exploitable buffer overflow exists in Macromedia's JRun 3.0 and 3.1.
Microsoft's MSN Chat is an ActiveX control for Microsoft Messenger, an instant messaging client. A buffer overflow exists in the ActiveX control that may permit a remote attacker to execute arbitrary code on the system with the privileges of the current user.
The Internet Software Consortium (ISC) provides a Dynamic Host Configuration Protocol Daemon (DHCPD), which is a server that is used to allocate network addresses and assign configuration parameters to hosts. A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root).
Sun's NFS/RPC file system cachefs daemon (cachefsd) is shipped and installed by default with Sun Solaris 2.5.1, 2.6, 7, and 8 (SPARC and Intel architectures). A remotely exploitable vulnerability exists in cachefsd that could permit a remote attacker to execute arbitrary code with the privileges of the cachefsd, typically root.
The rwall daemon (rpc.rwalld) is a utility that is used to listen for wall requests on the network. When a request is received, it calls wall, which sends the message to all terminals of a time-sharing system. A format string vulnerability may permit an intruder to execute code with the privileges of the rwall daemon.
A variety of vulnerabilities exist in various versions of Microsoft IIS. Some of these vulnerabilities may allow an intruder to execute arbitrary code on vulnerable systems.
Multiple vulnerabilities in Oracle Application Server have recently been discovered. These vulnerabilities include buffer overflows, insecure default settings, failures to enforce access controls, and failure to validate input. The impacts of these vulnerabilities include the execution of arbitrary commands or code, denial of service, and unauthorized access to sensitive information.
There is a bug in the zlib compression library that may manifest itself as a vulnerability in programs that are linked with zlib. This may allow an attacker to conduct a denial-of-service attack, gather information, or execute arbitrary code.
Remote Authentication Dial In User Service (RADIUS) servers are used for authentication, authorization and accounting for terminals that speak the RADIUS protocol. Multiple vulnerabilities have been discovered in several implementations of the RADIUS protocol.
Multiple vulnerabilities exist in the PHP scripting language. These vulnerabilities could allow a remote attacker to execute arbitrary code with the privileges of the PHP process.
Microsoft Internet Explorer contains a buffer overflow vulnerability in its handling of embedded objects in HTML documents. This vulnerability could allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.
CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP)February 12, 2002
Numerous vulnerabilities have been reported in multiple vendor SNMP implementations. These vulnerabilities may allow unauthorized privileged access, denial-of-service attacks, or unstable behavior. If your site uses SNMP in any capacity, the CERT/CC encourages you to read this advisory and follow the advice provided in the solution section.
There is a remotely exploitable buffer overflow in ICQ. Attackers that are able to exploit the vulnerability may be able to execute arbitrary code with the privileges of the victim user. Full details are discussed in VU#570167. An exploit is known to exist, but we do not believe it has been distributed in the wild. We have not seen active scanning for this vulnerability, nor have we received any reports of this vulnerability being exploited.
The CERT/CC has received credible reports of scanning and exploitation of Solaris systems running the
CDE Subprocess Control Service buffer overflow vulnerability identified in CA-2001-31 and discussed in
Vulnerabilities in software included by default on Microsoft Windows XP, and optionally on Windows ME and Windows 98, may allow an intruder to execute arbitrary code on vulnerable systems, to launch denial-of-service attacks against vulnerable systems, or to use vulnerable systems to launch denial-of-service attacks against third-party systems.
CA-2001-36: Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME HeadersDecember 19, 2001
Microsoft Internet Explorer contains a vulnerability in its handling of certain MIME headers in web pages and HTML email messages. This vulnerability may allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.
There are multiple vulnerabilities in several implementations of the Secure Shell (SSH) protocol. The SSH protocol enables a secure communications channel from a client to a server. We are seeing a high amount of scanning for SSH daemons, and we are receiving reports of exploitation.
Several applications use login for authentication to the system. A remotely exploitable buffer overflow exists in login derived from System V. Attackers can exploit this vulnerability to gain root access to the server.
WU-FTPD is a widely deployed software package used to provide File Transport Protocol (FTP) services on UNIX and Linux systems. There are two vulnerabilities in WU-FTPD that expose a system to potential remote root compromise by anyone with access to the FTP service.
The HP-UX line printer daemon (rlpdaemon) enables various clients to share printers over a network. A remotely exploitable buffer overflow vulnerability exists in the rlpdaemon.
There is a remotely exploitable buffer overflow vulnerability in a library function used by the CDE Subprocess Control Service. This vulnerability could be used to crash the service or to execute arbitrary code with root privileges.
There are multiple vulnerabilities in several implementations of the line printer daemon (lpd). The line printer daemon enables various clients to share printers over a network.
A remotely exploitable buffer overflow in the Oracle9iAS Web Cache allows intruders to execute arbitrary code or disrupt the normal operation of Web Cache.
An intruder can include a specially crafted macro in a Microsoft Excel or PowerPoint document that can avoid detection and run automatically regardless of the security settings specified by the user.
There is a remotely exploitable format string vulnerability in the CDE ToolTalk RPC database service. This vulnerability could be used to crash the service or execute arbitrary code, potentially allowing an intruder to gain root access.
The CERT/CC has received reports of new malicious code known as the "W32/Nimda worm" or the "Concept Virus (CV) v.5." This new worm appears to spread by multiple mechanisms.
A vulnerability for a remotely exploitable buffer overflow exists in Gauntlet Firewall by PGP Security.
ovactiond is a component of OpenView by Hewlett-Packard Company (HP) and NetView by Tivoli, an IBM Company (Tivoli). These products are used to manage large systems and networks. There is a serious vulnerability in ovactiond that allows intruders to execute arbitrary commands with elevated privileges. This may subsequently lead to an intruder gaining administrative control of a vulnerable machine.
Since around July 13, 2001, at least two variants of the self-propagating malicious code "Code Red" have been attacking hosts on the Internet (see CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL. Different organizations who have analyzed "Code Red" have reached different conclusions about the behavior of infected machines when their system clocks roll over to the next month. This advisory has been translated into Polish by CERT POLSKA.
"W32/Sircam" is malicious code that spreads through email and potentially through unprotected network shares. Once the malicious code has been executed on a system, it may reveal or delete sensitive information.
The telnetd program is a server for the Telnet remote virtual terminal protocol. There is a remotely exploitable buffer overflow in Telnet daemons derived from BSD source code. This vulnerability can crash the server or be leveraged to gain root access.
This year, we have seen a significant increase in activity resulting in compromises of home user machines. In many cases, these machines are then used by intruders to launch attacks against other organizations. Home users have generally been the least prepared to defend against attacks. Many home users do not keep their machines up to date with security patches and workarounds, do not run current anti-virus software, and do not exercise caution when handling email attachments. Intruders know this, and we have seen a marked increase in intruders specifically targeting home users who have cable modem and DSL connections.
The CERT/CC has received reports of new self-propagating malicious code that exploits certain configurations of Microsoft Windows susceptible to the vulnerability described in CERT advisory CA-2001-13 Buffer Overflow In IIS Indexing Service DLL. These reports indicate that the "Code Red" worm may have already affected as many as 225,000 hosts, and continues to spread rapidly. This advisory has been translated into Polish by CERT POLSKA.
CA-2001-18: Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol (LDAP)July 16, 2001
Several implementations of the Lightweight Directory Access Protocol (LDAP) protocol contain vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both.
A vulnerability in Check Point FireWall-1 and VPN-1 may allow an intruder to pass traffic through the firewall on port 259/UDP.
A vulnerability in Oracle 8i allows remote intruders to assume control of database servers running on victim machines. If the Oracle server is running on a Windows system, an intruder may also be able to gain control of the underlying operating system.
A buffer overflow exists in the Solaris BSD-style line printer daemon, in.lpd, that may allow a remote intruder to execute arbitrary code with the privileges of the running daemon.
A problem with HTTP server component of Cisco IOS system software allows an intruder to execute privileged commands on Cisco routers if local authentication databases are used.
A vulnerability exists in the Indexing Services used by Microsoft IIS 4.0 and IIS 5.0 running on Windows NT, Windows 2000, and beta versions of Windows XP. This vulnerability allows a remote intruder to run arbitrary code on the victim machine. This advisory has been translated into Polish by CERT POLSKA.
A serious vulnerability in Microsoft IIS may allow remote intruders to execute commands on an IIS web server. This vulnerability closely resembles a previous vulnerability in IIS that was widely exploited. The CERT/CC urges IIS administrators to take action to correct this vulnerability.
The CERT/CC has received reports of a new piece of self-propagating malicious code (referred to here as the sadmind/IIS worm). The worm uses two well-known vulnerabilities to compromise systems and deface web pages.
A vulnerability exists in Microsoft IIS 5.0 running on Windows 2000 that allows a remote intruder to run arbitrary code on the victim machine, allowing them to gain complete administrative control of the machine.
A new vulnerability has been identified which is present when using random increments to constantly increase TCP ISN values over time. Systems are vulnerable if they have not incorporated RFC1948 or equivalent improvements or do not use cryptographically secure network protocols like IPsec.
The San Diego Supercomputer Center (SDSC) has recently discovered several vulnerabilities in the Alcatel Speed Touch Asymmetric Digital Subscriber Line (ADSL) modem.
Several File Transfer Protocol (FTP) servers incorrectly manage buffers in a way that can lead to remote intruders executing arbitrary code on the FTP server.
Microsoft Internet Explorer has a vulnerability triggered when parsing MIME parts in a document that allows a malicious agent to execute arbitrary code.
The CERT/CC has received numerous reports indicating that a vulnerability in snmpXdmid is being actively exploited. Exploitation of this vulnerability allows an intruder to gain privileged (root) access to the system.
On January 29 and 30, 2001, VeriSign, Inc. issues two certificates to an individual fraudulently claiming to be an employee of Microsoft Corporation. Any code signed by these certificates will appear to be legitimately signed by Microsoft when, in fact, it is not. Once accepted, these certificates may allow an attacker to execute malicious code on the user's system.
"VBS/OnTheFly" is a VBScript program that spreads via email. This malicious code can infect a system if the enclosed attachment is run.
Original release: January 29, 2001
Domain Name System (DNS) Servers running various versions of ISC BIND (including both 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3; 9.x is not affected) and derivatives. Because the normal operation of most services on the Internet depends on the proper operation of DNS servers, other services could be impacted if these vulnerabilities are exploited.
Interbase is an open source database package that had previously been distributed in a closed source fashion by Borland/Inprise. Both the open and closed source versions of the Interbase server contain a compiled-in back door account with a known password.
A popular replacement software package to the BSD lpd printing service called LPRng contains at least one software defect, known as a "format string vulnerability," which may allow remote users to execute arbitrary code on vulnerable systems.
A variety of denial-of-service vulnerabilities has been explored and documented by BindView's RAZOR Security Team. These vulnerabilities allow attackers to consume limited resources on victim machines.
The CERT Coordination Center has recently learned of two serious denial-of-service vulnerabilities in the Internet Software Consortium's (ISC) BIND software.
To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Sun Microsystems. Users who accept these certificates into their browser may inadvertently run malicious code signed by the compromised certificates.
Additional Decryption Keys (ADKs) is a feature of PGP (Pretty Good Privacy) that allows authorized extra decryption keys to be added to a user's public key certificate. However, an implementation flaw in PGP allows unsigned ADKs which have been maliciously added to a certificate to be used for encryption.
Last updated August 23, 2000
The CERT/CC has begun receiving reports of an input validation vulnerability in the rpc.statd program being exploited. This program is included, and often installed by default, in several popular Linux distributions.
Under certain conditions, Internet Explorer can open Microsoft Access database or project files containing malicious code and execute the code without giving a user prior warning. Access files that are referenced by OBJECT tags in HTML documents can allow attackers to execute arbitrary commands using Visual Basic for Applications or macros.
Netscape Communicator and Navigator ship with Java classes that allow an unsigned Java applet to access local and remote resources in violation of the security policies for applets.
Microsoft recently released Microsoft Security Bulletin MS00-046, in which they announced a patch for the "Cache Bypass" vulnerability. By exploiting this vulnerability, an attacker can use an HTML-formatted message to read certain types of files on the victim's machine.
A vulnerability involving an input validation error in the "site exec" command has recently been identified in the Washington University ftpd (wu-ftpd) software package. A similar but distinct vulnerability has also been identified that involves a missing format string in several setproctitle() calls. It affects a broader number of ftp daemons.
The HHCtrl ActiveX control has a serious vulnerability that allows remote intruders to execute arbitrary code, if the intruder can cause a compiled help file (CHM) to be stored "locally."
There are several potential buffer overflow vulnerabilities in the Kerberos authentication software. The most severe vulnerability allows remote intruders to disrupt normal operations of the Key Distribution Center (KDC) if an attacker is able to send malformed requests to a realm's key server. The vulnerabilities discussed in this advisory are different than the ones discussed in advisory CA-2000-06.
Several flaws exist in Microsoft Internet Explorer that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. These problems are different from the problems reported in CERT advisories CA-2000-05 and CA-2000-08, but they have a similar impact.
Under certain circumstances, PGP 5.0 generates keys that are not sufficiently random, which may allow an attacher to predict keys and, hence, recover information encrypted with that key.
A flaw exists in Netscape Navigator that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. Attackers can trick users into disclosing information intended for a legitimate web site if the user has previously accepted a certificate in which the name recorded in the certificate does not match the DNS name of the web site to which the user is connecting.
The Microsoft Office 2000 UA ActiveX control is incorrectly marked as "safe for scripting". This vulnerability may allow for an intruder to disable macro warnings in Office products and, subsequently, execute arbitrary code. This vulnerability may be exploited by viewing an HTML document via a web page, newsgroup posting, or email message.
There are several buffer overflow vulnerabilities in the Kerberos authentication software. The most severe vulnerability allows remote intruders to gain root privileges on systems running services using Kerberos authentication. If vulnerable services are enabled on the Key Distribution Center (KDC) system, the entire Kerberos domain may be compromised.
A flaw has been discovered in the way some web browsers validate SSL sessions. By exploiting this vulnerability, intruders may be able to deceive people into disclosing sensitive information (e.g. credit card numbers and other sensitive data) intended for a legitimate web site.
Last updated May 5, 2000
The Love Letter Worm is a malicious VBScript program that spreads in a variety of ways. Users can be infected by various means, including email, Windows file sharing, IRC, USENET news, and possibly via web pages.
There are continuing compromises of machines running the DNS software that is part of BIND (named). A significant number of delegated DNS servers in the in-addr.apra tree are running outdated versions of DNS software.
A web site may inadvertently include malicious HTML tags or script in a dynamically generated page based on unvalidated input from untrustworthy sources.
In addition to continued reports of denial-of-service problems, a denial-of-service tool called "stacheldraht" has been discovered.
A new denial-of-service tool known as Tribe FloodNet 2K was released; a weakness in certain versions of MacOS allows intruders to use MacOS 9 as a "traffic amplifier."
All versions of sadmind, part of Sun Microsystems' Solstice AdminSuite package, are vulnerable to a buffer overflow that can allow a remote user to execute arbitrary code with root privileges.
Some versions of sshd are vulnerable to a buffer overflow that can allow an intruder to influence certain variables internal to the program. This vulnerability alone does not allow an intruder to execute code. However, a vulnerability in RSAREF2 can be used in conjunction to allow remote intruder to execute arbitrary code.
Six vulnerabilities have been found in BIND, the popular domain name server from the Internet Software Consortium (ISC). One of these vulnerabilities may allow remote intruders to gain privileged access to name servers.
Last updated November 9, 1999
Three vulnerabilities have been identified in WU-FTPD and other ftp daemons based on the WU-FTPD source code. WU-FTPD is a common package used to provide File Transfer Protocol (FTP) services.
There is a buffer overflow vulnerability in the logging facility of the amd daemon. By exploiting this vulnerability, remote intruders can execute arbitrary code as the user running the amd daemon (usually root).
September 13, 1999
Multiple vulnerabilities have been identified in some distributions of the Common Desktop Environment (CDE). These vulnerabilities are different from those discussed in CA-1998-02.
July 30, 1999
A vulnerability has been discovered in the default configuration of Cobalt Networks RaQ2 servers that allows remote users to install arbitrary software packages to the system. This access can then be used to gain root privileges on the system.
The default configuration of SGI Array Services disables authentication and allows remote and local users to execute arbitrary commands as root.
There is a buffer overflow vulnerability in the Calendar Manager Service Daemon, rpc.cmsd. This vulnerability allows remote and local users to execute arbitrary code with the privileges of cmsd, typically root. A tool to exploit this vulnerability has been publicly released.
There is a buffer overflow vulnerability in Microsoft Internet Information Server (IIS) 4.0. A tool to exploit this vulnerability has been publicly released.
This advisory reports on the "ExploreZip" Trojan horse, which is propagated by email and which destroys files.
Last updated November 9, 1999
This advisory describes two vulnerabilities, one in statd and one in automountd, that are being used together by intruders to gain access to vulnerable systems. By combining attacks exploiting these two vulnerabilities, a remote intruder is able to execute arbitrary commands with the privileges of the automountd service. Note that the rpc.statd vulnerability described in this advisory is distinct from the vulnerabilities described in CERT Advisories CA-1996-09 and CA-1997-26.
At approximately 2:00 PM GMT-5 on Friday March 26 1999 we began receiving reports of a Microsoft Word 97 and Word 2000 macro virus which is propagating via email attachments. The number and variety of reports we have received indicate that this is a widespread attack affecting a variety of sites.
In text from Netect, Inc., this advisory presents information about remote buffer overflows that lead to potential root compromises in various FTP servers.
Over the past few weeks, we have received an increase in the number of incident reports related to Trojan horses. This advisory includes descriptions of some of those incidents, some general information about Trojan horses, and advice for system and network administrators, end users, software developers, and distributors.
The CERT Coordination Center has received confirmation that some copies of the source code for the TCP Wrappers tool (tcpd) were modified by an intruder and contain a Trojan horse. An intruder can gain unauthorized root access to any host running this Trojan horse version of TCP Wrappers.
A vulnerability in certain implementations of TCP/IP allows intruders to disrupt service or crash systems with vulnerable TCP/IP stacks. No special access is required, and intruders can use source-address spoofing to conceal their true location.
There is a vulnerability in some implementations of the software that NFS servers use to log requests to use file systems. Intruders who exploit the vulnerability are able to gain administrative access to the vulnerable NFS file server. That is, they can do anything the system administrator can do. This vulnerability can be exploited remotely and does not require an account on the target machine.
An implementation fault in the ToolTalk object database server allows a remote attacker to run arbitrary code as the superuser on hosts supporting the ToolTalk service. The affected program runs on many popular UNIX operating systems supporting CDE and some Open Windows installs. This vulnerability is being actively exploited by attackers on the Internet.
A vulnerability in some MIME-aware mail and news clients could allow an intruder to execute arbitrary code, crash the system, or gain administrative rights on vulnerable systems. The vulnerability affects a number of mail and news clients in addition to the ones which have been the subjects of reports published by Microsoft, Netscape, AUSCERT, CIAC, NTBugTraq, and others.
The CERT Coordination Center has received reports regarding a buffer overflow in some implementations of IMAP servers. This vulnerability allows remote intruders to execute arbitrary commands under the privileges of the process running the vulnerable IMAP server. If the vulnerable IMAP server is running as root, remote intruders can gain root access. This vulnerability is different from the one discussed in CERT Advisory CA-1997-09.
This advisory discusses reports of buffer overflows in some Post Office Protocol (POP) servers. The vulnerability allows remote users to gain privileged (root) access to systems running vulnerable versions of POP servers.
This advisory reports vulnerability in some implementations of products utilizing RSA Laboratories' Public-Key Cryptography Standard #1 (PKCS#1). Under some situations, a sophisticated intruder may be able to use the vulnerability in PKCS#1 to recover information from SSL-encrypted sessions.
Last updated November 9, 1999
This advisory reports a buffer overflow vulnerability that exists in some implementations of NIS+.
This advisory describes three distinct problems in BIND. Topic 1 describes a vulnerability that may allow a remote intruder to gain root access on your name server or to disrupt normal operation of your name server. Topics 2 and 3 deal with vulnerabilities that can allow an intruder to disrupt your name server.
This advisory reports an exploitation involving long file names on Microsoft Windows-based web servers.
This advisory details a vulnerability in the SSH cryptographic login program.
This advisory reports several vulnerabilities in some implementations of the Common Desktop Environment (CDE).
This advisory describes the "smurf" IP Denial-of-Service attacks. The attack described in this advisory is different from the denial-of-service attacks described in CERT advisory CA-97.28.
This advisory reports on two IP denial-of-service attacks.
This advisory discusses the use of the PORT command in the FTP protocol.
This advisory reports a vulnerability that exists in the statd(1M) program, available on a variety of Unix platforms.
This advisory reports a vulnerability in some CGI scripts. This problem allows an attacker to execute arbitrary commands on a WWW server under the effective user-id of the server process.
This advisory describes a buffer overrun vulnerability which exists in the Count.cgi cgi-bin program that allows intruders to force Count.cgi to execute arbitrary commands.
This advisory discusses a buffer overflow problem in rdist. It is a different vulnerability from the one described in CA-1996-14.
This advisory supersedes CA-1996-02
It describes a vulnerability in all versions of BIND before release 4.9.6, suggests several solutions, and provides pointers to the current version of bind.
In this advisory, we describe 6 buffer overflow problems in SGI IRIX systems. Problems affect the df, pset, eject, login/scheme, ordist, and xlock programs. Workarounds and a pointer to a wrapper are provided.
Last updated November 9, 1999
This advisory describes a vulnerability in BSD-based lpr printing software. Vendor information and a pointer to a wrapper are included.
This advisory addresses a buffer overflow condition in some versions of the at(1) program. Patch information and a workaround are provided.
This advisory addresses a buffer overflow condition in suidperl (sperl) built from Perl 4.n and Perl 5.n distributions on UNIX systems. It suggests several solutions and includes vendor information and a patch for Perl version 5.003.
This advisory describes a vulnerability in some versions of ftpd distributed and installed under various Unix platforms. Includes vendor information.
This advisory describes a vulnerability in the SGI login program when the LOCKOUT parameter is set to a number greater than zero. The vulnerability is present in IRIX 5.3 and 6.2, and perhaps other versions.
This advisory reports a vulnerability in metamail, a package that implements MIME. All versions of metamail through 2.7 are vulnerable.
This advisory reports a buffer overflow problem in some versions of xlock. This problem makes it possible for local users to execute arbitrary programs as a privileged user. Patch information and a workaround are included.
This advisory reports a vulnerability in the webdist.cgi-bin program, part of the IRIX Mindshare Out Box package, available with IRIX 5.x and 6.x. By exploiting this vulnerability, both local and remote users may be able to execute arbitrary commands with the privileges of the httpd daemon. A workaround is included.
This advisory reports a buffer overflow vulnerability in the Xt library of the X Windowing System. Vendor vulnerability and patch information are included.
This advisory reports a buffer overflow condition that affects some libraries using the Natural Language Service (NLS). Vendor vulnerability and patch information are included.
This advisory reports a vulnerability in some versions of the Internet Message Access Protocol (IMAP) and Post Office Protocol (POP) implementations (imapd, ipop2d, and ipop3d). Vendor and upgrade information are included.
Topic 2 issued April 3, 1997
This advisory describes two vulnerabilities in INN (the InterNetNews server). One affects versions 1.5 and earlier; the other affects 1.5.1 and earlier. The advisory includes pointers to version 1.5.1 and earlier. Updated information on the second vulnerability was added as "Topic 2." Pointers to all relevant patches are included, along with information from vendors.
This advisory points out a vulnerability in the nph-test-cgi script included with some http daemons. Readers are urged to disable the script. Vendor information is included.
This advisory reports a vulnerability in many implementations of the rlogin program, including eklogin and klogin. Vendor information and a workaround are included.
This advisory addresses a MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. The advisory includes vendor information, pointers to the latest version of sendmail, a workaround, and general precautions to take when using sendmail.
A vulnerability in talkd(8) program used by talk(1) makes it possible to provide corrupt DNS information to a host and to remotely execute arbitrary commands with root privileges. The advisory includes information on how to solve the general problem as well as the specific one.
A vulnerability in the csetup program under IRIX versions 5.x, 6.0, 6.0.1, 6.1, and 6.2 allows local users to create or overwrite arbitrary files on the system and ultimately gain root privileges. A workaround is provided.
This advisory describes a vulnerability in the newgrp(1) program under HP-UX 9.x and 10.x that may allow users to gain root privileges. A workaround is provided.
This advisory describes multi-platform UNIX FLEXlm vulnerabilities. These problems may allow local users to create arbitrary files on the system and execute arbitrary programs using the privileges of the user running the FLEXlm daemons.
This advisory describes a vulnerability in Hewlett-Packard SD-UX that may allow local users to gain root privileges. A workaround is included.
This advisory describes a denial-of-service attack using large ICMP datagrams issued via the ping command. Vendor information is included.
The advisory describes a security problem affecting sendmail version 8 relating to group-writable files. Vendor patches and a workaround are included.
It describes a security problem relating to the daemon mode in sendmail 8.7 through 8.8.2. The advisory also includes a note about two vulnerabilities in versions 8.8.0 and 8.8.1; these have been fixed as well.
This advisory describes a vulnerability in the WorkMan compact disc-playing program that affects UNIX System V Release 4.0 and derivatives and Linux systems.
This advisory addresses two problems with the GNU Project's Bourne Again SHell (bash): one in yy_string_get() and one in yy_readline_get().
** This advisory supersedes the IP spoofing portion of CA-1995-01. **
It describes denial-of-service attacks through TCP SYN flooding and IP spoofing. Advice about filtering is included.
This advisory describes a vulnerability in all versions of sendmail prior to 8.7.6, and includes a workaround and patch information.
** This advisory supersedes CA-1993-09 and CA-1993-09a. **
It provides information about a vulnerability in the expreserve utility. A workaround and vendor information are included.
This advisory reports a configuration problem in the floating license server for Adobe FrameMaker (fm_fls). A workaround is provided.
This advisory describes a vulnerability in the Solaris volume management daemon (vold) and gives a workaround.
This advisory describes a vulnerability in the Solaris admintool and gives a workaround.
This advisory describes a vulnerability in the Solaris 2.5 kcms programs and suggests a workaround.
** This advisory supersedes CA-1991-20 and CA-1994-04. **
It describes a vulnerability in the lookup subroutine of rdist, for which an exploitation script is available. Vendor information and a pointer to a new version of rdist are included.
This advisory describes a vulnerability in the dip program, which is shipped with most Linux systems. Other UNIX systems may also use it. Pointers to dip 3.3.7 are included.
This advisory describes a vulnerability in systems that contain the suidperl program and that support saved set-user-ID and saved set-group-ID. Patch information is included.
This advisory warns users not to put interpreters in a Web server's CGI bin directory and to evaluate all programs in that directory.
This advisory was originally released as AUSCERT advisory AA-96.02a. It describes a vulnerability and workarounds for versions of NIS+ in which the access rights on the NIS+ passwd table are left in an unsecure state.
This advisory describes a vulnerability in the rpc.statd (or statd) program that allows authorized users to remove or create any file that a root user can. Vendor information is included.
This advisory describes a vulnerability in the pcnfsd program (also known as rpc.pcnfsd). A patch is included.
This advisory describes a vulnerability in the Java bytecode verifier portion of Sun Microsystems' Java Development Kit (JDK) 1.0 and 1.0.1. Workarounds are provided for this product and Netscape Navigator 2.0 and 2.01, which have the JDK built in.
This advisory describes a problem with example CGI code, as found in the NCSA 1.5a-export and APACHE 1.0.3 httpd, and possibly previous distributions of both servers. Workarounds are provided.
This advisory describes a vulnerability in the Netscape Navigator 2.0 Java implementation and in Release 1.0 of the Java Developer's Kit from Sun Microsystems, Inc. Workarounds and pointers to a patch are included.
This advisory describes a vulnerability in network servers that can lead to corrupt information. The advisory includes information on subroutines for validating host names and IP addresses, patches for sendmail, and the status of vendor activity relating to the problem.
This advisory describes a problem with the Kerberos 4 key server, points to patches, and provides vendor information.
** Superseded by CA-1997-22 **
This advisory describes UDP port denial-of-service attacks, for which an exploitation script has been publicly posted. The advisory includes a workaround.
This advisory warns readers of attacks on hundreds of Internet sites in which intruders exploit known vulnerabilities, all of which have been addressed in previous CERT advisories. These advisories are listed.
December 12, 1995
This advisory describes a vulnerability in the rpc.ypupdated program, for which an exploitation program has been posted to several newsgroups. The advisory includes vendor information and a workaround.
November 30, 1995
This advisory describes a vulnerability in the wu-fptd SITE EXEC command and provides solutions for both Linux users and others.
November 8, 1995
This advisory points out accounts that are distributed without passwords and urges SGI customers to create passwords for those accounts.
November 1, 1995
This advisory describes a vulnerability with some telnet daemons and includes patch information from vendors, along with a workaround.
October 19, 1995
This advisory describes a general problem with syslog, lists vendor information about patches, and provides a workaround for solving the syslog problem in sendmail in particular.
October 18, 1995
The advisory describes a problem with the loadmodule(8) program in Sun OS 4.1.X and provides patch information.
September 19, 1995
August 31, 1995
This advisory describes a vulnerability involving the -dSAFER option in ghostscript versions 2.6 through 3.22 beta. The advisory includes instructions for fixing the problem and pointers to version 3.33 of ghostscript.
August 29, 1995
This advisory describes a vulnerability in Solaris that can be exploited if the permissions on the /tmp and /var/tmp directories are set incorrectly.
August 17, 1995
This advisory describes a vulnerability in sendmail v.5, which is still in use and which includes IDA sendmail. Many vendors have previously fixed the problem, others recently developed patches.
April 21, 1995
** This advisory replaces CA-1995-07.**
It is a revision that provides new information the problem described in CA-1995-07, and includes precautions to take when running SATAN. A tutorial by the SATAN authors, "SATAN Password Disclosure" is appended to the advisory.
April 10, 1995
** Superseded by CA-1995-07a. **
April 3, 1995
An overview of the Security Administrator Tool for Analyzing Networks (SATAN) based on the CERT staff's review of beta version 0.51. Includes list of vulnerabilities probed and advice on securing systems.
February 22, 1995
February 17, 1995
This advisory provides a patch for a vulnerability in the NCSA HTTP daemon version 1.3 for UNIX.
March 3, 1995
** This advisory supersedes CA-1995-03. **
Description and patch information for a security problem in the Berkeley Telnet clients that support encryption and Kerberos V4 authentication. It provides additional information.
February 16, 1995
** Superseded by CA-1995-03a. **
January 26, 1995
** This advisory supersedes CA-1991-01a and CA-1991-13. **
It addresses vulnerabilities in some versions of /bin/mail based on BSD 4.3 UNIX. It includes a list of vendor patches and source code for mail.local.c, an alternative to /bin/mail.
January 23, 1995
The IP spoofing portion of this advisory has been superseded by CA-1996-21. The description of the intruder activity of hijacking terminals is still current.
December 19, 1994
This advisory describes security measures to guard against several vulnerabilities in the Network File System (NFS). The advisory was prompted by an increase in root compromises by intruders using tools to exploit the vulnerabilities.
October 19, 1994
This advisory discusses a Trojan horse that was found in version 2.2.9 or ircII, the source code for the Internet Relay Chat (IRC) client for UNIX systems. For reasons described in the advisory, the CERT staff urges everyone to install ircII version 2.6.
August 11, 1994
This advisory addresses a vulnerability in the Silicon Graphics, Inc. IRIX 5.x Help system. SGI recommends installing the patch, but has provided a workaround to disable the Help system if this is not possible.
July 14, 1994
June 9, 1994
This advisory addresses two vulnerabilities in Majordomo versions prior to 1.92. CERT staff recommends installing version 1.92, but provides workarounds if this is not possible.
June 3, 1994
This advisory addresses a vulnerability in the batch queue (bsh) of IBM AIX systems running versions prior to and including AIX 3.2. CERT staff recommends a workaround to disable the bsh feature. IBM provides a patch for systems requiring this functionality.
May 23, 1994
This advisory addresses a vulnerability in /bin/login of all IBM AIX 3 systems, and Linux systems. A workaround and patch information are included in this advisory.
April 14, 1994
This advisory addresses two vulnerabilities with some releases of fptd and announces new versions and patches to correct these problems. ftpd versions affected are wuarchive ftpd 2.0-2.3, DECWRL ftpd versions prior to 5.93, and BSDI ftpd version 1.1 prior to patch level 5. The vulnerabilities addressed are the SITE EXEC and race condition vulnerabilities.
April 06, 1994
Warning about intruder-modified source for wuarchive ftpd, which introduced a Trojan horse in versions 2.2, 2.1f, and possibly earlier versions. Recommended solution is to upgrade to version 2.3.
March 21, 1994
This advisory addresses a vulnerability with /etc/utmp ins SunOS 4.1.X and Solaris 1.1.1 operating systems. Solbourne Computer, Inc. and other Sparc products using SunOS 4.1.X or Solaris 1.1.1 are also affected. Solaris 2.x is not affected by this problem.
March 18, 1994
This advisory gives the MD5 checksums for a number of SunOS files, along with a tool for checking them.
March 17, 1994
** Superseded by CA-1996-14. **
February 24, 1994
Vulnerabilities are present in the bosext1.extcmds.obj performance tools in AIX 3.2.5 and in those AIX 3.2.4 systems with Program Temporary Fixes (PTFs) U420020 or U422510 installed. These problems do not exist in earlier versions of AIX.
February 14, 1994
** This advisory supersedes CA-1991-09 and CA-1992-12.**
A vulnerability is present in SunOS 4.1, 4.1.1, 4.1.2, and 4.1.3 /usr/etc/rpc.mountd. Unauthorized remote hosts will be able to mount the file system. The advisory describes how to obtain a patch for the problem from Sun.
February 03, 1994
This advisory describes ongoing network monitoring attacks. All systems that offer remote access through rlogin, telnet, and ftp are at risk. The advisory includes a description of the activity and suggested approaches for addressing the problem.
December 16, 1993
Information about a vulnerability in the system startup scripts on Solaris 2.x and Solaris x86 systems.
December 15, 1993
** This advisory supersedes CA-1991-22. **
The advisory addresses a vulnerability in /usr/etc/modload and $OPENWINHOME/bin/loadmodule in in Sun Microsystems, Inc. SunOS 4.1.1, 4.1.2, 4.1.3, and 4.1.3c and OpenWindows 3.0 on all sun4 and Solbourne Computer, Inc. architectures.
November 11, 1993
This advisory addresses a vulnerability in the logging function of many versions of xterm. It provides information about several solutions.
January 07, 1994
November 04, 1993
October 21, 1993
This advisory describes several vulnerabilities in Sun operating systems: /usr/lib/sendmail (SunOS 4.1.x, Solaris 2.x), /bin/tar (Solaris 2.x), and dev/audio (SunOS 4.1.x, Solaris 2.x). The advisory includes patch and workaround information for these problems.
September 30, 1993
This advisory alerts Internet sites to a new software tool that is widely available. The advisory describes vulnerabilities probed by the Internet Security Scanner (ISS) software.
September 17, 1993
A vulnerability relating to the "dos" and "asg" accounts exists in numerous SCO Operating Systems releases. This advisory provides instructions for repairing the vulnerability.
September 16, 1993
A vulnerability exists in Novell's NetWare 4.x login program (LOGIN.EXE). This advisory provides details on the availability of a security-enhance version of the Novell Netware 4.x login program.
August 09, 1993
Vulnerabilities exist in versions of the UMN UNIX gopher and gopher+ server and client available before August 6, 1993. These vulnerabilities are present in UMN UNIX gopher and gopher+ versions which were available from boombox.micro.umn.edu and many other anonymous FTP sites. This advisory provides details on the severity of the vulnerabilities and the availability of new versions of UMN UNIX gopher and gopher+.
July 14, 1993
This advisory provides an updated version of the anonymous FTP configuration guidelines that is available from the CERT Coordination Center.
July 01, 1993
** Superseded by CA-1996-19. **
June 11, 1993
** Superseded by CA-1996-19. **
May 24, 1993
A vulnerability exists in several releases of SCO's Operating Systems. This vulnerability has the potential to deny legitimate users the ability to log onto the system. This advisory details information about releases available to correct this problem.
April 22, 1993
A vulnerability exists in Cisco routers such that a router which is configured to suppress source routed packets with the following command: "no ip source-route" may allow traffic which should be suppressed. This vulnerability applies to all models of Cisco routers, and occurs with the following releases of software: 8.2, 8.3, 9.0, 9.1, and 9.17. This advisory details information about releases available to correct this problem.
April 09, 1993
A vulnerability is present in versions of wuarchive ftpd available before April 8, 1993. This vulnerability is present in wuarchive ftpd versions which were available from wuarchive.wustl.edu and many other anonymous FTP sites. This advisory provides details on the severity of the vulnerability and (1) the availability of a new version of wuarchive ftpd and (2) availability of a patch for the problem.
February 24, 1993
A vulnerability is present with Digital Equipment Corporation's OpenVMS and OpenVMS AXP. This vulnerability is present in OpenVMS V5.0 through V5.5-2 and OpenVMS AXP V1.0 but has been corrected in OpenVMS V6.0 and OpenVMS AXP V1.5. This advisory provides details from Digital on the severity of the vulnerability and patch availability for the problem.
February 18, 1993
A vulnerability is present in the "finger" program of Commodore Business Machine's Amiga UNIX product and affects Commodore Amiga UNIX versions 1.1, 2.03, 2.1, 2.1p1, 2.1p2, and 2.1p2a. This advisory details the availability of a patch for the problem and provides a suggested workaround.
February 03, 1993
This advisory describes a patch that is available to correct the ownerships and permissions for a number of system files in SunOS 4.1, 4.1.1, 4.1.2, and 4.1.3. These have been fixed in SunOS 5.0. CERT staff has seen an increasing number of attackers exploit these problems on systems and we encourage sites to consider installing this patch.
January 21, 1993
This advisory provides information concerning vulnerabilities in the distributed printing facility ("_writers" properties) of NeXT computers running all releases of NeXTSTEP software through NeXTSTEP Release 3.0. The advisory details the availability of a patch for the problems and provides suggested workarounds.
January 13, 1993
** This advisory supersedes CA-1992-17. **
A vulnerability is present in Hewlett-Packard's HP/UX Operating System for series 300, 700, and 800 computers, which allows remote NIS servers unauthorized access to local NIS hosts. Patches from HP are available for all of the HP/UX level 8 releases (8.0, 8.02, 8.06, and 8.07). The problem is fixed in HP/UX 9.0.
December 16, 1992
This advisory provides information concerning several vulnerabilities in ConvexOS/Secure, CONVEX CXbatch, CONVEX Storage Manager (CSM), and ConvexOS EMACS. These vulnerabilities can affect ConvexOS versions V6.2 - V10.2 and ConvexOS/Secure versions V9.5 and V10.0 on all supported architectures. The advisory describes a workaround for one of the vulnerabilities and provides information on how to obtain a patches for the other problems from CONVEX Computer Corporation.
December 10, 1992
This advisory provides information concerning a vulnerability in Cisco router access lists when the "established" keyword is used. This vulnerability is present in Cisco software releases 8.2, 8.3, 9.0 and 9.1. The advisory describes workarounds and provides information on how to obtain a patch for the problem from Cisco.
December 07, 1992
This advisory provides information from the United States Department of Justice, General Litigation and Legal Advice Section, Criminal Division, regarding keystroke monitoring by computer systems administrators, as a method of protecting computer systems from unauthorized access. The CERT staff strongly suggests adding a notice banner such as the one included in the advisory to all systems. Sites not covered by U.S. law should consult their legal counsel.
November 17, 1992
** This advisory supersedes CA-1992-16. **
It provides additional information concerning availability of remedial image kits to correct a vulnerability present in the Monitor utility in VMS V5.0 through V5.4-2. The vulnerability has been corrected in V5.4-3 through V5.5-1.
October 05, 1992
** Superseded by CA-1993-01. **
September 22, 1992
** Superseded by CA-1992-18. **
July 21, 1992
** This advisory supersedes CA-1991-16. **
The advisory describes how to obtain various patches for SunOS 4.1, 4.1.1, and 4.1.2 for all Sun architectures. As the application of these patches involves rebuilding your system kernel, it is recommended that you apply all patches simultaneously.
June 22, 1992
Warning about a significant intrusion incident on the Internet. Urges all system administrators to check their systems for the signs of intrusion detailed in the advisory.
June 04, 1992
Vulnerabilities are present in NIS under SunOS 4.1, 4.1.1, and 4.1.2, and may or may not exist in earlier versions of NIS. The advisory describes how to obtain a patch for SunOS 4.1, 4.1.1, and 4.1.2 for the problem from Sun.
May 28, 1992
** Superseded by CA-1994-02. **
May 27, 1992
A vulnerability involving environment variables and setuid/setgid programs exists on all Sun architectures running SunOS 4.0 and higher. The advisory details how to obtain patches for SunOS programs which are known to be impacted by the vulnerability. The advisory contains a workaround to protect vulnerable binaries for which patches are unavailable for your SunOS version, or for local or third party software which may be vulnerable.
May 26, 1992
A vulnerability is present in crontab(1) in version 3.2 of AIX. This advisory describes how to implement a workaround for the problem until you obtain the patch for the problem from IBM.
April 27, 1992
A vulnerability is present in the anonymous FTP configuration in all versions of AIX. The advisory describes how to obtain a patch for the problem from IBM.
April 10, 1992
A vulnerability is present in the default configuration of the lp software in Silicon Graphics Computer Systems (SGI) IRIX operating systems. This vulnerability is present in all versions of IRIX, prior to IRIX 4.0.5. The advisory describes how to reconfigure the lp software in order to eliminate this vulnerability.
March 31, 1992
A vulnerability is present in the passwd command in AIX 3.2 and the 2007 update of AIX 3.1. The advisory describes how to disable the /bin/passwd until you obtain and install the patch for the problem from IBM.
March 19, 1992
A vulnerability is present in the UUCP software in versions of AIX up to 2007. The advisory describes how to disable UUCP and details how to obtain a patch for the problem from IBM.
March 05, 1992
The rexd daemon may be enabled by default in versions 3.1 and 3.2 of AIX for IBM RS/6000 machines. The advisory describes a fix for the problem and details how to obtain a patch for the problem from IBM.
February 25, 1992
A vulnerability is present in AT&T TCP/IP Release 4.0 running on SVR4 systems for both the 386/486 and 3B2 RISC platforms. The problem is in the remote execution server /usr/etc/rexecd and a new version of rexecd is available from AT&T.
February 17, 1992
Warning about a significant intrusion incident on the Internet. Urges all system administrators to check their systems for the signs of intrusion detailed in the advisory.
February 06, 1992
This advisory warns users of a PC virus called Michelangelo. The virus affects IBM PCs and compatibles, and has a trigger date of March 6 (any year).
January 20, 1992
A vulnerability is present in the default configuration in release 2 of NeXTstep's NetInfo. The advisory indicates where a description of how to configure NetInfo correctly can be obtained.
December 18, 1991
A vulnerability is present in the crp system in Hewlett Packard/Apollo Domain/OS in all SR10 versions. A workaround is available and patches for SR10.3 and SR10.4 will be available from Apollo at a future date.
December 16, 1991
** Superseded by CA-1993-18. **
December 06, 1991
Vulnerabilities concerning Sun Microsystems, Inc. (Sun) Network File System (NFS) and the fsirand program. These vulnerabilities affect SunOS versions 4.1.1, 4.1, and 4.0.3 on all architectures. Patches are available for SunOS 4.1.1. An initial patch for SunOS 4.1 NFS is also available. Sun will be providing complete patches for SunOS 4.1 and SunOS 4.0.3 at a later date.
October 22, 1991
** Superseded by CA-1996-14. **
October 17, 1991
Vulnerability in the TFTP daemon in all versions of AIX for IBM RS/6000 machines. Patch available from IBM for all AIX releases from "GOLD" to the current release.
September 27, 1991
Warning about automated tftp probes for /etc/passwd to Internet sites throughout the world. Urges all sites to carefully check their system configurations concerning tftp usage. Indicates how sites can secure their tftp configurations.
September 26, 1991
Vulnerability in Ultrix DECnet to Internet gateway software. This advisory details a workaround. The vulnerability affects Ultrix versions 4.0, 4.1, and 4.2.
September 18, 1991
** The patch cited in this advisory has been made obsolete by patches described in CA-1992-15. **
September 10, 1991
Vulnerability in PC and Mac telnet program by NCSA. This advisory details a workaround.
August 26, 1991
Vulnerability regarding the handling of mail messages on all Silicon Graphics IRIX Systems prior to version 4.0. The problem is fixed in version 4.0. Solution involves changing permissions and ownership of a system command.
August 23, 1991
** Superseded by CA-1995-02. **
August 22, 1991
Vulnerability in MANY Unix systems regarding the use of a minus sign ("-") as the first character in any hosts.equiv hosts.lpd, and/or .rhosts files. Workaround is to re-arrange the lines in these files such that the "-" is not the first character in the file.
August 14, 1991
Vulnerability in Ultrix LAT/Telnet gateway software on all Ultrix 4.1 and 4.2 systems. Patch available directly from DEC.
September 12, 1991
Vulnerability in SunOS 4.0.3, 4.1, and 4.1.1 /usr/lib/lpd. Patched versions are available. Version 10a of this advisory supersedes all prior versions.
July 15, 1991
** Superseded by CA-1994-02. **
May 23, 1991
Addresses a vulnerability in all System V Release 4 versions of /bin/login. Patch provided by AT&T.
May 20, 1991
Fixes a security vulnerability on SunOS (4.0.3, 4.1, and 4.1.1) systems which have installed the Sun Source tapes.
May 14, 1991
Addresses three vulnerabilities in NeXT systems running various versions of NeXTstep. Affected are. rexd(8C), /private/etc, username "me".
May 01, 1991
Corrects improper installation of /usr/bin/chroot for Ultrix versions 4.0 and 4.1.
April 18, 1991
This advisory is an addition to CA-1991-03. It addresses more bogus Internet email scams and urges system administrators to warn their users.
April 04, 1991
This advisory addresses recent bogus email messages which have been distributed on the Internet. The messages request that the user change his/her password, and appear to come from the system admin.
March 26, 1991
This advisory announces a security problem with the in.telnetd program in releases of SunOS 4.1 and 4.1.1.
February 22, 1991
** Superseded by CA-1995-02. **
December 21, 1990
This Advisory was a rebroadcast of a Sun Microsystems, Inc. Security Bulletin announcing the availability of a patch that corrects a problem with TIOCCONS. Problem Description: TIOCCONS can be used to re-direct console output/input away from "console"
December 10, 1990
Many sites on the Internet received messages on Sunday, December 9. The messages stated that a group of researchers and students were testing for a "common bug" in network hosts.
November 16, 1990
Message about alleged attacks on telephone systems. No evidence that rumors were substantiated.
November 09, 1990
Warning about techniques intruders were using to get access to VMS systems. No new vulnerabilities described; intruders were using weak password attacks.
October 31, 1990
Vulnerability in Silicon Graphics IRIX 3.3 and 3.3.1 systems. /usr/sbin/Mail has a security flaw.
October 25, 1990
Vulnerability in DEC VMS versions 4.0 through 5.4. Problem with ANALYZE/PROCESS_DUMP routine.
October 03, 1990
Describes several vulnerabilities in NeXT system software. The advisory was originally issued as 90-06; 90-06a includes several corrections.
August 14, 1990
Vulnerability in SunOS 3.*, 4.0.3, and 4.1 SunView selection_svc facility.
July 27, 1990
Vulnerability in Hewlett Packard/Apollo Domain/OS version sr10.2 and some beta versions of sr10.3. File /etc/suid_exec contained a security flaw.
May 07, 1990
Warning about Unisys U5000 systems. Some of the logins supplied when the system was shipped did not have passwords, and intruders were taking advantage of this vulnerability.
March 19, 1990
Warning about a series of attacks on Internet systems. Includes a list of 14 points to check on Unix and VMS systems. The points cover possible signs of a break-in as well as possible system configuration vulnerabilities.
January 29, 1990
Vulnerability in SunOS 3.* and 4.0.* sendmail.
October 26, 1989
Vulnerability in SunOS 4.0.x rcp command.
A repost of the 10/17 Ultrix advisory with checksums for several Ultrix system programs.
Warning about attacks on DEC/Ultrix 3.0 machines. Advises users to check for Trojan horses, insecure tftp, simple passwords.
October 17, 1989
Warning about the "WANK" worm which attacked DECnet hosts.
August 16, 1989
Warning about a series of break-ins in which an intruder replaced the telnet(1) program with a Trojan horse that captured passwords. Contains some general hints about securing systems.
July 26, 1989
Vulnerability in SunOS 4.0.* restore(8) command.
Report from Keith Bostic of BSD patch for passwd(1) program.
Warning about BSD sendmail 5.59 debug command; general warning about getting latest version of ftpd; other general warnings.
CERT and CERT Coordination Center are registered U.S. Patent and Trademark Office