CERT-SEI

CERT/CC Advisories

Note: CERT/CC advisories have become part of the US-CERT National Cyber Awareness System.

2003
CA-2003-28: Buffer Overflow in Windows Workstation Service

November 11, 2003

A buffer overflow vulnerability exists in Microsoft's Windows Workstation Service (WKSSVC.DLL).

A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.

CA-2003-27: Multiple Vulnerabilities in Microsoft Windows and Exchange

October 16, 2003

There are multiple vulnerabilities in Microsoft Windows and Microsoft Exchange, the most serious of which could allow remote attackers to execute arbitrary code.

CA-2003-26: Multiple Vulnerabilities in SSL/TLS Implementations

October 2, 2003

There are multiple vulnerabilities in different implementations of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. These vulnerabilities occur primarily in Abstract Syntax Notation One (ASN.1) parsing code. The most serious vulnerabilities may allow a remote attacker to execute arbitrary code. The common impact is denial of service.

CA-2003-25: Buffer Overflow in Sendmail

September 18, 2003

A vulnerability in sendmail could allow a remote attacker to execute arbitrary code with the privileges of the sendmail daemon, typically root.

CA-2003-24: Buffer Management Vulnerability in OpenSSH

September 16, 2003

There is a remotely exploitable vulnerability in a general buffer management function in versions of OpenSSH prior to 3.7. This may allow a remote attacker to corrupt heap memory which could cause a denial-of-service condition. It may also be possible for an attacker to execute arbitrary code.

CA-2003-23: RPCSS Vulnerabilities in Microsoft Windows

September 10, 2003

Microsoft has published a bulletin describing three vulnerabilities that affect numerous versions of Microsoft Windows. Two of these vulnerabilities are remotely exploitable buffer overflows that may allow an attacker to execute arbitrary code with system privileges. The third vulnerability may allow a remote attacker to cause a denial of service.

CA-2003-22: Multiple Vulnerabilities in Microsoft Internet Explorer

August 26, 2003

Microsoft Internet Explorer (IE) contains multiple vulnerabilities, the most serious of which could allow a remote attacker to execute arbitrary code with the privileges of the user running IE.

CA-2003-21: GNU Project FTP Server Compromise

August 13, 2003

The CERT/CC has received a report that the system housing the primary FTP servers for the GNU software project was compromised.

CA-2003-20: W32/Blaster worm

August 11, 2003

The CERT/CC is receiving reports of widespread activity related to a new piece of malicious code known as W32/Blaster. This worm appears to exploit known vulnerabilities in the Microsoft Remote Procedure Call (RPC) Interface.

CA-2003-19: Exploitation of Vulnerabilities in Microsoft RPC Interface

July 31, 2003

The CERT/CC is receiving reports of widespread scanning and exploitation of two recently discovered vulnerabilities in Microsoft Remote Procedure Call (RPC) Interface.

CA-2003-18: Integer Overflows in Microsoft Windows DirectX MIDI Library

July 25, 2003

A set of integer overflows exists in a DirectX library included in Microsoft Windows. An attacker could exploit this vulnerability to execute arbitrary code or to cause a denial of service.

CA-2003-17: Exploit Available for the Cisco IOS Interface Blocked Vulnerabilities

July 18, 2003

An exploit has been posted publicly for the vulnerability described in VU#411332, which was announced in

http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml
CA-2003-16: Buffer Overflow in Microsoft RPC

July 17, 2003

A buffer overflow vulnerability exists in Microsoft's Remote Procedure Call (RPC) implementation. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.

CA-2003-15 :Cisco IOS Interface Blocked by IPv4 Packet

July 16, 2003

A vulnerability in many versions of Cisco IOS could allow an intruder to execute a denial-of-service attack against a vulnerable device.

CA-2003-14: Buffer Overflow in Microsoft Windows HTML Conversion Library

July 14, 2003

A buffer overflow vulnerability exists in a shared HTML conversion library included in Microsoft Windows. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.

CA-2003-13: Multiple Vulnerabilities in Snort Preprocessors

April 17, 2003

There are two vulnerabilities in the Snort Intrusion Detection System, each in a separate preprocessor module. Both vulnerabilities allow remote attackers to execute arbitrary code with the privileges of the user running Snort, typically root.

CA-2003-12: Buffer Overflow in Sendmail

March 29, 2003

There is a vulnerability in sendmail that may allow remote attackers to gain the privileges of the sendmail daemon, typically root.

CA-2003-11: Multiple Vulnerabilities in Lotus Notes and Domino

March 26, 2003

Multiple vulnerabilities have been reported to affect Lotus Notes clients and Domino servers. Multiple reporters, the close timing, and some ambiguity caused confusion about what releases are vulnerable. We are issuing this advisory to help clarify the details of the vulnerabilities, the versions affected, and the patches that resolve these issues.

CA-2003-10: Integer overflow in Sun RPC XDR library routines

March 19, 2003

There is an integer overflow in the xdrmem_getbytes() function distributed as part of the Sun Microsystems XDR library. This overflow can cause remotely exploitable buffer overflows in multiple applications, leading to the execution of arbitrary code. Although the library was originally distributed by Sun Microsystems, multiple vendors have included the vulnerable code in their own implementations.

CA-2003-09: Buffer Overflow in Core Microsoft Windows DLL

Updated March 19, 2003
Released March 17, 2003

A buffer overflow vulnerability exists in the Win32 API libraries shipped with all versions of Microsoft Windows 2000. This vulnerability, which is being actively exploited on WebDAV-enabled IIS 5.0 servers, will allow a remote attacker to execute arbitrary code on unpatched systems. Sites running Microsoft Windows 2000 should apply a patch or disable WebDAV services as soon as possible.

CA-2003-08: Increased Activity Targeting Windows Shares

March 11, 2003

In recent weeks, the CERT/CC has observed an increase in the number of reports of systems running Windows 2000 and XP compromised due to poorly protected file shares.

CA-2003-07: Remote Buffer Overflow in Sendmail

March 3, 2003

There is a vulnerability in sendmail that may allow remote attackers to gain the privileges of the sendmail daemon, typically root.

CA-2003-06: Multiple vulnerabilities in implementations of the Session Initiation Protocol (SIP)

February 21, 2003

Numerous vulnerabilities have been reported in multiple vendors' implementations of the Session Initiation Protocol. These vulnerabilities may allow an attacker to gain unauthorized privileged access, cause denial-of-service attacks, or cause unstable system behavior.

CA-2003-05: Multiple Vulnerabilities in Oracle Servers

February 19, 2003

Multiple vulnerabilities exist in Oracle software that may lead to execution of arbitrary code; the ability to read, modify, or delete information stored in underlying Oracle databases; or denial of service. All of these vulnerabilites were discovered by Next Generation Security Software Ltd.

CA-2003-04: MS-SQL Server Worm

January 25, 2003

The CERT/CC has received reports of self-propagating malicious code that exploits multiple vulnerabilities in the Resolution Service of Microsoft SQL Server 2000. The propagation of this worm has caused varied levels of network degradation across the Internet, in addition to the compromise of vulnerable machines.

CA-2003-03: Buffer Overflow in Windows Locator Service

January 23, 2003

A buffer overflow vulnerability in the Microsoft Windows Locator service could allow a remote attacker to execute arbitrary code or cause the Windows Locator service to fail. This service is enabled and running by default on Windows 2000 domain controllers and Windows NT 4.0 domain controllers.

CA-2003-02: Double-Free Bug in CVS Server

January 22, 2003

A "double-free" vulnerability in the Concurrent Versions System (CVS) server could allow an unauthenticated, remote attacker with read-only access to execute arbitrary code, alter program operation, read sensitive information, or cause a denial of service.

CA-2003-01: Buffer Overflows in ISC DHCPD Minires Library

January 15, 2003

The Internet Software Consortium (ISC) has discovered several buffer overflow vulnerabilities in their implementation of DHCP (ISC DHCPD). These vulnerabilities may allow remote attackers to execute arbitrary code on affected systems. At this time, we are not aware of any exploits.

2002
CA-2002-37: Buffer Overflow in Microsoft Windows Shell

December 19, 2002

A buffer overflow vulnerability exists in the Microsoft Windows Shell. An attacker can exploit this vulnerability by enticing a victim to read a malicious email message, visit a malicious web page, or browse to a folder containing a malicious .MP3 or .WMA file. The attacker can then execute arbitrary code with the privileges of the victim.

CA-2002-36: Multiple Vulnerabilities in SSH Implementations

December 16, 2002

Multiple vendors' implementations of the secure shell (SSH) transport layer protocol contain vulnerabilities that could allow a remote attacker to execute arbitrary code with the privileges of the SSH process or cause a denial of service. The vulnerabilities affect SSH clients and servers, and they occur before user authentication takes place.

CA-2002-35: Vulnerability in RaQ Server Appliances

December 11, 2002

A remotely exploitable vulnerability has been discovered in Sun Cobalt RaQ 4 Server Appliances running Sun's Security Hardening Package (SHP). Exploitation of this vulnerability may allow remote attackers to execute arbitrary code with superuser privileges.

CA-2002-34: Buffer Overflow in Solaris X Window Font Service

November 25, 2002

The Solaris X Window Font Service (XFS) daemon (fs.auto) contains a remotely exploitable buffer overflow vulnerability that could allow an attacker to execute arbitrary code or cause a denial of service.

CA-2002-33: Heap Overflow Vulnerability in Microsoft Data Access Components (MDAC)

November 21, 2002

A vulnerability in the Microsoft Data Access Components (MDAC) could lead to remote execution of code with the privileges of the current process or user.

CA-2002-32: Backdoor in Alcatel OmniSwitch AOS

November 21, 2002

Alcatel has recently discovered a serious vulnerability in AOS version 5.1.1. Exploitation of this vulnerability can lead to full administrative control of the device running AOS.

CA-2002-31: Multiple Vulnerabilities in BIND

November 14, 2002

Multiple vulnerabilities with varying impacts have been found in BIND, the popular domain name server and client library software package from the Internet Software Consortium (ISC).

CA-2002-30: Trojan Horse tcpdump and libpcap Distributions

November 13, 2002

The CERT/CC has received reports that several of the released source code distributions of the libpcap and tcpdump packages were modified by an intruder and contain a Trojan horse. We strongly encourage sites that use, redistribute, or mirror the libpcap or tcpdump packages to immediately verify the integrity of their distribution.

CA-2002-29: Buffer Overflow in Kerberos Administration Daemon

October 25, 2002

Multiple Kerberos distributions contain a remotely exploitable buffer overflow in the Kerberos administration daemon. A remote attacker could exploit this vulnerability to gain root privileges on a vulnerable system.

CA-2002-28: Trojan Horse Sendmail Distribution

October 8, 2002

The CERT/CC has received confirmation that some copies of the source code for the Sendmail package were modified by an intruder to contain a Trojan horse. Sites that employ, redistribute, or mirror the Sendmail package should immediately verify the integrity of their distribution.

CA-2002-27: Apache/mod_ssl Worm

September 14,2002

The CERT/CC has received reports of self-propagating malicious code which exploits a vulnerability (VU#102795) in OpenSSL. This malicious code has been referred to as Apache/mod_ssl worm, linux.slapper.worm and bugtraq.c worm.

CA-2002-26: Buffer Overflow in CDE ToolTalk

August 12, 2002

The Common Desktop Environment (CDE) ToolTalk RPC database server contains a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code or cause a denial of service.

CA-2002-25: Integer Overflow In XDR Library

August 5, 2002

There is an integer overflow present in the xdr_array() function distributed as part of the Sun Microsystems XDR library. This overflow has been shown to lead to remotely exploitable buffer overflows in multiple applications, leading to the execution of arbitrary code. Although the library was originally distributed by Sun Microsystems, multiple vendors have included the vulnerable code in their own implementations.

CA-2002-24: Trojan Horse OpenSSH Distribution

August 1, 2002

The CERT/CC has received confirmation that some copies of the source code for the OpenSSH package were modified by an intruder and contain a Trojan horse. We strongly encourage sites which employ, redistribute, or mirror the OpenSSH package to immediately verify the integrity of their distribution.

CA-2002-23: Multiple Vulnerabilities in OpenSSL

July 30, 2002

There are four remotely exploitable buffer overflows in OpenSSL. There are also encoding problems in the ASN.1 library used by OpenSSL. Several of these vulnerabilities could be used by a remote attacker to execute arbitrary code on the target system. All could be used to create denial of service.

CA-2002-22: Multiple Vulnerabilities in Microsoft SQL Server

July 29, 2002

The Microsoft SQL Server contains several serious vulnerabilities that allow remote attackers to obtain sensitive information, alter database contents, compromise SQL servers, and, in some configurations, compromise server hosts.

CA-2002-21: Vulnerability in PHP

July 22, 2002

A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server.

CA-2002-20: Multiple Vulnerabilities in CDE ToolTalk

July 10, 2002

Two vulnerabilities have been discovered in the Common Desktop Environment (CDE) ToolTalk RPC database server. The first vulnerability could be used by a remote attacker to delete arbitrary files, cause a denial of service, or possibly execute arbitrary code or commands. The second vulnerability could allow a local attacker to overwrite arbitrary files with contents of the attacker's choice.

CA-2002-19: Buffer Overflows in Multiple DNS Resolver Libraries

June 28, 2002

Buffer overflow vulnerabilities exist in multiple implementations of DNS resolver libraries. Operating systems and applications that utilize vulnerable DNS resolver libraries may be affected.

CA-2002-18: OpenSSH Vulnerabilities in Challenge Response Handling

June 26, 2002

There are two related vulnerabilities in the challenge response handling code in OpenSSH versions 2.3.1p1 through 3.3. They may allow a remote intruder to execute arbitrary code as the user running sshd (often root). The first vulnerability affects OpenSSH versions 2.9.9 through 3.3, that have the challenge response option enabled, and use SKEY or BSD_AUTH authentication. The second vulnerability affects PAM modules using interactive keyboard authentication in OpenSSH versions 2.3.1p1 through 3.3, regardless of the challenge response option setting.

CA-2002-17: Apache Web Server Chunk Handling Vulnerability

June 17, 2002

There is a remotely exploitable vulnerability in the handling of large chunks of data in web servers that are based on Apache source code. This vulnerability is present by default in configurations of Apache web servers versions 1.3 through 1.3.24 and versions 2.0 through 2.0.36. The impact of this vulnerability is dependent upon the software version and the hardware platform the server is running on.

CA-2002-16: Multiple Vulnerabilities in Yahoo! Messenger

June 5, 2002

There are multiple vulnerabilities in Yahoo! Messenger. Attackers that are able to exploit these vulnerabilities may be able to execute arbitrary code with the privileges of the victim user.

CA-2002-15: Denial-of-Service Vulnerability in ISC BIND 9

June 4, 2002

A denial-of-service vulnerability exists in version 9 of the Internet Software Consortium's (ISC) Berkeley Internet Name Domain (BIND) server. ISC BIND versions 8 and 4 are not affected. Exploiting this vulnerability will cause the BIND server to shut down.

CA-2002-14: Buffer Overflow in Macromedia JRun

May 29, 2002

A remotely exploitable buffer overflow exists in Macromedia's JRun 3.0 and 3.1.

CA-2002-13: Buffer Overflow in Microsoft's MSN Chat ActiveX Control

May 10, 2002

Microsoft's MSN Chat is an ActiveX control for Microsoft Messenger, an instant messaging client. A buffer overflow exists in the ActiveX control that may permit a remote attacker to execute arbitrary code on the system with the privileges of the current user.

CA-2002-12: Format String Vulnerability in ISC DHCPD

May 8, 2002

The Internet Software Consortium (ISC) provides a Dynamic Host Configuration Protocol Daemon (DHCPD), which is a server that is used to allocate network addresses and assign configuration parameters to hosts. A format string vulnerability may permit a remote attacker to execute code with the privileges of the DHCPD (typically root).

CA-2002-11: Heap Overflow in Cachefs Daemon (cachefsd)

May 6, 2002

Sun's NFS/RPC file system cachefs daemon (cachefsd) is shipped and installed by default with Sun Solaris 2.5.1, 2.6, 7, and 8 (SPARC and Intel architectures). A remotely exploitable vulnerability exists in cachefsd that could permit a remote attacker to execute arbitrary code with the privileges of the cachefsd, typically root.

CA-2002-10: Format String Vulnerability in rpc.rwalld

May 1, 2002

The rwall daemon (rpc.rwalld) is a utility that is used to listen for wall requests on the network. When a request is received, it calls wall, which sends the message to all terminals of a time-sharing system. A format string vulnerability may permit an intruder to execute code with the privileges of the rwall daemon.

CA-2002-09: Multiple Vulnerabilities in Microsoft IIS

April 11, 2002

A variety of vulnerabilities exist in various versions of Microsoft IIS. Some of these vulnerabilities may allow an intruder to execute arbitrary code on vulnerable systems.

CA-2002-08: Multiple Vulnerabilities in Oracle Servers

March 14, 2002

Multiple vulnerabilities in Oracle Application Server have recently been discovered. These vulnerabilities include buffer overflows, insecure default settings, failures to enforce access controls, and failure to validate input. The impacts of these vulnerabilities include the execution of arbitrary commands or code, denial of service, and unauthorized access to sensitive information.

CA-2002-07: Double Free Bug in zlib Compression Library

March 12, 2002

There is a bug in the zlib compression library that may manifest itself as a vulnerability in programs that are linked with zlib. This may allow an attacker to conduct a denial-of-service attack, gather information, or execute arbitrary code.

CA-2002-06: Vulnerabilities in Various Implementations of the RADIUS Protocol

March 4, 2002

Remote Authentication Dial In User Service (RADIUS) servers are used for authentication, authorization and accounting for terminals that speak the RADIUS protocol. Multiple vulnerabilities have been discovered in several implementations of the RADIUS protocol.

CA-2002-05: Multiple Vulnerabilities in PHP fileupload

February 27, 2002

Multiple vulnerabilities exist in the PHP scripting language. These vulnerabilities could allow a remote attacker to execute arbitrary code with the privileges of the PHP process.

CA-2002-04: Buffer Overflow in Microsoft Internet Explorer

February 25, 2002

Microsoft Internet Explorer contains a buffer overflow vulnerability in its handling of embedded objects in HTML documents. This vulnerability could allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.

CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP)

February 12, 2002

Numerous vulnerabilities have been reported in multiple vendor SNMP implementations. These vulnerabilities may allow unauthorized privileged access, denial-of-service attacks, or unstable behavior. If your site uses SNMP in any capacity, the CERT/CC encourages you to read this advisory and follow the advice provided in the solution section.

CA-2002-02: Buffer Overflow in AOL ICQ

January 24, 2002

There is a remotely exploitable buffer overflow in ICQ. Attackers that are able to exploit the vulnerability may be able to execute arbitrary code with the privileges of the victim user. Full details are discussed in VU#570167. An exploit is known to exist, but we do not believe it has been distributed in the wild. We have not seen active scanning for this vulnerability, nor have we received any reports of this vulnerability being exploited.

CA-2002-01: Exploitation of Vulnerability in CDE Subprocess Control Service

January 14, 2002

The CERT/CC has received credible reports of scanning and exploitation of Solaris systems running the CDE Subprocess Control Service buffer overflow vulnerability identified in CA-2001-31 and discussed in VU#172583.

2001
CA-2001-37: Buffer Overflow in UPnP Service on Microsoft Windows

December 20, 2001

Vulnerabilities in software included by default on Microsoft Windows XP, and optionally on Windows ME and Windows 98, may allow an intruder to execute arbitrary code on vulnerable systems, to launch denial-of-service attacks against vulnerable systems, or to use vulnerable systems to launch denial-of-service attacks against third-party systems.

CA-2001-36: Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME Headers

December 19, 2001

Microsoft Internet Explorer contains a vulnerability in its handling of certain MIME headers in web pages and HTML email messages. This vulnerability may allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.

CA-2001-35: Recent Activity Against Secure Shell Daemons

December 13, 2001

There are multiple vulnerabilities in several implementations of the Secure Shell (SSH) protocol. The SSH protocol enables a secure communications channel from a client to a server. We are seeing a high amount of scanning for SSH daemons, and we are receiving reports of exploitation.

CA-2001-34: Buffer Overflow in System V Derived Login

December 12, 2001

Several applications use login for authentication to the system. A remotely exploitable buffer overflow exists in login derived from System V. Attackers can exploit this vulnerability to gain root access to the server.

CA-2001-33: Multiple Vulnerabilities in WU-FTPD

November 29, 2001

WU-FTPD is a widely deployed software package used to provide File Transport Protocol (FTP) services on UNIX and Linux systems. There are two vulnerabilities in WU-FTPD that expose a system to potential remote root compromise by anyone with access to the FTP service.

CA-2001-32: HP-UX Line Printer Daemon Vulnerable to Directory Traversal

November 21, 2001

The HP-UX line printer daemon (rlpdaemon) enables various clients to share printers over a network. A remotely exploitable buffer overflow vulnerability exists in the rlpdaemon.

CA-2001-31: Buffer Overflow in CDE Subprocess Control Service

November 12, 2001

There is a remotely exploitable buffer overflow vulnerability in a library function used by the CDE Subprocess Control Service. This vulnerability could be used to crash the service or to execute arbitrary code with root privileges.

CA-2001-30: Multiple Vulnerabilities in lpd

November 5, 2001

There are multiple vulnerabilities in several implementations of the line printer daemon (lpd). The line printer daemon enables various clients to share printers over a network.

CA-2001-29: Oracle9iAS Web Cache vulnerable to buffer overflow

October 25, 2001

A remotely exploitable buffer overflow in the Oracle9iAS Web Cache allows intruders to execute arbitrary code or disrupt the normal operation of Web Cache.

CA-2001-28: Automatic Execution of Macros

October 8, 2001

An intruder can include a specially crafted macro in a Microsoft Excel or PowerPoint document that can avoid detection and run automatically regardless of the security settings specified by the user.

CA-2001-27: Format String Vulnerability in CDE ToolTalk

October 5, 2001

There is a remotely exploitable format string vulnerability in the CDE ToolTalk RPC database service. This vulnerability could be used to crash the service or execute arbitrary code, potentially allowing an intruder to gain root access.

CA-2001-26: Nimda Worm

September 18, 2001

The CERT/CC has received reports of new malicious code known as the "W32/Nimda worm" or the "Concept Virus (CV) v.5." This new worm appears to spread by multiple mechanisms.

CA-2001-25: Buffer Overflow in Gauntlet Firewall allows intruders to execute arbitrary code

September 6, 2001

A vulnerability for a remotely exploitable buffer overflow exists in Gauntlet Firewall by PGP Security.

CA-2001-24: Vulnerability in OpenView and NetView

August 15, 2001

ovactiond is a component of OpenView by Hewlett-Packard Company (HP) and NetView by Tivoli, an IBM Company (Tivoli). These products are used to manage large systems and networks. There is a serious vulnerability in ovactiond that allows intruders to execute arbitrary commands with elevated privileges. This may subsequently lead to an intruder gaining administrative control of a vulnerable machine.

CA-2001-23: Continued Threat of the "Code Red" Worm

July 26, 2001

Since around July 13, 2001, at least two variants of the self-propagating malicious code "Code Red" have been attacking hosts on the Internet (see CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL. Different organizations who have analyzed "Code Red" have reached different conclusions about the behavior of infected machines when their system clocks roll over to the next month. This advisory has been translated into Polish by CERT POLSKA.

CA-2001-22: W32/Sircam Malicious Code

July 25, 2001

"W32/Sircam" is malicious code that spreads through email and potentially through unprotected network shares. Once the malicious code has been executed on a system, it may reveal or delete sensitive information.

CA-2001-21: Buffer Overflow in telnetd

July 24, 2001

The telnetd program is a server for the Telnet remote virtual terminal protocol. There is a remotely exploitable buffer overflow in Telnet daemons derived from BSD source code. This vulnerability can crash the server or be leveraged to gain root access.

CA-2001-20: Continuing Threats to Home Users

July 20, 2001

This year, we have seen a significant increase in activity resulting in compromises of home user machines. In many cases, these machines are then used by intruders to launch attacks against other organizations. Home users have generally been the least prepared to defend against attacks. Many home users do not keep their machines up to date with security patches and workarounds, do not run current anti-virus software, and do not exercise caution when handling email attachments. Intruders know this, and we have seen a marked increase in intruders specifically targeting home users who have cable modem and DSL connections.

CA-2001-19: "Code Red" Worm Exploiting Buffer Overflow in IIS Indexing Service DLL

July 19, 2001

The CERT/CC has received reports of new self-propagating malicious code that exploits certain configurations of Microsoft Windows susceptible to the vulnerability described in CERT advisory CA-2001-13 Buffer Overflow In IIS Indexing Service DLL. These reports indicate that the "Code Red" worm may have already affected as many as 225,000 hosts, and continues to spread rapidly. This advisory has been translated into Polish by CERT POLSKA.

CA-2001-18: Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol (LDAP)

July 16, 2001

Several implementations of the Lightweight Directory Access Protocol (LDAP) protocol contain vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both.

CA-2001-17: Check Point RDP Bypass Vulnerability

July 9, 2001

A vulnerability in Check Point FireWall-1 and VPN-1 may allow an intruder to pass traffic through the firewall on port 259/UDP.

CA-2001-16: Oracle 8i contains buffer overflow in TNS listener

July 3, 2001

A vulnerability in Oracle 8i allows remote intruders to assume control of database servers running on victim machines. If the Oracle server is running on a Windows system, an intruder may also be able to gain control of the underlying operating system.

CA-2001-15: Buffer Overflow in Sun Solaris in.lpd Print Daemon

June 29, 2001

A buffer overflow exists in the Solaris BSD-style line printer daemon, in.lpd, that may allow a remote intruder to execute arbitrary code with the privileges of the running daemon.

CA-2001-14: Cisco IOS HTTP Server Authentication Vulnerability

June 28, 2001

A problem with HTTP server component of Cisco IOS system software allows an intruder to execute privileged commands on Cisco routers if local authentication databases are used.

CA-2001-13: Buffer Overflow In IIS Indexing Service DLL

June 19, 2001

A vulnerability exists in the Indexing Services used by Microsoft IIS 4.0 and IIS 5.0 running on Windows NT, Windows 2000, and beta versions of Windows XP. This vulnerability allows a remote intruder to run arbitrary code on the victim machine. This advisory has been translated into Polish by CERT POLSKA.

CA-2001-12: Superfluous Decoding Vulnerability in IIS

May 15, 2001

A serious vulnerability in Microsoft IIS may allow remote intruders to execute commands on an IIS web server. This vulnerability closely resembles a previous vulnerability in IIS that was widely exploited. The CERT/CC urges IIS administrators to take action to correct this vulnerability.

CA-2001-11: sadmind/IIS Worm

May 8, 2001

The CERT/CC has received reports of a new piece of self-propagating malicious code (referred to here as the sadmind/IIS worm). The worm uses two well-known vulnerabilities to compromise systems and deface web pages.

CA-2001-10: Buffer Overflow Vulnerability in Microsoft IIS 5.0

May 2, 2001

A vulnerability exists in Microsoft IIS 5.0 running on Windows 2000 that allows a remote intruder to run arbitrary code on the victim machine, allowing them to gain complete administrative control of the machine.

CA-2001-09: Statistical Weaknesses in TCP/IP Initial Sequence Numbers

May 1, 2001

A new vulnerability has been identified which is present when using random increments to constantly increase TCP ISN values over time. Systems are vulnerable if they have not incorporated RFC1948 or equivalent improvements or do not use cryptographically secure network protocols like IPsec.

CA-2001-08: Multiple Vulnerabilities in Alcatel ADSL Modems

April 10, 2001

The San Diego Supercomputer Center (SDSC) has recently discovered several vulnerabilities in the Alcatel Speed Touch Asymmetric Digital Subscriber Line (ADSL) modem.

CA-2001-07: File Globbing Vulnerabilities in Various FTP Servers

April 10, 2001

Several File Transfer Protocol (FTP) servers incorrectly manage buffers in a way that can lead to remote intruders executing arbitrary code on the FTP server.

CA-2001-06: Automatic Execution of Embedded MIME Types

April 3, 2001

Microsoft Internet Explorer has a vulnerability triggered when parsing MIME parts in a document that allows a malicious agent to execute arbitrary code.

CA-2001-05: Exploitation of snmpXdmid

March 30, 2001

The CERT/CC has received numerous reports indicating that a vulnerability in snmpXdmid is being actively exploited. Exploitation of this vulnerability allows an intruder to gain privileged (root) access to the system.

CA-2001-04: Unauthentic "Microsoft corporation" Certificates

March 22, 2001

On January 29 and 30, 2001, VeriSign, Inc. issues two certificates to an individual fraudulently claiming to be an employee of Microsoft Corporation. Any code signed by these certificates will appear to be legitimately signed by Microsoft when, in fact, it is not. Once accepted, these certificates may allow an attacker to execute malicious code on the user's system.

CA-2001-03: VBS/OnTheFly (Anna Kournikova) Malicious Code

February 12, 2001

"VBS/OnTheFly" is a VBScript program that spreads via email. This malicious code can infect a system if the enclosed attachment is run.

CA-2001-02: Multiple Vulnerabilities in BIND

Last revised: February 2, 2001—added Appendix B, which answers frequently asked questions
Original release: January 29, 2001

Domain Name System (DNS) Servers running various versions of ISC BIND (including both 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3; 9.x is not affected) and derivatives. Because the normal operation of most services on the Internet depends on the proper operation of DNS servers, other services could be impacted if these vulnerabilities are exploited.

CA-2001-01: Interbase Server Contains Compiled-in Back Door Account

January 10, 2001

Interbase is an open source database package that had previously been distributed in a closed source fashion by Borland/Inprise. Both the open and closed source versions of the Interbase server contain a compiled-in back door account with a known password.


2000
CA-2000-22: Input Validation Problems in LPRng

December 12, 2000

A popular replacement software package to the BSD lpd printing service called LPRng contains at least one software defect, known as a "format string vulnerability," which may allow remote users to execute arbitrary code on vulnerable systems.

CA-2000-21: Denial-of-Service Vulnerabilities in TCP/IP Stacks

November 30, 2000

A variety of denial-of-service vulnerabilities has been explored and documented by BindView's RAZOR Security Team. These vulnerabilities allow attackers to consume limited resources on victim machines.

CA-2000-20: Multiple Denial-of-Service Problems in ISC BIND

November 13, 2000

The CERT Coordination Center has recently learned of two serious denial-of-service vulnerabilities in the Internet Software Consortium's (ISC) BIND software.

CA-2000-19: Revocation of Sun Microsystems Browser Certificates

October 25, 2000

To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Sun Microsystems. Users who accept these certificates into their browser may inadvertently run malicious code signed by the compromised certificates.

CA-2000-18: PGP May Encrypt Data With Unauthorized ADKs

August 24, 2000

Additional Decryption Keys (ADKs) is a feature of PGP (Pretty Good Privacy) that allows authorized extra decryption keys to be added to a user's public key certificate. However, an implementation flaw in PGP allows unsigned ADKs which have been maliciously added to a certificate to be used for encryption.

CA-2000-17: Input Validation Problem In rpc.statd

August 18, 2000
Last updated August 23, 2000

The CERT/CC has begun receiving reports of an input validation vulnerability in the rpc.statd program being exploited. This program is included, and often installed by default, in several popular Linux distributions.

CA-2000-16: Microsoft "IE Script"/Access/OBJECT Tag Vulnerability

August 11, 2000

Under certain conditions, Internet Explorer can open Microsoft Access database or project files containing malicious code and execute the code without giving a user prior warning. Access files that are referenced by OBJECT tags in HTML documents can allow attackers to execute arbitrary commands using Visual Basic for Applications or macros.

CA-2000-15: Netscape Allows Java Applets to Read Protected Resources

August 10, 2000

Netscape Communicator and Navigator ship with Java classes that allow an unsigned Java applet to access local and remote resources in violation of the security policies for applets.

CA-2000-14: Microsoft Outlook and Outlook Express Cache Bypass Vulnerability

July 26, 2000

Microsoft recently released Microsoft Security Bulletin MS00-046, in which they announced a patch for the "Cache Bypass" vulnerability. By exploiting this vulnerability, an attacker can use an HTML-formatted message to read certain types of files on the victim's machine.

CA-2000-13: Two Input Validation Problems In FTPD

July 7, 2000

A vulnerability involving an input validation error in the "site exec" command has recently been identified in the Washington University ftpd (wu-ftpd) software package. A similar but distinct vulnerability has also been identified that involves a missing format string in several setproctitle() calls. It affects a broader number of ftp daemons.

CA-2000-12: HHCtrl ActiveX Control Allows Local Files to be Executed

June 19, 2000

The HHCtrl ActiveX control has a serious vulnerability that allows remote intruders to execute arbitrary code, if the intruder can cause a compiled help file (CHM) to be stored "locally."

CA-2000-11: MIT Kerberos Vulnerable to Denial-of-Service Attacks

June 9, 2000

There are several potential buffer overflow vulnerabilities in the Kerberos authentication software. The most severe vulnerability allows remote intruders to disrupt normal operations of the Key Distribution Center (KDC) if an attacker is able to send malformed requests to a realm's key server. The vulnerabilities discussed in this advisory are different than the ones discussed in advisory CA-2000-06.

CA-2000-10: Inconsistent Warning Messages in Internet Explorer

June 6, 2000

Several flaws exist in Microsoft Internet Explorer that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. These problems are different from the problems reported in CERT advisories CA-2000-05 and CA-2000-08, but they have a similar impact.

CA-2000-09: Flaw in PGP 5.0 Key Generation

May 30, 2000

Under certain circumstances, PGP 5.0 generates keys that are not sufficiently random, which may allow an attacher to predict keys and, hence, recover information encrypted with that key.

CA-2000-08: Inconsistent Warning Messages in Netscape Navigator

May 26, 2000

A flaw exists in Netscape Navigator that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. Attackers can trick users into disclosing information intended for a legitimate web site if the user has previously accepted a certificate in which the name recorded in the certificate does not match the DNS name of the web site to which the user is connecting.

CA-2000-07: Microsoft Office 2000 UA ActiveX Control Incorrectly Marked "Safe for Scripting"

May 24, 2000

The Microsoft Office 2000 UA ActiveX control is incorrectly marked as "safe for scripting". This vulnerability may allow for an intruder to disable macro warnings in Office products and, subsequently, execute arbitrary code. This vulnerability may be exploited by viewing an HTML document via a web page, newsgroup posting, or email message.

CA-2000-06: Multiple Buffer Overflows in Kerberos Authenticated Services

May 17, 2000

There are several buffer overflow vulnerabilities in the Kerberos authentication software. The most severe vulnerability allows remote intruders to gain root privileges on systems running services using Kerberos authentication. If vulnerable services are enabled on the Key Distribution Center (KDC) system, the entire Kerberos domain may be compromised.

CA-2000-05: Netscape Navigator Improperly Validates SSL Sessions

May 12, 2000

A flaw has been discovered in the way some web browsers validate SSL sessions. By exploiting this vulnerability, intruders may be able to deceive people into disclosing sensitive information (e.g. credit card numbers and other sensitive data) intended for a legitimate web site.

CA-2000-04: Love Letter Worm

May 4, 2000
Last updated May 5, 2000

The Love Letter Worm is a malicious VBScript program that spreads in a variety of ways. Users can be infected by various means, including email, Windows file sharing, IRC, USENET news, and possibly via web pages.

CA-2000-03: Continuing Compromises of DNS servers

April 26, 2000

There are continuing compromises of machines running the DNS software that is part of BIND (named). A significant number of delegated DNS servers in the in-addr.apra tree are running outdated versions of DNS software.

CA-2000-02: Malicious HTML Tags Embedded in Client Requests

February 2, 2000

A web site may inadvertently include malicious HTML tags or script in a dynamically generated page based on unvalidated input from untrustworthy sources.

CA-2000-01: Denial-of-Service Developments

January 3, 2000

In addition to continued reports of denial-of-service problems, a denial-of-service tool called "stacheldraht" has been discovered.


1999
CA-1999-17: Denial-of-Service Tools

December 28, 1999

A new denial-of-service tool known as Tribe FloodNet 2K was released; a weakness in certain versions of MacOS allows intruders to use MacOS 9 as a "traffic amplifier."

CA-1999-16: Buffer Overflow in Sun Solstice AdminSuite Daemon sadmind

December 14, 1999

All versions of sadmind, part of Sun Microsystems' Solstice AdminSuite package, are vulnerable to a buffer overflow that can allow a remote user to execute arbitrary code with root privileges.

CA-1999-15: Buffer Overflows in SSH daemon and RSAREF2 Library

December 13, 1999

Some versions of sshd are vulnerable to a buffer overflow that can allow an intruder to influence certain variables internal to the program. This vulnerability alone does not allow an intruder to execute code. However, a vulnerability in RSAREF2 can be used in conjunction to allow remote intruder to execute arbitrary code.

CA-1999-14: Multiple Vulnerabilities in BIND

November 10, 1999

Six vulnerabilities have been found in BIND, the popular domain name server from the Internet Software Consortium (ISC). One of these vulnerabilities may allow remote intruders to gain privileged access to name servers.

CA-1999-13: Multiple Vulnerabilities in WU-FTPD

October 19, 1999
Last updated November 9, 1999

Three vulnerabilities have been identified in WU-FTPD and other ftp daemons based on the WU-FTPD source code. WU-FTPD is a common package used to provide File Transfer Protocol (FTP) services.

CA-1999-12: Buffer Overflow in amd

September 16, 1999

There is a buffer overflow vulnerability in the logging facility of the amd daemon. By exploiting this vulnerability, remote intruders can execute arbitrary code as the user running the amd daemon (usually root).

CA-1999-11: Four Vulnerabilities in the Common Desktop Environment

September 13, 1999

Multiple vulnerabilities have been identified in some distributions of the Common Desktop Environment (CDE). These vulnerabilities are different from those discussed in CA-1998-02.

CA-1999-10: Insecure Default Configuration on RaQ2 Servers

July 30, 1999

A vulnerability has been discovered in the default configuration of Cobalt Networks RaQ2 servers that allows remote users to install arbitrary software packages to the system. This access can then be used to gain root privileges on the system.

CA-1999-09: Array Services default configuration

July 19, 1999

The default configuration of SGI Array Services disables authentication and allows remote and local users to execute arbitrary commands as root.

CA-1999-08: Buffer overflow vulnerability in rpc.cmsd

July 16, 1999

There is a buffer overflow vulnerability in the Calendar Manager Service Daemon, rpc.cmsd. This vulnerability allows remote and local users to execute arbitrary code with the privileges of cmsd, typically root. A tool to exploit this vulnerability has been publicly released.

CA-1999-07: IIS Buffer Overflow

June 16, 1999

There is a buffer overflow vulnerability in Microsoft Internet Information Server (IIS) 4.0. A tool to exploit this vulnerability has been publicly released.

CA-1999-06: ExploreZip Trojan Horse Program

June 10, 1999

This advisory reports on the "ExploreZip" Trojan horse, which is propagated by email and which destroys files.

CA-1999-05: Vulnerability in statd exposes vulnerability in automountd

June 9, 1999
Last updated November 9, 1999

This advisory describes two vulnerabilities, one in statd and one in automountd, that are being used together by intruders to gain access to vulnerable systems. By combining attacks exploiting these two vulnerabilities, a remote intruder is able to execute arbitrary commands with the privileges of the automountd service. Note that the rpc.statd vulnerability described in this advisory is distinct from the vulnerabilities described in CERT Advisories CA-1996-09 and CA-1997-26.

CA-1999-04: Melissa Macro Virus

March 27, 1999

At approximately 2:00 PM GMT-5 on Friday March 26 1999 we began receiving reports of a Microsoft Word 97 and Word 2000 macro virus which is propagating via email attachments. The number and variety of reports we have received indicate that this is a widespread attack affecting a variety of sites.

CA-1999-03: FTP Buffer Overflows

February 11, 1999

In text from Netect, Inc., this advisory presents information about remote buffer overflows that lead to potential root compromises in various FTP servers.

CA-1999-02: Trojan Horses

February 5, 1999

Over the past few weeks, we have received an increase in the number of incident reports related to Trojan horses. This advisory includes descriptions of some of those incidents, some general information about Trojan horses, and advice for system and network administrators, end users, software developers, and distributors.

CA-1999-01: Trojan TCP Wrappers

January 21, 1999

The CERT Coordination Center has received confirmation that some copies of the source code for the TCP Wrappers tool (tcpd) were modified by an intruder and contain a Trojan horse. An intruder can gain unauthorized root access to any host running this Trojan horse version of TCP Wrappers.


1998
CA-1998-13: Vulnerability in Certain TCP/IP Implementations

December 21, 1998

A vulnerability in certain implementations of TCP/IP allows intruders to disrupt service or crash systems with vulnerable TCP/IP stacks. No special access is required, and intruders can use source-address spoofing to conceal their true location.

CA-1998-12: Remotely Exploitable Buffer Overflow Vulnerability in mountd

October 12, 1998

There is a vulnerability in some implementations of the software that NFS servers use to log requests to use file systems. Intruders who exploit the vulnerability are able to gain administrative access to the vulnerable NFS file server. That is, they can do anything the system administrator can do. This vulnerability can be exploited remotely and does not require an account on the target machine.

CA-1998-11: Vulnerability in Tooltalk RPC Service

September 3, 1998

An implementation fault in the ToolTalk object database server allows a remote attacker to run arbitrary code as the superuser on hosts supporting the ToolTalk service. The affected program runs on many popular UNIX operating systems supporting CDE and some Open Windows installs. This vulnerability is being actively exploited by attackers on the Internet.

CA-1998-10: Buffer Overflow in MIME-aware Mail and News Clients

August 11, 1998

A vulnerability in some MIME-aware mail and news clients could allow an intruder to execute arbitrary code, crash the system, or gain administrative rights on vulnerable systems. The vulnerability affects a number of mail and news clients in addition to the ones which have been the subjects of reports published by Microsoft, Netscape, AUSCERT, CIAC, NTBugTraq, and others.

CA-1998-09: Buffer Overflow in Some Implementations of IMAP Servers

July 20, 1998

The CERT Coordination Center has received reports regarding a buffer overflow in some implementations of IMAP servers. This vulnerability allows remote intruders to execute arbitrary commands under the privileges of the process running the vulnerable IMAP server. If the vulnerable IMAP server is running as root, remote intruders can gain root access. This vulnerability is different from the one discussed in CERT Advisory CA-1997-09.

CA-1998-08: Buffer Overflows in Some POP Servers

July 14, 1998

This advisory discusses reports of buffer overflows in some Post Office Protocol (POP) servers. The vulnerability allows remote users to gain privileged (root) access to systems running vulnerable versions of POP servers.

CA-1998-07: Vulnerability in Some Usages of PKCS#1

June 26, 1998

This advisory reports vulnerability in some implementations of products utilizing RSA Laboratories' Public-Key Cryptography Standard #1 (PKCS#1). Under some situations, a sophisticated intruder may be able to use the vulnerability in PKCS#1 to recover information from SSL-encrypted sessions.

CA-1998-06: Buffer Overflow in NIS+

June 9, 1998
Last updated November 9, 1999

This advisory reports a buffer overflow vulnerability that exists in some implementations of NIS+.

CA-1998-05: Multiple Vulnerabilities in BIND

April 8, 1998

This advisory describes three distinct problems in BIND. Topic 1 describes a vulnerability that may allow a remote intruder to gain root access on your name server or to disrupt normal operation of your name server. Topics 2 and 3 deal with vulnerabilities that can allow an intruder to disrupt your name server.

CA-1998-04: Microsoft Windows-based Web Servers access via long file names

February 6, 1998

This advisory reports an exploitation involving long file names on Microsoft Windows-based web servers.

CA-1998-03: Vulnerability in ssh-agent

January 22, 1998

This advisory details a vulnerability in the SSH cryptographic login program.

CA-1998-02: Vulnerabilities in CDE

January 21, 1998

This advisory reports several vulnerabilities in some implementations of the Common Desktop Environment (CDE).

CA-1998-01: Smurf IP Denial-of-Service Attacks

January 5, 1998

This advisory describes the "smurf" IP Denial-of-Service attacks. The attack described in this advisory is different from the denial-of-service attacks described in CERT advisory CA-97.28.


1997
CA-1997-28: IP Denial-of-Service Attacks

December 16, 1997

This advisory reports on two IP denial-of-service attacks.

CA-1997-27: FTP Bounce

December 10, 1997

This advisory discusses the use of the PORT command in the FTP protocol.

CA-1997-26: Buffer Overrun Vulnerability in statd(1M) Program

December 5, 1997

This advisory reports a vulnerability that exists in the statd(1M) program, available on a variety of Unix platforms.

CA-1997-25: Sanitizing User-Supplied Data in CGI Scripts

November 10, 1997

This advisory reports a vulnerability in some CGI scripts. This problem allows an attacker to execute arbitrary commands on a WWW server under the effective user-id of the server process.

CA-1997-24: Buffer Overrun Vulnerability in Count.cgi cgi-bin Program

November 5, 1997

This advisory describes a buffer overrun vulnerability which exists in the Count.cgi cgi-bin program that allows intruders to force Count.cgi to execute arbitrary commands.

CA-1997-23: Buffer Overflow Problem in rdist

September 16, 1997

This advisory discusses a buffer overflow problem in rdist. It is a different vulnerability from the one described in CA-1996-14.

CA-1997-22: BIND - the Berkeley Internet Name Daemon

August 13, 1997

This advisory supersedes CA-1996-02

It describes a vulnerability in all versions of BIND before release 4.9.6, suggests several solutions, and provides pointers to the current version of bind.

CA-1997-21: SGI Buffer Overflow Vulnerabilities

July 16, 1997

In this advisory, we describe 6 buffer overflow problems in SGI IRIX systems. Problems affect the df, pset, eject, login/scheme, ordist, and xlock programs. Workarounds and a pointer to a wrapper are provided.

CA-1997-20: JavaScript Vulnerability

July 8, 1997
Last updated November 9, 1999

This advisory reports a vulnerability in JavaScript that enables remote attackers to monitor a user's Web activities.

CA-1997-19: lpr Buffer Overrun Vulnerability

June 25, 1997

This advisory describes a vulnerability in BSD-based lpr printing software. Vendor information and a pointer to a wrapper are included.

CA-1997-18: Vulnerability in the at(1) program

June 12, 1997

This advisory addresses a buffer overflow condition in some versions of the at(1) program. Patch information and a workaround are provided.

CA-1997-17: Vulnerability in suidperl(sperl)

May 29, 1997

This advisory addresses a buffer overflow condition in suidperl (sperl) built from Perl 4.n and Perl 5.n distributions on UNIX systems. It suggests several solutions and includes vendor information and a patch for Perl version 5.003.

CA-1997-16: ftpd Signal Handling Vulnerability

May 29, 1997

This advisory describes a vulnerability in some versions of ftpd distributed and installed under various Unix platforms. Includes vendor information.

CA-1997-15: Vulnerability in SGI login LOCKOUT

May 28, 1997

This advisory describes a vulnerability in the SGI login program when the LOCKOUT parameter is set to a number greater than zero. The vulnerability is present in IRIX 5.3 and 6.2, and perhaps other versions.

CA-1997-14: Vulnerability in metamail

May 21, 1997

This advisory reports a vulnerability in metamail, a package that implements MIME. All versions of metamail through 2.7 are vulnerable.

CA-1997-13: Vulnerability in xlock

May 7, 1997

This advisory reports a buffer overflow problem in some versions of xlock. This problem makes it possible for local users to execute arbitrary programs as a privileged user. Patch information and a workaround are included.

CA-1997-12: Vulnerability in webdist.cgi

May 6, 1997

This advisory reports a vulnerability in the webdist.cgi-bin program, part of the IRIX Mindshare Out Box package, available with IRIX 5.x and 6.x. By exploiting this vulnerability, both local and remote users may be able to execute arbitrary commands with the privileges of the httpd daemon. A workaround is included.

CA-1997-11: Vulnerability in libXt

May 1, 1997

This advisory reports a buffer overflow vulnerability in the Xt library of the X Windowing System. Vendor vulnerability and patch information are included.

CA-1997-10: Vulnerability in Natural Language Service

April 24, 1997

This advisory reports a buffer overflow condition that affects some libraries using the Natural Language Service (NLS). Vendor vulnerability and patch information are included.

CA-1997-09: Vulnerability in IMAP and POP

April 7, 1997

This advisory reports a vulnerability in some versions of the Internet Message Access Protocol (IMAP) and Post Office Protocol (POP) implementations (imapd, ipop2d, and ipop3d). Vendor and upgrade information are included.

CA-1997-08: Vulnerabilities in INND

Originally issued February 20, 1997
Topic 2 issued April 3, 1997

This advisory describes two vulnerabilities in INN (the InterNetNews server). One affects versions 1.5 and earlier; the other affects 1.5.1 and earlier. The advisory includes pointers to version 1.5.1 and earlier. Updated information on the second vulnerability was added as "Topic 2." Pointers to all relevant patches are included, along with information from vendors.

CA-1997-07: Vulnerability in the httpd nph-test-cgi script

February 18, 1997

This advisory points out a vulnerability in the nph-test-cgi script included with some http daemons. Readers are urged to disable the script. Vendor information is included.

CA-1997-06: Vulnerability in rlogin/term

February 6, 1997

This advisory reports a vulnerability in many implementations of the rlogin program, including eklogin and klogin. Vendor information and a workaround are included.

CA-1997-05: MIME Conversion Buffer Overflow in Sendmail Versions 8.8.3 and 8.8.4

January 28, 1997

This advisory addresses a MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. The advisory includes vendor information, pointers to the latest version of sendmail, a workaround, and general precautions to take when using sendmail.

CA-1997-04: talkd Vulnerability

January 27, 1997

A vulnerability in talkd(8) program used by talk(1) makes it possible to provide corrupt DNS information to a host and to remotely execute arbitrary commands with root privileges. The advisory includes information on how to solve the general problem as well as the specific one.

CA-1997-03: Vulnerability in IRIX csetup

January 8, 1997

A vulnerability in the csetup program under IRIX versions 5.x, 6.0, 6.0.1, 6.1, and 6.2 allows local users to create or overwrite arbitrary files on the system and ultimately gain root privileges. A workaround is provided.

CA-1997-02: HP-UX newgrp Buffer Overrun Vulnerability

January 7, 1997

This advisory describes a vulnerability in the newgrp(1) program under HP-UX 9.x and 10.x that may allow users to gain root privileges. A workaround is provided.

CA-1997-01: Multi-platform Unix FLEXIm Vulnerabilities

January 6, 1997

This advisory describes multi-platform UNIX FLEXlm vulnerabilities. These problems may allow local users to create arbitrary files on the system and execute arbitrary programs using the privileges of the user running the FLEXlm daemons.


1996
CA-1996-27: Vulnerability in HP Software Installation Programs

December 19, 1996

This advisory describes a vulnerability in Hewlett-Packard SD-UX that may allow local users to gain root privileges. A workaround is included.

CA-1996-26: Denial-of-Service Attack via ping

December 18, 1996

This advisory describes a denial-of-service attack using large ICMP datagrams issued via the ping command. Vendor information is included.

CA-1996-25: Sendmail Group Permissions Vulnerability

December 10, 1996

The advisory describes a security problem affecting sendmail version 8 relating to group-writable files. Vendor patches and a workaround are included.

CA-1996-24: Sendmail Daemon Mode Vulnerability

November 21, 1996

It describes a security problem relating to the daemon mode in sendmail 8.7 through 8.8.2. The advisory also includes a note about two vulnerabilities in versions 8.8.0 and 8.8.1; these have been fixed as well.

CA-1996-23: Vulnerability in Workman

October 28, 1996

This advisory describes a vulnerability in the WorkMan compact disc-playing program that affects UNIX System V Release 4.0 and derivatives and Linux systems.

CA-1996-22: Vulnerabilities in bash

October 08, 1996

This advisory addresses two problems with the GNU Project's Bourne Again SHell (bash): one in yy_string_get() and one in yy_readline_get().

CA-1996-21: TCP SYN Flooding and IP Spoofing Attacks

September 19, 1996

** This advisory supersedes the IP spoofing portion of CA-1995-01. **

It describes denial-of-service attacks through TCP SYN flooding and IP spoofing. Advice about filtering is included.

CA-1996-20: Sendmail Vulnerabilities

September 18, 1996

This advisory describes a vulnerability in all versions of sendmail prior to 8.7.6, and includes a workaround and patch information.

CA-1996-19: Vulnerability in expreserve

August 15, 1996

** This advisory supersedes CA-1993-09 and CA-1993-09a. **

It provides information about a vulnerability in the expreserve utility. A workaround and vendor information are included.

CA-1996-18: Vulnerability in fm_fls

August 14, 1996

This advisory reports a configuration problem in the floating license server for Adobe FrameMaker (fm_fls). A workaround is provided.

CA-1996-17: Vulnerability in Solaris vold

August 06, 1996

This advisory describes a vulnerability in the Solaris volume management daemon (vold) and gives a workaround.

CA-1996-16: Vulnerability in Solaris admintool

August 05, 1996

This advisory describes a vulnerability in the Solaris admintool and gives a workaround.

CA-1996-15: Vulnerability in Solaris 2.5 KCMS programs

July 31, 1996

This advisory describes a vulnerability in the Solaris 2.5 kcms programs and suggests a workaround.

CA-1996-14: Vulnerability in rdist

July 24, 1996

** This advisory supersedes CA-1991-20 and CA-1994-04. **

It describes a vulnerability in the lookup subroutine of rdist, for which an exploitation script is available. Vendor information and a pointer to a new version of rdist are included.

CA-1996-13: Vulnerability in the dip program

July 09, 1996

This advisory describes a vulnerability in the dip program, which is shipped with most Linux systems. Other UNIX systems may also use it. Pointers to dip 3.3.7 are included.

CA-1996-12: Vulnerability in suidperl

June 26, 1996

This advisory describes a vulnerability in systems that contain the suidperl program and that support saved set-user-ID and saved set-group-ID. Patch information is included.

CA-1996-11: Interpreters in CGI bin Directories

May 29, 1996

This advisory warns users not to put interpreters in a Web server's CGI bin directory and to evaluate all programs in that directory.

CA-1996-10: NIS+ Configuration Vulnerability

May 28, 1996

This advisory was originally released as AUSCERT advisory AA-96.02a. It describes a vulnerability and workarounds for versions of NIS+ in which the access rights on the NIS+ passwd table are left in an unsecure state.

CA-1996-09: Vulnerability in rpc.statd

April 24, 1996

This advisory describes a vulnerability in the rpc.statd (or statd) program that allows authorized users to remove or create any file that a root user can. Vendor information is included.

CA-1996-08: Vulnerabilities in PCNFSD

April 18, 1996

This advisory describes a vulnerability in the pcnfsd program (also known as rpc.pcnfsd). A patch is included.

CA-1996-07: Weaknesses in Java Bytecode Verifier

March 29, 1996

This advisory describes a vulnerability in the Java bytecode verifier portion of Sun Microsystems' Java Development Kit (JDK) 1.0 and 1.0.1. Workarounds are provided for this product and Netscape Navigator 2.0 and 2.01, which have the JDK built in.

CA-1996-06: Vulnerability in NCSA/Apache CGI example code

March 20, 1996

This advisory describes a problem with example CGI code, as found in the NCSA 1.5a-export and APACHE 1.0.3 httpd, and possibly previous distributions of both servers. Workarounds are provided.

CA-1996-05: Java Implementations Can Allow Connections to an Arbitrary Host

March 05, 1996

This advisory describes a vulnerability in the Netscape Navigator 2.0 Java implementation and in Release 1.0 of the Java Developer's Kit from Sun Microsystems, Inc. Workarounds and pointers to a patch are included.

CA-1996-04: Corrupt Information from Network Servers

February 22, 1996

This advisory describes a vulnerability in network servers that can lead to corrupt information. The advisory includes information on subroutines for validating host names and IP addresses, patches for sendmail, and the status of vendor activity relating to the problem.

CA-1996-03: Vulnerability in Kerberos 4 Key Server

February 21, 1996

This advisory describes a problem with the Kerberos 4 key server, points to patches, and provides vendor information.

CA-1996-02: BIND

February 15, 1996

** Superseded by CA-1997-22 **

CA-1996-01: UDP Port Denial-of-Service Attack

February 08, 1996

This advisory describes UDP port denial-of-service attacks, for which an exploitation script has been publicly posted. The advisory includes a workaround.

1995
CA-1995-18: Widespread Attacks on Internet Sites

December 12, 1995

This advisory warns readers of attacks on hundreds of Internet sites in which intruders exploit known vulnerabilities, all of which have been addressed in previous CERT advisories. These advisories are listed.

CA-1995-17: rpc.ypupdated Vulnerability

December 12, 1995

This advisory describes a vulnerability in the rpc.ypupdated program, for which an exploitation program has been posted to several newsgroups. The advisory includes vendor information and a workaround.

CA-1995-16: wu-ftpd Misconfiguration Vulnerability

November 30, 1995

This advisory describes a vulnerability in the wu-fptd SITE EXEC command and provides solutions for both Linux users and others.

CA-1995-15: SGI lp Vulnerability

November 8, 1995

This advisory points out accounts that are distributed without passwords and urges SGI customers to create passwords for those accounts.

CA-1995-14: Telnetd Environment Vulnerability

November 1, 1995

This advisory describes a vulnerability with some telnet daemons and includes patch information from vendors, along with a workaround.

CA-1995-13: Syslog Vulnerability - A Workaround for Sendmail

October 19, 1995

This advisory describes a general problem with syslog, lists vendor information about patches, and provides a workaround for solving the syslog problem in sendmail in particular.

CA-1995-12: Sun 4.1.X Loadmodule Vulnerability

October 18, 1995

The advisory describes a problem with the loadmodule(8) program in Sun OS 4.1.X and provides patch information.

CA-1995-11: Sun Sendmail Vulnerability

September 19, 1995

** Superseded by CA-1996-20, CA-1996-24, and CA-1996-25. **

CA-1995-10: Ghostscript Vulnerability

August 31, 1995

This advisory describes a vulnerability involving the -dSAFER option in ghostscript versions 2.6 through 3.22 beta. The advisory includes instructions for fixing the problem and pointers to version 3.33 of ghostscript.

CA-1995-09: Solaris ps Vulnerability

August 29, 1995

This advisory describes a vulnerability in Solaris that can be exploited if the permissions on the /tmp and /var/tmp directories are set incorrectly.

CA-1995-08: Sendmail v.5 Vulnerability

August 17, 1995

This advisory describes a vulnerability in sendmail v.5, which is still in use and which includes IDA sendmail. Many vendors have previously fixed the problem, others recently developed patches.

CA-1995-07a: SATAN Vulnerability: Password Disclosure

April 21, 1995

** This advisory replaces CA-1995-07.**

It is a revision that provides new information the problem described in CA-1995-07, and includes precautions to take when running SATAN. A tutorial by the SATAN authors, "SATAN Password Disclosure" is appended to the advisory.

CA-1995-07: Vulnerability in SATAN

April 10, 1995

** Superseded by CA-1995-07a. **

CA-1995-06: Security Administrator Tool for Analyzing Networks (SATAN)

April 3, 1995

An overview of the Security Administrator Tool for Analyzing Networks (SATAN) based on the CERT staff's review of beta version 0.51. Includes list of vulnerabilities probed and advice on securing systems.

CA-1995-05: Sendmail Vulnerabilities

February 22, 1995

** Superseded by CA-1996-20, CA-1996-24, and CA-1996-25. **

CA-1995-04: NCSA HTTP Daemon for UNIX Vulnerability

February 17, 1995

This advisory provides a patch for a vulnerability in the NCSA HTTP daemon version 1.3 for UNIX.

CA-1995-03a: Telnet Encryption Vulnerability

March 3, 1995

** This advisory supersedes CA-1995-03. **

Description and patch information for a security problem in the Berkeley Telnet clients that support encryption and Kerberos V4 authentication. It provides additional information.

CA-1995-03: Telnet Encryption Vulnerability

February 16, 1995

** Superseded by CA-1995-03a. **

CA-1995-02: Vulnerabilities in /bin/mail

January 26, 1995

** This advisory supersedes CA-1991-01a and CA-1991-13. **

It addresses vulnerabilities in some versions of /bin/mail based on BSD 4.3 UNIX. It includes a list of vendor patches and source code for mail.local.c, an alternative to /bin/mail.

CA-1995-01: IP Spoofing Attacks and Hijacked Terminal Connections

January 23, 1995

The IP spoofing portion of this advisory has been superseded by CA-1996-21. The description of the intruder activity of hijacking terminals is still current.


CA-1994-15: NFS Vulnerabilities

CA-1994-14: Trojan Horse in IRC Client for UNIX

CA-1994-13: SGI IRIX Help Vulnerability

CA-1994-11: Majordomo Vulnerabilities

CA-1994-10: IBM AIX bsh Vulnerability

CA-1994-09: /bin/login Vulnerability

CA-1994-08: ftpd Vulnerabilites

CA-1994-07: wuarchive ftpd Trojan Horse

CA-1994-06: Writable /etc/utmp Vulnerability

CA-1994-05: MD5 Checksums

CA-1994-03: IBM AIX Performance Tools Vulnerability

CA-1994-02: Revised Patch for SunOS /usr/etc/rpc.mountd Vulnerability

CA-1994-01: Ongoing Network Monitoring Attacks

CA-1993-19: Solaris System Startup Vulnerability

CA-1993-18: SunOS/Solbourne loadmodule and modload Vulnerability

CA-1993-17: xterm Logging Vulnerability

CA-1993-15: /usr/lib/sendmail, /bin/tar, and /dev/audio Vulnerabilities

CA-1993-14: Internet Security Scanner (ISS)

CA-1993-13: SCO Home Directory Vulnerability

CA-1993-12: Novell LOGIN.EXE Vulnerability

CA-1993-11: UMN UNIX gopher and gopher+ Vulnerabilities

CA-1993-10: Anonymous FTP Activity

CA-1993-08: SCO /bin/passwd Vulnerability

CA-1993-07: Cisco Router Packet Handling Vulnerability

CA-1993-06: wuarchive ftpd Vulnerability

CA-1993-05: OpenVMS and OpenVMS AXP Vulnerability

CA-1993-04: Commodore-Amiga UNIX finger Vulnerability

CA-1993-03: SunOS File/Directory Permissions

CA-1993-02: New Patch for NeXT NetInfo _writers Vulnerabilities

CA-1993-01: Revised Hewlett-Packard NIS ypbind Vulnerability

CA-1992-21: Convex CSM: migmgr patch

CA-1992-20: Cisco Access List Vulnerability

CA-1992-19: Keystroke Logging Banner

CA-1992-18: Revised VMS Monitor Vulnerability

CA-1992-15: Multiple SunOS Vulnerabilities Patched

CA-1992-14: Altered System Binaries Incident

CA-1992-13: SunOS NIS Vulnerability

CA-1992-11: SunOS Environment Variables and setuid/setgid Vulnerability

CA-1992-10: AIX crontab Vulnerability

CA-1992-09: AIX Anonymous FTP Vulnerability

CA-1992-08: Silicon Graphics Computer Systems IRIX lp Vulnerability

CA-1992-07: AIX /bin/passwd Vulnerability

CA-1992-06: AIX uucp Vulnerability

CA-1992-05: AIX REXD Daemon Vulnerability

CA-1992-04: AT&T /usr/etc/rexecd Vulnerability

CA-1992-03: Internet Intruder Activity

CA-1992-02: Michelangelo PC Virus Warning

CA-1992-01: NeXTstep Configuration Vulnerability

CA-1991-23: Hewlett-Packard/Apollo Domain/OS crp Vulnerability

CA-1991-21: NFS Jumbo Patch, SunOS 4.1

CA-1991-19: AIX TFTP Daemon Vulnerability

CA-1991-18: Active Internet tftp Attacks

CA-1991-17: DECnet-Internet Gateway Vulnerability

CA-1991-15: Mac/PC NCSA Telnet Vulnerability

CA-1991-14: SGI IRIX /usr/sbin/fmt Vulnerability

CA-1991-12: Trusted Hosts Configuration Vulnerability

CA-1991-11: ULTRIX LAT/Telnet Gateway Vulnerability

CA-1991-10: REVISION NOTICE: New Patch for SunOS /usr/lib/lpd

CA-1991-08: AT&T System V Release 4 /bin/login Vulnerability

CA-1991-07: SunOS Source Tape Installation Vulnerability

CA-1991-06: NeXT rexd, /private/etc, Username me Vulnerabilities

CA-1991-05: DEC Ultrix Vulnerability

CA-1991-04: Social Engineering

CA-1991-03: Unauthorized Password Change Requests Via Mail Messages

CA-1991-02: SunOS in.telnetd Vulnerability

CA-1990-12: SunOS TIOCCONS Vulnerability

CA-1990-11: Security Probes from Italy

CA-1990-10: Rumor of Alleged Attack

CA-1990-09: VAX/VMS Break-ins

CA-1990-08: IRIX 3.3 and 3.31 /usr/sbin/Mail

CA-1990-07: VMS ANALYZE/PROCESS_DUMP

CA-1990-06: NeXT's System Software

CA-1990-05: SunView selection_svc vulnerability

CA-1990-04: Apollo Domain/OS suid_exec Problem

CA-1990-03: Unisys U5000 /etc/passwd problem

CA-1990-02: Internet Intruder Warning

CA-1989-07: Sun RCP Vulnerability

CA-1989-06: DEC/Ultrix 3.0 Systems

CA-1989-05: DEC/Ultrix 3.0 Systems

CA-1989-04: WANK Worm On SPAN Network

CA-1989-03: Telnet Breakin Warning

CA-1989-02: Sun Restore Hole

CA-1989-01: Passwd Hole

CA-1988-01: ftpd Vulnerability