[Secure-testing-commits] r802 - sarge-checks/CAN

Joey Hess joeyh@costa.debian.org
Wed, 13 Apr 2005 21:14:21 +0000 

Author: joeyh
Date: 2005-04-13 21:14:18 +0000 (Wed, 13 Apr 2005)
New Revision: 802

Modified:
   sarge-checks/CAN/list
Log:
automatic CAN database update

Modified: sarge-checks/CAN/list
===================================================================
--- sarge-checks/CAN/list	2005-04-13 16:03:52 UTC (rev 801)
+++ sarge-checks/CAN/list	2005-04-13 21:14:18 UTC (rev 802)
@@ -1,3 +1,166 @@
+CAN-2005-1098 (GetDataBack for NTFS 2.31 stores the username and license key in ...)
+	TODO: check
+CAN-2005-1097 (Rebrand P2P Share Spy 2.2 stores the user password in plaintext in the ...)
+	TODO: check
+CAN-2005-1096 (SQL injection vulnerability in main.asp for Ocean12 Membership Manager ...)
+	TODO: check
+CAN-2005-1095 (Cross-site scripting (XSS) vulnerability in main.asp for Ocean12 ...)
+	TODO: check
+CAN-2005-1094 (FTP Now 2.6.14 stores usernames and passwords in plaintext in ...)
+	TODO: check
+CAN-2005-1093 (Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM, with ...)
+	TODO: check
+CAN-2005-1092 (Lightspeed DeluxeFTP 6.01 stores usernames and passwords in plaintext ...)
+	TODO: check
+CAN-2005-1091 (Maxthon 1.2.0 and 1.2.1 allows remote attackers to bypass the security ...)
+	TODO: check
+CAN-2005-1090 (Directory traversal vulnerability in the readFile and writeFile API ...)
+	TODO: check
+CAN-2005-1089 (Unknown vulnerability in DC++ before 0.674 allows attackers to append ...)
+	TODO: check
+CAN-2005-1088 (Unknown vulnerability in DameWare NT Utilities 4.8 and earlier, and ...)
+	TODO: check
+CAN-2005-1087 (CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD ...)
+	TODO: check
+CAN-2005-1086 (Buffer overflow in the cmdIS.DLL plugin for AN HTTPD Server 1.42n ...)
+	TODO: check
+CAN-2005-1085 (Cross-site scripting (XSS) vulnerability in the control panel in ...)
+	TODO: check
+CAN-2005-1084 (SQL injection vulnerability in sdating.php in aeDating 3.2 allows ...)
+	TODO: check
+CAN-2005-1083 (index.php in aeDating 3.2 allows remote attackers to include arbitrary ...)
+	TODO: check
+CAN-2005-1082 (Multiple SQL injection vulnerabilities in AzDGDatingPlatinum 1.1.0 ...)
+	TODO: check
+CAN-2005-1081 (Cross-site scripting (XSS) vulnerability in view.php in ...)
+	TODO: check
+CAN-2005-1080 (Directory traversal vulnerability in the Java Archive Tool (Jar) ...)
+	TODO: check
+CAN-2005-1079 (SQL injection vulnerability in index.php for zOOm Media Gallery 2.1.2 ...)
+	TODO: check
+CAN-2005-1078 (XAMPP 1.4.x has multiple default or null passwords, which allows ...)
+	TODO: check
+CAN-2005-1077 (Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x ...)
+	TODO: check
+CAN-2005-1076 (Cross-site scripting (XSS) vulnerability in the discussion board ...)
+	TODO: check
+CAN-2005-1075 (Multiple cross-site scripting (XSS) vulnerabilities in RadScripts ...)
+	TODO: check
+CAN-2005-1074 (SQL injection vulnerability in index.php for RadScripts RadBids Gold 2 ...)
+	TODO: check
+CAN-2005-1073 (Directory traversal vulnerability in index.php for RadScripts RadBids ...)
+	TODO: check
+CAN-2005-1072 (Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows ...)
+	TODO: check
+CAN-2005-1071 (SQL injection vulnerability in banner.inc.php in JPortal Web Portal ...)
+	TODO: check
+CAN-2005-1070 (SQL injection vulnerability in index.php in Invision Power Board 1.3.1 ...)
+	TODO: check
+CAN-2005-1069 (Unknown vulnerability in sCssBoard 1.11 and earlier has unknown ...)
+	TODO: check
+CAN-2005-1068 (Cross-site scripting (XSS) vulnerability in sCssBoard 1.11 and earlier ...)
+	TODO: check
+CAN-2005-1067 (Vulnerability in Access_user Class before 1.75 allows local users to ...)
+	TODO: check
+CAN-2005-1066 (Race condition in rpdump in Pine 4.62 and earlier allows local users ...)
+	TODO: check
+CAN-2005-1065 (tetex in Novell Linux Desktop 9 allows local users to determine the ...)
+	TODO: check
+CAN-2005-1064 (The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 ...)
+	TODO: check
+CAN-2005-1063
+	NOTE: reserved
+CAN-2005-1062
+	NOTE: reserved
+CAN-2005-1061
+	NOTE: reserved
+CAN-2005-1060 (Unknown vulnerability in the TCP/IP functionality (TCPIP.NLM) in ...)
+	TODO: check
+CAN-2005-1059 (Linksys WET11 1.5.4 allows remote attackers to change the password ...)
+	TODO: check
+CAN-2005-1058 (Cisco IOS 12.2T, 12.3 and 12.3T, when processing an ISAKMP profile ...)
+	TODO: check
+CAN-2005-1057 (Cisco IOS 12.2T, 12.3 and 12.3T, when using Easy VPN Server XAUTH ...)
+	TODO: check
+CAN-2005-1056 (Unknown vulnerability in HP OpenView Network Node Manager (NMM) 6.2 ...)
+	TODO: check
+CAN-2005-1055 (TowerBlog 0.6 and earlier stores the login data file under the web ...)
+	TODO: check
+CAN-2005-1054 (PHP remote code injection vulnerability in news.php in ModernBill ...)
+	TODO: check
+CAN-2005-1053 (Multiple cross-site scripting (XSS) vulnerabilities in orderwiz.php in ...)
+	TODO: check
+CAN-2005-1052 (Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not ...)
+	TODO: check
+CAN-2005-1051 (SQL injection vulnerability in profile.php in PunBB 1.2.4 allows ...)
+	TODO: check
+CAN-2005-1050 (The modload op in the Reviews module for PostNuke 0.760-RC3 allows ...)
+	TODO: check
+CAN-2005-1049 (Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 ...)
+	TODO: check
+CAN-2005-1048 (SQL injection vulnerability in modules.php in PostNuke 0.760 RC3 ...)
+	TODO: check
+CAN-2005-1047 (Meilad File upload script (up.php) mod for phpBB 2.0.x does not ...)
+	TODO: check
+CAN-2005-1046 (Buffer overflow in the kimgio library for KDE 3.4.0 allows remote ...)
+	TODO: check
+CAN-2005-1045 (OpenText FirstClass 8.0 client does not properly sanitize strings ...)
+	TODO: check
+CAN-2005-1044
+	NOTE: rejected
+	TODO: check
+CAN-2005-1043 (exif.c in PHP before 4.3.11 allows remote attackers to cause a denial ...)
+	TODO: check
+CAN-2005-1042 (Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP ...)
+	TODO: check
+CAN-2005-1041 (The fib_seq_start function in fib_hash.c in Linux kernel allows local ...)
+	TODO: check
+CAN-2005-1040 (Multiple unknown vulnerabilities in netapplet in Novell Linux Desktop ...)
+	TODO: check
+CAN-2005-1039 (Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, ...)
+	TODO: check
+CAN-2005-1038 (crontab in Vixie cron 4.1, when running with the -e option, allows ...)
+	TODO: check
+CAN-2005-1037 (Unknown vulnerability in AIX 5.3.0, when configured as an NIS client, ...)
+	TODO: check
+CAN-2005-1036 (FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO ...)
+	TODO: check
+CAN-2005-1035 (Multiple buffer overflows in Pavuk before 0.9.32 have unknown attack ...)
+	TODO: check
+CAN-2005-1034 (SurgeFTP 2.2m1 allows remote attackers to cause a denial of service ...)
+	TODO: check
+CAN-2005-1033 (CubeCart 2.0.6 allows remote attackers to obtain sensitive information ...)
+	TODO: check
+CAN-2005-1032 (SQL injection vulnerability in cart.php in LiteCommerce allows remote ...)
+	TODO: check
+CAN-2005-1031 (RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops), ...)
+	TODO: check
+CAN-2005-1030 (Multiple cross-site scripting (XSS) vulnerabilities in Active Auction ...)
+	TODO: check
+CAN-2005-1029 (Multiple SQL injection vulnerabilities in Active Auction House allow ...)
+	TODO: check
+CAN-2005-1028 (PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive ...)
+	TODO: check
+CAN-2005-1027 (Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x ...)
+	TODO: check
+CAN-2005-1026 (Multiple SQL injection vulnerabilities in SnailSource phpBB 2.0.x mods ...)
+	TODO: check
+CAN-2005-1025 (The FTP server in AS/400 4.3, when running in IFS mode, allows remote ...)
+	TODO: check
+CAN-2005-1024 (modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain ...)
+	TODO: check
+CAN-2005-1023 (Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to ...)
+	TODO: check
+CAN-2005-1022 (ColdFusion 6.1 Updater 1 places Java .class files under the web root ...)
+	TODO: check
+CAN-2005-1021 (Memory leak in Secure Shell (SSH) in Cisco IOS 12.0 through 12.3, when ...)
+	TODO: check
+CAN-2005-1020 (Secure Shell (SSH) 2 in Cisco IOS 12.0 through 12.3 allows remote ...)
+	TODO: check
+CAN-2005-1019 (Buffer overflow in the getConfig function in Aeon 0.2a and earlier ...)
+	TODO: check
+CAN-2005-1018 (Buffer overflow in the UniversalAgent for Computer Associates (CA) ...)
+	TODO: check
 CAN-2005-XXXX [eGroupware: Inproper handling of canceled emails may disclose personal information]
 	- egroupware (unfixed; bug pending)
 CAN-2005-XXXX [Some security issues in mod_security]
@@ -57,7 +220,7 @@
 	NOTE: not-for-us (PayProCart)
 CAN-2005-1003 (Directory traversal vulnerability in index.php for ProfitCode ...)
 	NOTE: not-for-us (PayProCart)
-CAN-2005-1002 (logwebftbs2000.exe in LOG-FT File Transfer allows remote attackers to ...)
+CAN-2005-1002 (logwebftbs2000.exe in Logics Software File Transfer (LOG-FT) allows ...)
 	NOTE: not-for-us (LOG-FT File Transfer)
 CAN-2005-1001 (PHP-Nuke 7.6 allows remote attackers to obtain sensitive information ...)
 	NOTE: not-for-us (PHP-Nuke)
@@ -83,7 +246,7 @@
 	NOTE: not-for-us (AIX)
 CAN-2005-0990 (unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite ...)
 	- sharutils 4.2.1-13
-CAN-2005-0989 (The Javascript engine in Mozilla Suite 1.7.6 and Firefox 1.0.1 and ...)
+CAN-2005-0989 (The find_replen function in jsstr.c in the the Javascript engine for ...)
 	- mozilla (unfixed; bug #302778)
 	- mozilla-firefox 1.0.2-3
 CAN-2005-0988 (Race condition in gzip 1.2.4, 1.3.3, and earlier when decompressing a ...)
@@ -109,7 +272,7 @@
 	NOTE: not-for-us (Rumba)
 CAN-2005-0978 (Directory traversal vulnerability in the Object Push service in IVT ...)
 	NOTE: not-for-us (IVT BlueSoleil)
-CAN-2005-0977 (The shm_nopage function in the tmpfs driver in Linux kernel 2.6 does ...)
+CAN-2005-0977 (The shmem_nopage function in shmem.c for the tmpfs driver in Linux ...)
 	- kernel-source-2.6.8 2.6.8-16
 CAN-2005-0976
 	NOTE: reserved
@@ -188,10 +351,9 @@
 	NOTE: not-for-us (Microsoft)
 CAN-2005-0943 (Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and ...)
 	NOTE: not-for-us (Cisco Hardware issue)
-CAN-2005-0942 (Unknown vulnerability in Sybase Adaptive Server Enterprise (ASE) XP ...)
+CAN-2005-0942 (The XP Server process (xp_server) in Sybase Adaptive Server Enterprise ...)
 	NOTE: not-for-us (Sybase ASE)
 CAN-2005-0941 [OpenOffice.org heap possible overflow in DOC parsing]
-	NOTE: reserved
 	- openoffice.org (unfixed; bug #304469)
 CAN-2005-0939
 	NOTE: reserved
@@ -665,7 +827,7 @@
 	NOTE: not-for-us (paFileDB not in Debian)
 CAN-2005-0781 (SQL injection vulnerability in (1) viewall.php and (2) category.php in ...)
 	NOTE: not-for-us (paFileDB not in Debian)
-CAN-2005-0780 (paFileDB 3.1 and earlier allows remote attackres to obtain sensitive ...)
+CAN-2005-0780 (paFileDB 3.1 and earlier allows remote attackers to obtain sensitive ...)
 	NOTE: not-for-us (paFileDB not in Debian)
 CAN-2005-0779 (PlatinumFTP 1.0.18, and possibly earlier versions, allows remote ...)
 	NOTE: not-for-us (PlatinumFTP not in Debian)
@@ -845,12 +1007,15 @@
 CAN-2005-0712 (Mac OS X before 10.3.8 users world-writable permissions for certain ...)
 	NOTE: not-for-us (Mac OS)
 CAN-2005-0711 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable ...)
+	{DSA-707-1}
 	- mysql-dfsg 4.0.24
 	- mysql-dfsg-4.1 4.1.10a
 CAN-2005-0710 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote ...)
+	{DSA-707-1}
 	- mysql-dfsg 4.0.24
 	- mysql-dfsg-4.1 4.1.10a
 CAN-2005-0709 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote ...)
+	{DSA-707-1}
 	- mysql-dfsg 4.0.24
 	- mysql-dfsg-4.1 4.1.10a
 CAN-2005-0708 (The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 ...)
@@ -1333,10 +1498,10 @@
 	NOTE: reserved
 CAN-2005-0552
 	NOTE: reserved
-CAN-2005-0551
-	NOTE: reserved
-CAN-2005-0550
-	NOTE: reserved
+CAN-2005-0551 (The Client Server Runtime System (CSRSS) process of Microsoft Windows ...)
+	TODO: check
+CAN-2005-0550 (Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and SP2, and ...)
+	TODO: check
 CAN-2005-0549 (Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2 ...)
 	NOTE: not-for-us (Solaris)
 CAN-2005-0548 (Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2 ...)
@@ -2134,7 +2299,7 @@
 	NOTE: not-for-us (CubeCart)
 CAN-2005-0442 (Directory traversal vulnerability in index.php for CubeCart 2.0.4 ...)
 	NOTE: not-for-us (CubeCart)
-CAN-2005-0441 (Buffer overflow in Sybase Adaptive Server Enterprise (ASE) 12.x before ...)
+CAN-2005-0441 (Multiple stack-based buffer overflows in Sybase Adaptive Server ...)
 	NOTE: not-for-us (Sybase)
 CAN-2005-0440 (ELOG before 2.5.7 allows remote attackers to bypass authentication and ...)
 	- elog 2.5.7+r1558-1
@@ -2240,7 +2405,7 @@
 CAN-2005-0391
 	NOTE: reserved
 CAN-2005-0390 [axel buffer overflow in HTTP redirection handling in conn.c]
-	NOTE: reserved
+	{DSA-706-1}
 	- axel 1.0b-1
 CAN-2005-0389
 	NOTE: rejected
@@ -2324,8 +2489,8 @@
 	NOTE: not-for-us (Sentinel License Manager)
 CAN-2005-0352 (Servers Alive 4.1 and 5.0, when running as a service, does not drop ...)
 	NOTE: not-fo-us (Servers Alive)
-CAN-2005-0351
-	NOTE: reserved
+CAN-2005-0351 (Buffer overflow in (1) termsh, (2) atcronsh, and (3) auditsh in SCO ...)
+	TODO: check
 CAN-2005-0350 (Heap-based buffer overflow in multiple F-Secure Anti-Virus and ...)
 	NOTE: not-for-us (F-Secure Anti-Virus)
 CAN-2005-0349 (The production release of the UniversalAgent for UNIX in BrightStor ...)
@@ -3304,16 +3469,16 @@
 	- pdftohtml 0.36-11
 	- kdegraphics (unfixed; bug #303238)
 	- tetex-bin 2.0.2-26
-CAN-2005-0063
-	NOTE: reserved
+CAN-2005-0063 (The document processing application used by the Windows Shell in ...)
+	TODO: check
 CAN-2005-0062
 	NOTE: reserved
-CAN-2005-0061
-	NOTE: reserved
-CAN-2005-0060
-	NOTE: reserved
-CAN-2005-0059
-	NOTE: reserved
+CAN-2005-0061 (The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and ...)
+	TODO: check
+CAN-2005-0060 (Buffer overflow in the font processing component of Microsoft Windows ...)
+	TODO: check
+CAN-2005-0059 (Buffer overflow in the Message Queuing component of Microsoft Windows ...)
+	TODO: check
 CAN-2005-0058
 	NOTE: reserved
 CAN-2005-0057 (The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 ...)
@@ -4430,6 +4595,7 @@
 CAN-2004-0958 (php_variables.c in PHP before 5.0.2 allows remote attackers to read ...)
 	- php4 4.3.9
 CAN-2004-0957 (Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user ...)
+	{DSA-707-1}
 	- mysql-dfsg-4.1 4.1.10a-6
 	- mysql-dfsg 4.0.24-5
 CAN-2004-0956 (MySQL before 4.0.20 allows remote attackers to cause a denial of ...)