[Secure-testing-commits] r1503 - data/CAN

Joey Hess joeyh at costa.debian.org
Sat Jul 30 16:07:13 UTC 2005 

Author: joeyh
Date: 2005-07-30 16:07:08 +0000 (Sat, 30 Jul 2005)
New Revision: 1503

Modified:
   data/CAN/list
Log:
done with block and a few others


Modified: data/CAN/list
===================================================================
--- data/CAN/list	2005-07-30 15:24:19 UTC (rev 1502)
+++ data/CAN/list	2005-07-30 16:07:08 UTC (rev 1503)
@@ -741,100 +741,102 @@
 	NOTE: not-for-us (Macromedia JRun)
 CAN-2001-1543 (Axis network camera 2120, 2110, 2100, 200+ and 200 contains a default ...)
 	NOTE: not-for-us (Axis network camera)
-begin claimed by joeyh
 CAN-2001-1542 (NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter ...)
-	TODO: check
+	NOTE: not-for-us (NAI WebShield SMTP)
 CAN-2001-1541 (Buffer overflow in Unix-to-Unix Copy Protocol (UUCP) in BSDI BSD/OS ...)
-	TODO: check
+	NOTE: not-for-us (BSDI UUCP)
 CAN-2001-1540 (IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a ...)
-	TODO: check
+	TODO: try nmap exploit
 CAN-2001-1539 (The JavaScript settimeout function in Internet Explorer allows remote ...)
-	TODO: check
+	NOTE: not-for-us (MSIE)
 CAN-2001-1538 (SpeedXess HA-120 DSL router has a default administrative password of ...)
-	TODO: check
+	NOTE: not-for-us (SpeedXess HA-120 DSL router)
 CAN-2001-1537 (The default "basic" security setting' in config.php for TWIG webmail ...)
-	TODO: check
+	NOTE: current twig package seems to have secure cookies enabled
+	NOTE: still uses "basic" security setting.
 CAN-2001-1536 (Autogalaxy stores usernames and passwords in cleartext in cookies, ...)
-	TODO: check
+	NOTE: not-for-us (Autogalaxy
 CAN-2001-1535 (Slashcode 2.0 creates new accounts with an 8-character random ...)
-	TODO: check
+	NOTE: cannot find paper about this anymore
+	TODO: followup
 CAN-2001-1534 (mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's ...)
-	TODO: check
+	NOTE: cannot find paper about this anymore
+	NOTE: only affects things misusing apache session IDs
+	TODO: followup
 CAN-2001-1533 (** DISPUTED * ...)
-	TODO: check
+	NOTE: not-for-us (Microsoft)
 CAN-2001-1532 (WebX stores authentication information in the HTTP_REFERER variable, ...)
-	TODO: check
+	NOTE: not-for-us (WebX)
 CAN-2001-1531 (Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to ...)
-	TODO: check
+	NOTE: not-for-us (Claris Emailer)
 CAN-2001-1530 (run.cgi in Webmin 0.80 and 0.88 creates temporary files with ...)
-	TODO: check
+	NOTE: verified current webmin is ok
 CAN-2001-1529 (Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows ...)
-	TODO: check
+	NOTE: not-for-us (AIX)
 CAN-2001-1528 (AmTote International homebet program returns different error messages ...)
-	TODO: check
+	NOTE: not-for-us (AmTote International homebet)
 CAN-2001-1527 (easyNews 1.5 and earlier stores adminstration passwords in cleartext ...)
-	TODO: check
+	NOTE: not-for-us (easynews)
 CAN-2001-1526 (Cross-site scripting (XSS) vulnerability in the comments action in ...)
-	TODO: check
+	NOTE: not-for-us (easynews)
 CAN-2001-1525 (Directory traversal vulnerability in the comments action in easyNews ...)
-	TODO: check
+	NOTE: not-for-us (easynews)
 CAN-2001-1524 (Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier ...)
-	TODO: check
+	NOTE: not-for-us (PHP-Nuke)
 CAN-2001-1523 (Cross-site scripting (XSS) vulnerability in the DMOZGateway module for ...)
-	TODO: check
+	NOTE: not-for-us (PHP-Nuke)
 CAN-2001-1522 (Cross-site scripting (XSS) vulnerability in im.php in IMessenger for ...)
-	TODO: check
+	NOTE: not-for-us (PHP-Nuke)
 CAN-2001-1521 (Cross-site scripting (XSS) vulnerability in user.php in PostNuke 0.64 ...)
-	TODO: check
+	NOTE: not-for-us (PHP-Nuke)
 CAN-2001-1520 (Xircom REX 6000 allows local users to obtain the 10 digit PIN by ...)
-	TODO: check
+	NOTE: not-for-us (Xircom REX)
 CAN-2001-1519 (** DISPUTED ** ...)
-	TODO: check
+	NOTE: not-for-us (RunAs)
 CAN-2001-1518 (RunAs (runas.exe) in Windows 2000 only creates one session instance at ...)
-	TODO: check
+	NOTE: not-for-us (RunAs)
 CAN-2001-1517 (** DISPUTED ** ...)
-	TODO: check
+	NOTE: not-for-us (RunAs)
 CAN-2001-1516 (Cross-site scripting (XSS) vulnerability in phpReview 0.9.0 rc2 and ...)
-	TODO: check
+	NOTE: not-for-us (phpReview)
 CAN-2001-1515 (Macintosh clients, when using NT file system volumes on Windows 2000 ...)
-	TODO: check
+	NOTE: not-for-us (Macintosh clients, when using NT file system volumes on Windows)
 CAN-2001-1514 (ColdFusion 4.5 and 5, when running on Windows with the advanced ...)
-	TODO: check
+	NOTE: not-for-us (ColdFusion)
 CAN-2001-1513 (Macromedia JRun 3.0 and 3.1 allows remote attackers to obtain ...)
-	TODO: check
+	NOTE: not-for-us (JRun)
 CAN-2001-1512 (Unknown vulnerability in Allaire JRun 3.1 allows remote attackers to ...)
-	TODO: check
+	NOTE: not-for-us (JRun)
 CAN-2001-1511 (JRun 3.0 and 3.1 running on JRun Web Server (JWS) and IIS allows ...)
-	TODO: check
+	NOTE: not-for-us (JRun)
 CAN-2001-1510 (Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, ...)
-	TODO: check
+	NOTE: not-for-us (JRun)
 CAN-2001-1509 (geteuid in Itanium Architecture (IA) running on HP-UX 11.20 does not ...)
-	TODO: check
+	NOTE: not-for-us (HP-UX)
 CAN-2001-1508 (Buffer overflow in lpstat in SCO OpenServer 5.0 through 5.0.6a allows ...)
-	TODO: check
+	NOTE: lpstat not suid in lprng or cupsys-client in Debian
 CAN-2001-1507 (OpenSSH before 3.0.1 with Kerberos V enabled does not properly ...)
-	TODO: check
+	- openssh 1:3.0.1
 CAN-2000-1237 (The POP3 server in FTGate returns an -ERR code after receiving an ...)
-	TODO: check
+	NOTE: not-for-us (FTGate)
 CAN-2000-1236 (SQL injection vulnerability in mod_sql in Oracle Internet Application ...)
-	TODO: check
+	NOTE: not-for-us (Oracle)
 CAN-2000-1235 (The default configurations of (1) the port listener and (2) modplsql ...)
-	TODO: check
+	NOTE: not-for-us (Oracle)
 CAN-2000-1234 (violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1233 (SQL injection vulnerability in read.php3 and other scripts in Phorum ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1232 (upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1231 (code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1230 (Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1229 (Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum ...)
-	TODO: check
+	NOTE: not-for-us (Phorum)
 CAN-2000-1228 (Phorum 3.0.7 allows remote attackers to change the administrator ...)
-	TODO: check
-end claimed by joeyh
+	NOTE: not-for-us (Phorum)
 CAN-2005-2259 (The dispallclosed2 function in dispallclosed.pl for multiple USANet ...)
 	NOTE: not-for-us (USANet)
 CAN-2005-2258 (PHP remote file inclusion vulnerability in photolist.inc.php in Squito ...)
@@ -969,9 +971,9 @@
 CAN-2005-2197 (SQL injection vulnerability in sql.cls.php in Id Board 1.1.3 allows ...)
 	NOTE: not-for-us (Id Board)
 CAN-2005-2196 (The Apple AirPort card uses a default WEP key when not connected to a ...)
-	TODO: check
+	NOTE: not-for-us (Apple Airport)
 CAN-2005-2195 (Apple Darwin Streaming Server 5.5 and earlier allows remote attackers ...)
-	TODO: check
+	NOTE: not-for-us (Apple Darwin Streaming Server)
 CAN-2005-2194
 	NOTE: reserved
 CAN-2005-2193 (SQL injection vulnerability in the user profile edit module in ...)
@@ -1471,7 +1473,7 @@
 CAN-2002-1983 (The timer implementation in QNX RTOS 6.1.0 allows local users to cause ...)
 	NOTE: not-for-us (QNX)
 CAN-2002-1982 (Directory traversal vulnerability in the list_directory function in ...)
-	TODO: check, possibly affected, but sphor currently off, minor issue
+	NOTE: verified current version is not vulnerable to exploit
 CAN-2002-1981 (Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the ...)
 	NOTE: not-for-us (Microsoft)
 CAN-2002-1980 (Buffer overflow in Volume Manager daemon (vold) of Sun Solaris 2.5.1 ...)

More information about the Secure-testing-commits mailing list