Author: joeyh
Date: 2005-04-13 21:14:18 +0000 (Wed, 13 Apr 2005)
New Revision: 802
Modified:
sarge-checks/CAN/list
Log:
automatic CAN database update
Modified: sarge-checks/CAN/list
==================================================================---
sarge-checks/CAN/list 2005-04-13 16:03:52 UTC (rev 801)
+++ sarge-checks/CAN/list 2005-04-13 21:14:18 UTC (rev 802)
@@ -1,3 +1,166 @@
+CAN-2005-1098 (GetDataBack for NTFS 2.31 stores the username and license key in
...)
+ TODO: check
+CAN-2005-1097 (Rebrand P2P Share Spy 2.2 stores the user password in plaintext
in the ...)
+ TODO: check
+CAN-2005-1096 (SQL injection vulnerability in main.asp for Ocean12 Membership
Manager ...)
+ TODO: check
+CAN-2005-1095 (Cross-site scripting (XSS) vulnerability in main.asp for Ocean12
...)
+ TODO: check
+CAN-2005-1094 (FTP Now 2.6.14 stores usernames and passwords in plaintext in
...)
+ TODO: check
+CAN-2005-1093 (Buffer overflow in the PopUp Plus 2.0.3.8 plugin for Miranda IM,
with ...)
+ TODO: check
+CAN-2005-1092 (Lightspeed DeluxeFTP 6.01 stores usernames and passwords in
plaintext ...)
+ TODO: check
+CAN-2005-1091 (Maxthon 1.2.0 and 1.2.1 allows remote attackers to bypass the
security ...)
+ TODO: check
+CAN-2005-1090 (Directory traversal vulnerability in the readFile and writeFile
API ...)
+ TODO: check
+CAN-2005-1089 (Unknown vulnerability in DC++ before 0.674 allows attackers to
append ...)
+ TODO: check
+CAN-2005-1088 (Unknown vulnerability in DameWare NT Utilities 4.8 and earlier,
and ...)
+ TODO: check
+CAN-2005-1087 (CRLF injection vulnerability in the cmdIS.DLL plugin for AN
HTTPD ...)
+ TODO: check
+CAN-2005-1086 (Buffer overflow in the cmdIS.DLL plugin for AN HTTPD Server
1.42n ...)
+ TODO: check
+CAN-2005-1085 (Cross-site scripting (XSS) vulnerability in the control panel in
...)
+ TODO: check
+CAN-2005-1084 (SQL injection vulnerability in sdating.php in aeDating 3.2
allows ...)
+ TODO: check
+CAN-2005-1083 (index.php in aeDating 3.2 allows remote attackers to include
arbitrary ...)
+ TODO: check
+CAN-2005-1082 (Multiple SQL injection vulnerabilities in AzDGDatingPlatinum
1.1.0 ...)
+ TODO: check
+CAN-2005-1081 (Cross-site scripting (XSS) vulnerability in view.php in ...)
+ TODO: check
+CAN-2005-1080 (Directory traversal vulnerability in the Java Archive Tool (Jar)
...)
+ TODO: check
+CAN-2005-1079 (SQL injection vulnerability in index.php for zOOm Media Gallery
2.1.2 ...)
+ TODO: check
+CAN-2005-1078 (XAMPP 1.4.x has multiple default or null passwords, which allows
...)
+ TODO: check
+CAN-2005-1077 (Multiple cross-site scripting (XSS) vulnerabilities in XAMPP
1.4.x ...)
+ TODO: check
+CAN-2005-1076 (Cross-site scripting (XSS) vulnerability in the discussion board
...)
+ TODO: check
+CAN-2005-1075 (Multiple cross-site scripting (XSS) vulnerabilities in
RadScripts ...)
+ TODO: check
+CAN-2005-1074 (SQL injection vulnerability in index.php for RadScripts RadBids
Gold 2 ...)
+ TODO: check
+CAN-2005-1073 (Directory traversal vulnerability in index.php for RadScripts
RadBids ...)
+ TODO: check
+CAN-2005-1072 (Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5
allows ...)
+ TODO: check
+CAN-2005-1071 (SQL injection vulnerability in banner.inc.php in JPortal Web
Portal ...)
+ TODO: check
+CAN-2005-1070 (SQL injection vulnerability in index.php in Invision Power Board
1.3.1 ...)
+ TODO: check
+CAN-2005-1069 (Unknown vulnerability in sCssBoard 1.11 and earlier has unknown
...)
+ TODO: check
+CAN-2005-1068 (Cross-site scripting (XSS) vulnerability in sCssBoard 1.11 and
earlier ...)
+ TODO: check
+CAN-2005-1067 (Vulnerability in Access_user Class before 1.75 allows local
users to ...)
+ TODO: check
+CAN-2005-1066 (Race condition in rpdump in Pine 4.62 and earlier allows local
users ...)
+ TODO: check
+CAN-2005-1065 (tetex in Novell Linux Desktop 9 allows local users to determine
the ...)
+ TODO: check
+CAN-2005-1064 (The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before
1.1.7 ...)
+ TODO: check
+CAN-2005-1063
+ NOTE: reserved
+CAN-2005-1062
+ NOTE: reserved
+CAN-2005-1061
+ NOTE: reserved
+CAN-2005-1060 (Unknown vulnerability in the TCP/IP functionality (TCPIP.NLM) in
...)
+ TODO: check
+CAN-2005-1059 (Linksys WET11 1.5.4 allows remote attackers to change the
password ...)
+ TODO: check
+CAN-2005-1058 (Cisco IOS 12.2T, 12.3 and 12.3T, when processing an ISAKMP
profile ...)
+ TODO: check
+CAN-2005-1057 (Cisco IOS 12.2T, 12.3 and 12.3T, when using Easy VPN Server
XAUTH ...)
+ TODO: check
+CAN-2005-1056 (Unknown vulnerability in HP OpenView Network Node Manager (NMM)
6.2 ...)
+ TODO: check
+CAN-2005-1055 (TowerBlog 0.6 and earlier stores the login data file under the
web ...)
+ TODO: check
+CAN-2005-1054 (PHP remote code injection vulnerability in news.php in
ModernBill ...)
+ TODO: check
+CAN-2005-1053 (Multiple cross-site scripting (XSS) vulnerabilities in
orderwiz.php in ...)
+ TODO: check
+CAN-2005-1052 (Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not
...)
+ TODO: check
+CAN-2005-1051 (SQL injection vulnerability in profile.php in PunBB 1.2.4 allows
...)
+ TODO: check
+CAN-2005-1050 (The modload op in the Reviews module for PostNuke 0.760-RC3
allows ...)
+ TODO: check
+CAN-2005-1049 (Multiple cross-site scripting vulnerabilities in PostNuke
0.760-RC3 ...)
+ TODO: check
+CAN-2005-1048 (SQL injection vulnerability in modules.php in PostNuke 0.760 RC3
...)
+ TODO: check
+CAN-2005-1047 (Meilad File upload script (up.php) mod for phpBB 2.0.x does not
...)
+ TODO: check
+CAN-2005-1046 (Buffer overflow in the kimgio library for KDE 3.4.0 allows
remote ...)
+ TODO: check
+CAN-2005-1045 (OpenText FirstClass 8.0 client does not properly sanitize
strings ...)
+ TODO: check
+CAN-2005-1044
+ NOTE: rejected
+ TODO: check
+CAN-2005-1043 (exif.c in PHP before 4.3.11 allows remote attackers to cause a
denial ...)
+ TODO: check
+CAN-2005-1042 (Integer overflow in the exif_process_IFD_TAG function in exif.c
in PHP ...)
+ TODO: check
+CAN-2005-1041 (The fib_seq_start function in fib_hash.c in Linux kernel allows
local ...)
+ TODO: check
+CAN-2005-1040 (Multiple unknown vulnerabilities in netapplet in Novell Linux
Desktop ...)
+ TODO: check
+CAN-2005-1039 (Race condition in Core Utilities (coreutils) 5.2.1, when (1)
mkdir, ...)
+ TODO: check
+CAN-2005-1038 (crontab in Vixie cron 4.1, when running with the -e option,
allows ...)
+ TODO: check
+CAN-2005-1037 (Unknown vulnerability in AIX 5.3.0, when configured as an NIS
client, ...)
+ TODO: check
+CAN-2005-1036 (FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO
...)
+ TODO: check
+CAN-2005-1035 (Multiple buffer overflows in Pavuk before 0.9.32 have unknown
attack ...)
+ TODO: check
+CAN-2005-1034 (SurgeFTP 2.2m1 allows remote attackers to cause a denial of
service ...)
+ TODO: check
+CAN-2005-1033 (CubeCart 2.0.6 allows remote attackers to obtain sensitive
information ...)
+ TODO: check
+CAN-2005-1032 (SQL injection vulnerability in cart.php in LiteCommerce allows
remote ...)
+ TODO: check
+CAN-2005-1031 (RUNCMS 1.1A, and possibly other products based on e-Xoops
(exoops), ...)
+ TODO: check
+CAN-2005-1030 (Multiple cross-site scripting (XSS) vulnerabilities in Active
Auction ...)
+ TODO: check
+CAN-2005-1029 (Multiple SQL injection vulnerabilities in Active Auction House
allow ...)
+ TODO: check
+CAN-2005-1028 (PHP-Nuke 6.x through 7.6 allows remote attackers to obtain
sensitive ...)
+ TODO: check
+CAN-2005-1027 (Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke
6.x ...)
+ TODO: check
+CAN-2005-1026 (Multiple SQL injection vulnerabilities in SnailSource phpBB
2.0.x mods ...)
+ TODO: check
+CAN-2005-1025 (The FTP server in AS/400 4.3, when running in IFS mode, allows
remote ...)
+ TODO: check
+CAN-2005-1024 (modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to
obtain ...)
+ TODO: check
+CAN-2005-1023 (Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke
6.x to ...)
+ TODO: check
+CAN-2005-1022 (ColdFusion 6.1 Updater 1 places Java .class files under the web
root ...)
+ TODO: check
+CAN-2005-1021 (Memory leak in Secure Shell (SSH) in Cisco IOS 12.0 through
12.3, when ...)
+ TODO: check
+CAN-2005-1020 (Secure Shell (SSH) 2 in Cisco IOS 12.0 through 12.3 allows
remote ...)
+ TODO: check
+CAN-2005-1019 (Buffer overflow in the getConfig function in Aeon 0.2a and
earlier ...)
+ TODO: check
+CAN-2005-1018 (Buffer overflow in the UniversalAgent for Computer Associates
(CA) ...)
+ TODO: check
CAN-2005-XXXX [eGroupware: Inproper handling of canceled emails may disclose
personal information]
- egroupware (unfixed; bug pending)
CAN-2005-XXXX [Some security issues in mod_security]
@@ -57,7 +220,7 @@
NOTE: not-for-us (PayProCart)
CAN-2005-1003 (Directory traversal vulnerability in index.php for ProfitCode
...)
NOTE: not-for-us (PayProCart)
-CAN-2005-1002 (logwebftbs2000.exe in LOG-FT File Transfer allows remote
attackers to ...)
+CAN-2005-1002 (logwebftbs2000.exe in Logics Software File Transfer (LOG-FT)
allows ...)
NOTE: not-for-us (LOG-FT File Transfer)
CAN-2005-1001 (PHP-Nuke 7.6 allows remote attackers to obtain sensitive
information ...)
NOTE: not-for-us (PHP-Nuke)
@@ -83,7 +246,7 @@
NOTE: not-for-us (AIX)
CAN-2005-0990 (unshar (unshar.c) in sharutils 4.2.1 allows local users to
overwrite ...)
- sharutils 4.2.1-13
-CAN-2005-0989 (The Javascript engine in Mozilla Suite 1.7.6 and Firefox 1.0.1
and ...)
+CAN-2005-0989 (The find_replen function in jsstr.c in the the Javascript engine
for ...)
- mozilla (unfixed; bug #302778)
- mozilla-firefox 1.0.2-3
CAN-2005-0988 (Race condition in gzip 1.2.4, 1.3.3, and earlier when
decompressing a ...)
@@ -109,7 +272,7 @@
NOTE: not-for-us (Rumba)
CAN-2005-0978 (Directory traversal vulnerability in the Object Push service in
IVT ...)
NOTE: not-for-us (IVT BlueSoleil)
-CAN-2005-0977 (The shm_nopage function in the tmpfs driver in Linux kernel 2.6
does ...)
+CAN-2005-0977 (The shmem_nopage function in shmem.c for the tmpfs driver in
Linux ...)
- kernel-source-2.6.8 2.6.8-16
CAN-2005-0976
NOTE: reserved
@@ -188,10 +351,9 @@
NOTE: not-for-us (Microsoft)
CAN-2005-0943 (Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and
...)
NOTE: not-for-us (Cisco Hardware issue)
-CAN-2005-0942 (Unknown vulnerability in Sybase Adaptive Server Enterprise (ASE)
XP ...)
+CAN-2005-0942 (The XP Server process (xp_server) in Sybase Adaptive Server
Enterprise ...)
NOTE: not-for-us (Sybase ASE)
CAN-2005-0941 [OpenOffice.org heap possible overflow in DOC parsing]
- NOTE: reserved
- openoffice.org (unfixed; bug #304469)
CAN-2005-0939
NOTE: reserved
@@ -665,7 +827,7 @@
NOTE: not-for-us (paFileDB not in Debian)
CAN-2005-0781 (SQL injection vulnerability in (1) viewall.php and (2)
category.php in ...)
NOTE: not-for-us (paFileDB not in Debian)
-CAN-2005-0780 (paFileDB 3.1 and earlier allows remote attackres to obtain
sensitive ...)
+CAN-2005-0780 (paFileDB 3.1 and earlier allows remote attackers to obtain
sensitive ...)
NOTE: not-for-us (paFileDB not in Debian)
CAN-2005-0779 (PlatinumFTP 1.0.18, and possibly earlier versions, allows remote
...)
NOTE: not-for-us (PlatinumFTP not in Debian)
@@ -845,12 +1007,15 @@
CAN-2005-0712 (Mac OS X before 10.3.8 users world-writable permissions for
certain ...)
NOTE: not-for-us (Mac OS)
CAN-2005-0711 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses
predictable ...)
+ {DSA-707-1}
- mysql-dfsg 4.0.24
- mysql-dfsg-4.1 4.1.10a
CAN-2005-0710 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote
...)
+ {DSA-707-1}
- mysql-dfsg 4.0.24
- mysql-dfsg-4.1 4.1.10a
CAN-2005-0709 (MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote
...)
+ {DSA-707-1}
- mysql-dfsg 4.0.24
- mysql-dfsg-4.1 4.1.10a
CAN-2005-0708 (The sendfile system call in FreeBSD 4.8 through 4.11 and 5
through 5.4 ...)
@@ -1333,10 +1498,10 @@
NOTE: reserved
CAN-2005-0552
NOTE: reserved
-CAN-2005-0551
- NOTE: reserved
-CAN-2005-0550
- NOTE: reserved
+CAN-2005-0551 (The Client Server Runtime System (CSRSS) process of Microsoft
Windows ...)
+ TODO: check
+CAN-2005-0550 (Buffer overflow in Microsoft Windows 2000, Windows XP SP1 and
SP2, and ...)
+ TODO: check
CAN-2005-0549 (Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2
...)
NOTE: not-for-us (Solaris)
CAN-2005-0548 (Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2
...)
@@ -2134,7 +2299,7 @@
NOTE: not-for-us (CubeCart)
CAN-2005-0442 (Directory traversal vulnerability in index.php for CubeCart
2.0.4 ...)
NOTE: not-for-us (CubeCart)
-CAN-2005-0441 (Buffer overflow in Sybase Adaptive Server Enterprise (ASE) 12.x
before ...)
+CAN-2005-0441 (Multiple stack-based buffer overflows in Sybase Adaptive Server
...)
NOTE: not-for-us (Sybase)
CAN-2005-0440 (ELOG before 2.5.7 allows remote attackers to bypass
authentication and ...)
- elog 2.5.7+r1558-1
@@ -2240,7 +2405,7 @@
CAN-2005-0391
NOTE: reserved
CAN-2005-0390 [axel buffer overflow in HTTP redirection handling in conn.c]
- NOTE: reserved
+ {DSA-706-1}
- axel 1.0b-1
CAN-2005-0389
NOTE: rejected
@@ -2324,8 +2489,8 @@
NOTE: not-for-us (Sentinel License Manager)
CAN-2005-0352 (Servers Alive 4.1 and 5.0, when running as a service, does not
drop ...)
NOTE: not-fo-us (Servers Alive)
-CAN-2005-0351
- NOTE: reserved
+CAN-2005-0351 (Buffer overflow in (1) termsh, (2) atcronsh, and (3) auditsh in
SCO ...)
+ TODO: check
CAN-2005-0350 (Heap-based buffer overflow in multiple F-Secure Anti-Virus and
...)
NOTE: not-for-us (F-Secure Anti-Virus)
CAN-2005-0349 (The production release of the UniversalAgent for UNIX in
BrightStor ...)
@@ -3304,16 +3469,16 @@
- pdftohtml 0.36-11
- kdegraphics (unfixed; bug #303238)
- tetex-bin 2.0.2-26
-CAN-2005-0063
- NOTE: reserved
+CAN-2005-0063 (The document processing application used by the Windows Shell in
...)
+ TODO: check
CAN-2005-0062
NOTE: reserved
-CAN-2005-0061
- NOTE: reserved
-CAN-2005-0060
- NOTE: reserved
-CAN-2005-0059
- NOTE: reserved
+CAN-2005-0061 (The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2,
and ...)
+ TODO: check
+CAN-2005-0060 (Buffer overflow in the font processing component of Microsoft
Windows ...)
+ TODO: check
+CAN-2005-0059 (Buffer overflow in the Message Queuing component of Microsoft
Windows ...)
+ TODO: check
CAN-2005-0058
NOTE: reserved
CAN-2005-0057 (The Hyperlink Object Library for Windows 98, 2000, XP, and
Server 2003 ...)
@@ -4430,6 +4595,7 @@
CAN-2004-0958 (php_variables.c in PHP before 5.0.2 allows remote attackers to
read ...)
- php4 4.3.9
CAN-2004-0957 (Unknown vulnerability in MySQL 3.23.58 and earlier, when a local
user ...)
+ {DSA-707-1}
- mysql-dfsg-4.1 4.1.10a-6
- mysql-dfsg 4.0.24-5
CAN-2004-0956 (MySQL before 4.0.20 allows remote attackers to cause a denial of
...)