Author: joeyh
Date: 2005-05-25 09:14:21 +0000 (Wed, 25 May 2005)
New Revision: 1146
Modified:
sarge-checks/CAN/list
Log:
automatic CAN database update
Modified: sarge-checks/CAN/list
==================================================================---
sarge-checks/CAN/list 2005-05-25 08:54:39 UTC (rev 1145)
+++ sarge-checks/CAN/list 2005-05-25 09:14:21 UTC (rev 1146)
@@ -1,3 +1,273 @@
+CAN-2005-1750 (SQL injection vulnerability in login.asp in ezdwc NewsletterEz
3.0 ...)
+ TODO: check
+CAN-2005-1749 (Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1
...)
+ TODO: check
+CAN-2005-1748 (The embedded LDAP server in BEA WebLogic Server and Express 8.1
...)
+ TODO: check
+CAN-2005-1747 (Multiple cross-site scripting (XSS) vulnerabilities in BEA
WebLogic ...)
+ TODO: check
+CAN-2005-1746 (The cluster cookie parsing code in BEA WebLogic Server 7.0
through ...)
+ TODO: check
+CAN-2005-1745 (The UserLogin control in BEA WebLogic Portal 8.1 through Service
Pack ...)
+ TODO: check
+CAN-2005-1744 (BEA WebLogic Server and WebLogic Express 7.0 through Service
Pack 5 ...)
+ TODO: check
+CAN-2005-1743 (BEA WebLogic Server and WebLogic Express 8.1 through Service
Pack 3 ...)
+ TODO: check
+CAN-2005-1742 (BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows
users ...)
+ TODO: check
+CAN-2005-1741 (Gearbox Software Halo Combat Evolved 1.6 allows remote attackers
to ...)
+ TODO: check
+CAN-2005-1740 (fixproc in Net-snmp 5.x before 5.2.1-r1 creates temporary files
...)
+ TODO: check
+CAN-2005-1739 (The XWD Decoder in ImageMagick before 6.2.2.3, and
GraphicsMagick ...)
+ TODO: check
+CAN-2005-1738 (Multiple format string vulnerabilities in the (1)
logPrintBadfile ...)
+ TODO: check
+CAN-2005-1737 (Multiple unknown vulnerabilities in PROMS 0.11 allow
"non-authorized ...)
+ TODO: check
+CAN-2005-1736 (PROMS 0.11 does not properly handle "certain
combinations of rights," ...)
+ TODO: check
+CAN-2005-1735 (Multiple cross-site scripting (XSS) vulnerabilities in PROMS
before ...)
+ TODO: check
+CAN-2005-1734 (Multiple SQL injection vulnerabilities in PROMS before 0.11
allow ...)
+ TODO: check
+CAN-2005-1733 (Cookie Cart stores the password file under the web document root
with ...)
+ TODO: check
+CAN-2005-1732 (Cookie Cart allows remote attackers to read the Order
Notification ...)
+ TODO: check
+CAN-2005-1731
+ NOTE: reserved
+CAN-2005-1730
+ NOTE: reserved
+CAN-2005-1729
+ NOTE: reserved
+CAN-2005-1728
+ NOTE: reserved
+CAN-2005-1727
+ NOTE: reserved
+CAN-2005-1726
+ NOTE: reserved
+CAN-2005-1725
+ NOTE: reserved
+CAN-2005-1724
+ NOTE: reserved
+CAN-2005-1723
+ NOTE: reserved
+CAN-2005-1722
+ NOTE: reserved
+CAN-2005-1721
+ NOTE: reserved
+CAN-2005-1720
+ NOTE: reserved
+CAN-2005-1719 (Unknown vulnerability in ALWIL avast! antivirus 4 (4.6.6230) and
...)
+ TODO: check
+CAN-2005-1718 (Buffer overflow in LS Games War Times 1.03 and earlier allows
remote ...)
+ TODO: check
+CAN-2005-1717 (ZyXEL Prestige 650R-31 router running ZyNOS FW v3.40(KO.1)
allows ...)
+ TODO: check
+CAN-2005-1716 (TOPo 2.2 (2.2.178) stores data files in the data directory under
the ...)
+ TODO: check
+CAN-2005-1715 (Cross-site scripting (XSS) vulnerability in index.php for TOPo
2.2 ...)
+ TODO: check
+CAN-2005-1714 (Cross-site scripting (XSS) vulnerability in NetWin SurgeMail
3.0c2 ...)
+ TODO: check
+CAN-2005-1713 (Multiple cross-site scripting (XSS) vulnerabilities in
Serendipity 0.8 ...)
+ TODO: check
+CAN-2005-1712 (Unknown vulnerability in Serendipity 0.8, when used with
multiple ...)
+ TODO: check
+CAN-2005-1711 (Gibraltar Firewall 2.2 and earlier, when using the ClamAV update
to ...)
+ TODO: check
+CAN-2005-1710 (Multiple cross-site scripting (XSS) vulnerabilities in Blue Coat
...)
+ TODO: check
+CAN-2005-1709 (Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows
remote ...)
+ TODO: check
+CAN-2005-1708 (Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows
...)
+ TODO: check
+CAN-2005-1707 (The fn_show_postinst function in Gentoo webapp-config before
1.10-r14 ...)
+ TODO: check
+CAN-2005-1706 (Unknown vulnerability in MailScanner 4.41.3 and earlier, related
to ...)
+ TODO: check
+CAN-2005-1705 (gdb before 6.3 searches the current working directory to load
the ...)
+ TODO: check
+CAN-2005-1704 (Integer overflow in the BFD library for gdb before 6.3 allows
...)
+ TODO: check
+CAN-2005-1703 (Warrior Kings: Battles 1.23 and earlier allows remote attackers
to ...)
+ TODO: check
+CAN-2005-1702 (Format string vulnerability in Warrior Kings: Battles 1.23 and
earlier ...)
+ TODO: check
+CAN-2005-1701 (SQL injection vulnerability in PortailPHP 1.3 allows remote
attackers ...)
+ TODO: check
+CAN-2005-1700 (SQL injection vulnerability in pnadmin.php in the Xanthia module
in ...)
+ TODO: check
+CAN-2005-1699 (Directory traversal vulnerability in pnadminapi.php in the
Xanthia ...)
+ TODO: check
+CAN-2005-1698 (PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain
...)
+ TODO: check
+CAN-2005-1697 (The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows
remote ...)
+ TODO: check
+CAN-2005-1696 (Multiple cross-site scripting (XSS) vulnerabilities in PostNuke
0.750 ...)
+ TODO: check
+CAN-2005-1695 (Multiple cross-site scripting (XSS) vulnerabilities in the RSS
module ...)
+ TODO: check
+CAN-2005-1694 (Multiple SQL injection vulnerabilities in Xanthia.php in the
Xanthia ...)
+ TODO: check
+CAN-2005-1693 (Integer overflow in Computer Associates Vet Antivirus library,
as used ...)
+ TODO: check
+CAN-2005-1692 (Format string vulnerability in gxine 0.41 through 0.44 allows
remote ...)
+ TODO: check
+CAN-2005-1691
+ NOTE: reserved
+CAN-2005-1690
+ NOTE: reserved
+CAN-2005-1689
+ NOTE: reserved
+CAN-2005-1688 (Wordpress 1.5 and earlier allow remote attackers to obtain
sensitive ...)
+ TODO: check
+CAN-2005-1687 (SQL injection vulnerability in wp-trackback.php in Wordpress 1.5
and ...)
+ TODO: check
+CAN-2005-1686 (Format string vulnerability in gedit 2.10.2 may allow attackers
to ...)
+ TODO: check
+CAN-2005-1685 (episodex guestbook allows remote attackers to bypass
authentication ...)
+ TODO: check
+CAN-2005-1684 (Cross-site scripting (XSS) vulnerability in default.asp for
episodex ...)
+ TODO: check
+CAN-2005-1683 (Buffer overflow in winword.exe 10.2627.6714 and earlier in
Microsoft ...)
+ TODO: check
+CAN-2005-1682 (JavaMail API, as used by Solstice Internet Mail Server POP3 2.0,
does ...)
+ TODO: check
+CAN-2005-1681 (PHP remote code injection vulnerability in common.php in phpATM
1.21, ...)
+ TODO: check
+CAN-2005-1680 (D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when ...)
+ TODO: check
+CAN-2005-1679 (Stack-based buffer overflow in the error directive in picasm
1.12b and ...)
+ TODO: check
+CAN-2005-1678 (Groove Virtual Office before 3.1 build 2338, before 3.1a build
2364, ...)
+ TODO: check
+CAN-2005-1677 (Unknown vulnerability in Groove Virtual Office before 3.1 build
2338, ...)
+ TODO: check
+CAN-2005-1676 (Multiple cross-site scripting (XSS) vulnerabilities in Groove
Mobile ...)
+ TODO: check
+CAN-2005-1675 (Groove Virtual Office before 3.1 build 2338, before 3.1a build
2364, ...)
+ TODO: check
+CAN-2005-1674 (Cross-Site Request Forgery (CSRF) vulnerability in Help Center
Live ...)
+ TODO: check
+CAN-2005-1673 (Multiple SQL injection vulnerabilities in Help Center Live allow
...)
+ TODO: check
+CAN-2005-1672 (Multiple cross-site scripting (XSS) vulnerabilities in Help
Center ...)
+ TODO: check
+CAN-2005-1671 (The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be
...)
+ TODO: check
+CAN-2005-1670 (Unknown vulnerability in Extreme BlackDiamond 10808 and 8800
switches ...)
+ TODO: check
+CAN-2005-1669
+ NOTE: reserved
+CAN-2005-1668 (YusASP Web Asset Manager 1.0 allows remote attackers to gain
...)
+ TODO: check
+CAN-2005-1667 (DataTrac Activity Console 1.1 allows remote attackers to cause a
...)
+ TODO: check
+CAN-2005-1666 (Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow
...)
+ TODO: check
+CAN-2005-1665 (The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not
...)
+ TODO: check
+CAN-2005-1664 (The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows
remote ...)
+ TODO: check
+CAN-2005-1663 (Jeuce Personal Web Server 2.13 allows remote attackers to cause
a ...)
+ TODO: check
+CAN-2005-1662 (Directory traversal vulnerability in Jeuce Personal Web Server
2.13 ...)
+ TODO: check
+CAN-2005-1661 (Jeuce Personal Webserver 2.13 allows remote attackers to cause a
...)
+ TODO: check
+CAN-2005-1660 (HTMLJunction EZGuestbook stores the guestbook.mdb file under the
web ...)
+ TODO: check
+CAN-2005-1659 (Cross-site scripting (XSS) vulnerability in filemanager.cpp in
...)
+ TODO: check
+CAN-2005-1658 (Directory traversal vulnerability in filemanager.cpp in MyServer
0.8 ...)
+ TODO: check
+CAN-2005-1657 (Multiple directory traversal vulnerabilities in Mercur Messaging
2005 ...)
+ TODO: check
+CAN-2005-1656 (Mercur Messaging 2005 SP2 allows remote attackers to read the
source ...)
+ TODO: check
+CAN-2005-1655 (AOL Instant Messenger 5.5.x and earlier allows remote attackers
to ...)
+ TODO: check
+CAN-2005-1654 (Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote
attackers ...)
+ TODO: check
+CAN-2004-2093 (Buffer overflow in the open_socket_out function in socket.c for
rsync ...)
+ TODO: check
+CAN-2004-2092 (eTrust InoculateIT for Linux 6.0 uses insecure permissions for
...)
+ TODO: check
+CAN-2004-2091 (Microsoft Baseline Security Analyzer (MBSA) 1.2 does not
correctly ...)
+ TODO: check
+CAN-2004-2090 (Microsoft Internet Explorer 5.0.1 through 6.0 allows remote
attackers ...)
+ TODO: check
+CAN-2004-2089 (Matrix FTP Server allows remote attackers to cause a denial of
service ...)
+ TODO: check
+CAN-2004-2088 (Sophos Anti-Virus 3.78 allows remote attackers to bypass virus
...)
+ TODO: check
+CAN-2004-2087 (Unknown vulnerability in SandSurfer before 1.7.0 allows remote
...)
+ TODO: check
+CAN-2004-2086 (Stack-based buffer overflow in results.stm for Sambar Server
before ...)
+ TODO: check
+CAN-2004-2085 (Multiple cross-site scripting (XSS) vulnerabilities in Brad
Fears ...)
+ TODO: check
+CAN-2004-2084 (Cross-site scripting (XSS) vulnerability in search.php in JShop
...)
+ TODO: check
+CAN-2004-2083 (Opera Web Browser 7.0 through 7.23 allows remote attackers to
trick ...)
+ TODO: check
+CAN-2004-2082 (The samiftp.dll library in Sami FTP Server 1.1.3 allows remote
...)
+ TODO: check
+CAN-2004-2081 (The samiftp.dll library in Sami FTP Server 1.1.3 allows local
users to ...)
+ TODO: check
+CAN-2004-2080 (Red-M Red-Alert 2.7.5 with software 3.1 build 24 converts
multiple ...)
+ TODO: check
+CAN-2004-2079 (Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds
authentication ...)
+ TODO: check
+CAN-2004-2078 (Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote
...)
+ TODO: check
+CAN-2004-2077 (Nadeo Game Engine for Nadeo TrackMania and Nadeo Virtual Skipper
3 ...)
+ TODO: check
+CAN-2004-2076 (Cross-site scripting (XSS) vulnerability in search.php for
Jelsoft ...)
+ TODO: check
+CAN-2004-2075 (Sophos Anti-Virus 3.78 allows remote attackers to cause a denial
of ...)
+ TODO: check
+CAN-2004-2074 (Format string vulnerability in Dream FTP 1.02 allows local users
to ...)
+ TODO: check
+CAN-2004-2073 (Linux-VServer 1.24 allows local users with root privileges on a
...)
+ TODO: check
+CAN-2004-2072 (Cross-site scripting (XSS) vulnerability in index.php for Mambo
Open ...)
+ TODO: check
+CAN-2004-2071 (Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier
...)
+ TODO: check
+CAN-2003-1214 (Unknown vulnerability in the server login for VisualShapers
ezContents ...)
+ TODO: check
+CAN-2003-1213 (The default installation of MaxWebPortal 1.30 stores the portal
...)
+ TODO: check
+CAN-2003-1212 (MaxWebPortal 1.30 allows remote attackers to perform
unauthorized ...)
+ TODO: check
+CAN-2003-1211 (Cross-site scripting (XSS) vulnerability in search.asp for ...)
+ TODO: check
+CAN-2003-1210 (Multiple SQL injection vulnerabilities in the Downloads module
for ...)
+ TODO: check
+CAN-2003-1209 (The Post_Method function in Monkey HTTP Daemon before 0.6.2
allows ...)
+ TODO: check
+CAN-2003-1208 (Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow
local ...)
+ TODO: check
+CAN-2003-1207 (Crob FTP Server 3.5.1 allows remote authenticated users to cause
a ...)
+ TODO: check
+CAN-2003-1206 (Format string vulnerability in Crob FTP Server 2.60.1 allows
remote ...)
+ TODO: check
+CAN-2003-1205 (Crob FTP Server 2.60.1 allows remote authenticated users to
cause a ...)
+ TODO: check
+CAN-2003-1204 (Multiple cross-site scripting (XSS) vulnerabilities in Mambo
Site ...)
+ TODO: check
+CAN-2003-1203 (Cross-site scripting (XSS) vulnerability in index.php for Mambo
Site ...)
+ TODO: check
+CAN-2002-1663 (The Post_Method function in method.c for Monkey HTTP Daemon
before ...)
+ TODO: check
+CAN-2002-1662 (Multiple cross-site scripting (XSS) vulnerabilities in Mambo
Site ...)
+ TODO: check
+CAN-2000-1224 (Caucho Technology Resin 1.2 and possibly earlier allows remote
...)
+ TODO: check
CAN-2005-XXXX [imagemagick xwd endless loop DoS]
- imagemagick (unfixed; bug #310690)
CAN-2005-XXXX [Insecure tempfile handling in net-snmp''s fixproc]
@@ -46,7 +316,7 @@
NOTE: not-for-us (SafeHTML)
CAN-2005-1637 (Multiple SQL injection vulnerabilities in NPDS 4.8 and 5.0 allow
...)
NOTE: not-for-us (NPDS)
-CAN-2005-1636 (mysql_install_db in MySQL 4.x before 4.0.12 and 5.x up to 5.0.4
...)
+CAN-2005-1636 (mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to
5.0.4 ...)
TODO: mysql-dfsg-4.1 should be already be fixed as well, double check
- mysql-dfsg 4.0.12-2
CAN-2005-1635 (JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to
obtain ...)
@@ -386,7 +656,7 @@
NOTE: not-for-us (ArticleLive)
CAN-2005-1482 (ArticleLive 2005 allows remote attackers to gain privileges by
...)
NOTE: not-for-us (ArticleLive)
-CAN-2005-1481 (Multiple SQL injection vulnerabilities in ASP Inline Corporate
...)
+CAN-2005-1481 (Multiple SQL injection vulnerabilities in Aaron Outpost ASP
Inline ...)
NOTE: not-for-us (ASP Inline Corporate Calendar)
CAN-2005-1480 (Directory traversal vulnerability in RaidenFTPD before 2.4.2241
allows ...)
NOTE: not-for-us (RaidenFTPD)
@@ -894,7 +1164,7 @@
NOTE: not-for-us
CAN-2004-1823 (Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft
...)
NOTE: not-for-us
-CAN-2004-1822 (Multiple cross-site scripting (XSS) vulnurabilities in Phorum
3.1 ...)
+CAN-2004-1822 (Multiple cross-site scripting (XSS) vulnerabilities in Phorum
3.1 ...)
NOTE: not-for-us
CAN-2004-1821 (SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5
through ...)
NOTE: not-for-us
@@ -1195,10 +1465,10 @@
- ethereal 0.10.10-2sarge2
CAN-2005-1456 (Multiple unknown vulnerabilities in the (1) DHCP and (2) Telnet
...)
- ethereal 0.10.10-2sarge2
-CAN-2005-1455
- NOTE: reserved
-CAN-2005-1454
- NOTE: reserved
+CAN-2005-1455 (Buffer overflow in the sql_escape_func function in FreeRADIUS
1.0.2 ...)
+ TODO: check
+CAN-2005-1454 (SQL injection vulnerability in the radius_xlat function in
FreeRADIUS ...)
+ TODO: check
CAN-2005-1453 (fetchnews in leafnode 1.9.48 to 1.11.1 allows remote NNTP
servers to ...)
- leafnode 1.11.2.rel-1
CAN-2004-2069 (sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other
versions, ...)
@@ -1640,8 +1910,8 @@
CAN-2005-1261 (Stack-based buffer overflow in the URL parsing function in Gaim
before ...)
NOTE: see http://gaim.sourceforge.net/security/
- gaim 1:1.2.1-1.1
-CAN-2005-1260
- NOTE: reserved
+CAN-2005-1260 (bzip2 allows remote attackers to cause a denial of service (hard
drive ...)
+ TODO: check
CAN-2005-1259
NOTE: reserved
CAN-2005-1258
@@ -3014,8 +3284,8 @@
CAN-2005-0758 (zgrep in gzip before 1.3.5 does not properly sanitize arguments,
which ...)
NOTE: see http://bugs.gentoo.org/show_bug.cgi?id=90626
- gzip 1.3.5-10
-CAN-2005-0757
- NOTE: reserved
+CAN-2005-0757 (The xattr file system code on Linux 2.4.x on 64-bit systems does
not ...)
+ TODO: check
CAN-2005-0756
NOTE: reserved
CAN-2005-0755 (Heap-based buffer overflow in RealPlayer 10 and earlier, Helix
Player ...)
@@ -4555,8 +4825,7 @@
NOTE: reserved
CAN-2005-0393
NOTE: reserved
-CAN-2005-0392
- NOTE: reserved
+CAN-2005-0392 (ppxp does not drop root privileges before opening log files,
which ...)
{DSA-725-1}
CAN-2005-0391 (geneweb 4.10 and earlier does not properly check file
permissions and ...)
{DSA-712-1}
@@ -5011,7 +5280,7 @@
NOTE: not-for-us (PhotoPost)
CAN-2005-0272 (ReviewPost PHP Pro before 2.84 allows remote attackers to upload
and ...)
NOTE: not-for-us (ReviewPost)
-CAN-2005-0271 (Multiple SQL injection vulnerbilities in ReviewPost PHP Pro
before ...)
+CAN-2005-0271 (Multiple SQL injection vulnerabilities in ReviewPost PHP Pro
before ...)
NOTE: not-for-us (ReviewPost)
CAN-2005-0270 (Multiple cross-site scripting (XSS) vulnerabilities in
ReviewPost PHP ...)
NOTE: not-for-us (ReviewPost)
@@ -5446,8 +5715,8 @@
- kernel-source-2.6.8 2.6.8-14
CAN-2005-0135 (The unw_unwind_to_user function in unwind.c on Itanium (ia64)
...)
- kernel-source-2.6.8 2.6.8-14
-CAN-2005-0134
- NOTE: reserved
+CAN-2005-0134 (The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not
properly ...)
+ TODO: check
CAN-2004-1381 (Firefox before 1.0 and Mozilla before 1.7.5 allow inactive ...)
- mozilla-firefox 1.0
- mozilla 2:1.7.5
@@ -5669,8 +5938,8 @@
NOTE: reserved
CAN-2005-0041
NOTE: reserved
-CAN-2005-0040
- NOTE: reserved
+CAN-2005-0040 (Multiple cross-site scripting (XSS) vulnerabilities in
DotNetNuke ...)
+ TODO: check
CAN-2005-0039 (Certain configurations of IPsec, when using Encapsulating
Security ...)
TODO: check
CAN-2005-0038
@@ -8211,7 +8480,7 @@
NOTE: not-for-us (MSIE bugs)
CAN-2004-0283 (Mailmgr 1.2.3 allows local users to overwrite arbitrary files
via a ...)
NOTE: not-for-us (mailmgr; not in Debian)
-CAN-2004-0282 (Crob FTP daemon 2.5.2 allows remote attackers to cause a denial
of ...)
+CAN-2004-0282 (Crob FTP daemon 3.5.2 allows remote attackers to cause a denial
of ...)
NOTE: not-for-us (Crob FTP; not in Debian)
CAN-2004-0281 (Caucho Technology Resin 2.1.12 allows remote attackers to gain
...)
NOTE: not-for-us (Caucho Technology Resin; not in Debian)