CERTVU:258721Various FTP clients fail to account for pipe (|) characters in default file names
0.06 Low
EPSS
Percentile
93.5%
Overview
Various FTP client implementations do not correctly handle files whose name begins with the “|” (pipe) character.
Description
Most FTP clients include a feature in which the remote filename is used as the local filename in a GET (RETR) operation. For example, many FTP clients support syntax similar to the following:
ftp> get file.name local.name
which causes the remote file _file.name _to be retrieved to the local client and named local.name. In a typical FTP client, if you specify
ftp> get file.name
the client will assume a local name of file.name. Furthermore, many FTP clients support an often undocumented feature that allows the contents of a remote file to be piped through a local command. For example,
ftp> get README | more
will often cause the contents of the remote file README to be piped through the local more command. This is a very widely known and often used feature, but is not well documented. Note specifically that the presence of the pipe character (|) means that the second argument to the _get _command is not a filename, but rather an indication to pass the contents of the remote filename through a command. Similar undocumented behavior is often present for the dash character (-), which causes the contents of the remote file to be sent to standard output.
Some FTP clients with both features present a security risk. If the name of the remote file begins with a pipe character (|), and an FTP client relies on the default local filename, the contents of the file will be piped through a command based on the name of the remote file. Specifically, the command will be the name of the remote file without the leading pipe (|) character. For example, if the remote file is named |logger, with the contents
hello, how are you
an FTP command such as
ftp> get |logger
will, on a vulnerable FTP client, cause the contents of the file (hello, how are you) to be logged to your local system log, rather than creating a local file named |logger.
In October of 1997, IBM’s Emergency Response Service published a security advisory (ERS-SVA-E01-1997:009.1) detailing a vulnerability in the AIX FTP client. Quoting from ERS-SVA-E01-1997:009.1:
The ftp client can be tricked into running arbitrary commands supplied by the remote server. When the remote file begins with a pipe symbol, the ftp client will process the contents of the remote file as a shell script.
After IBM’s Emergency Response Service published their bulletin, it was discovered that other vendors client FTP implementations were vulnerable as well. However, it appears not all implementations were actually fixed. Some discussion about this problem is available at
<http://online.securityfocus.com/bid/396/discussion/>
In 2003, this problem was discovered to have affected FTP clients that weren’t fixed when the problem was originally discovered, most notably including the FTP client from MIT, which is redistributed by some operating system vendors such as Red Hat. The list of vendors below includes as “vulnerable” vendors who fixed their FTP clients in the 1997 time frame. Follow the links to individual vendor records for more detailed information.
Impact
A malicious server can execute arbitrary code on a victim FTP client.
Solution
Apply a vendor-supplied patch.
Vendor Information
258721
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
MIT Kerberos Development Team __ Affected
Notified: January 17, 2003 Updated: January 24, 2003
Status
Affected
Vendor Statement
By inspection of the code, MIT krb5 releases up to and including krb5-1.2.7 appear to be vulnerable. Our development sources also appear to be vulnerable. We will be working on a patch.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Red Hat Inc. __ Affected
Notified: January 16, 2003 Updated: February 03, 2003
Status
Affected
Vendor Statement
Red Hat has audited the various ftp clients distributed as part of Red Hat Linux. The ftp client that ships as part of the Kerberos 5 packages (krb5-workstation) is vulnerable to these issues. Updated packages are now available along with our advisory at the URL below. Users of Red Hat can update their systems using the ‘up2date’ tool.
<http://rhn.redhat.com/errata/RHSA-2003-020.html>
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Sun Microsystems Inc. __ Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Affected
Vendor Statement
This issue was addressed in Solaris 7 and patched in earlier releases. Thus this issue does not affect Solaris 7, 8 and 9. The only affected and supported version of Solaris is 2.6 with the following patches available: 106522-01 or later (SPARC) and 106523-01 or later (x86). Sun will be publishing a Sun Alert available from the following location for this issue:
<http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fsalert/50222>
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Xerox Corporation __ Affected
Notified: January 16, 2003 Updated: May 30, 2003
Status
Affected
Vendor Statement
A response to this vulnerability is available from our web site: <http://www.xerox.com/security>.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Apple Computer Inc. __ Not Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
The currently-shipping FTP client for Mac OS X and Mac OS X Server does not contain the vulnerability described in this advisory.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Cisco Systems Inc. __ Not Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Not Affected
Vendor Statement
All Cisco software which is not based on a variant of Unix is not affected by this vulnerability. This list includes but is not limited to Cisco IOS, CatOS and PIX software. Cisco products which run on a customer supplied Unix or Linux based platform should check with their operating system vendor to determine their vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Cray Inc. __ Not Affected
Notified: January 16, 2003 Updated: January 16, 2003
Status
Not Affected
Vendor Statement
Cray Inc. is not vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
FreeBSD __ Not Affected
Notified: January 16, 2003 Updated: January 21, 2003
Status
Not Affected
Vendor Statement
FreeBSD is not affected.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Hewlett-Packard Company __ Not Affected
Notified: January 16, 2003 Updated: January 28, 2003
Status
Not Affected
Vendor Statement
Source:
Hewlett-Packard Company Software Security Response Team
cross reference id: SSRT3456
HP-UX - not vulnerable
HP-MPE/ix - not vulnerable
HP Tru64 UNIX - not vulnerable
HP OpenVMS - not vulnerable
HP NonStop Servers - not vulnerable
To report potential security vulnerabilities in HP software, send an E-mail message to: mailto:[email protected]
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Hitachi __ Not Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Not Affected
Vendor Statement
GR2000 router is not vulnerable described by this notice.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
IBM __ Not Affected
Notified: January 16, 2003 Updated: January 16, 2003
Status
Not Affected
Vendor Statement
The ftp client in IBM’s AIX operating system is not vulnerable to this issue.
The ftp client does not allow files beginning with pipe symbols (“|”) to be retrieved. In this case,the client will return an error message.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Ingrian Networks __ Not Affected
Notified: January 16, 2003 Updated: January 17, 2003
Status
Not Affected
Vendor Statement
Ingrian Networks has determined that no Ingrian platforms are vulnerable to this attack.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Juniper Networks __ Not Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
Juniper has determined that none of our platforms are affected by this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
MontaVista Software __ Not Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
MontaVista Software’s Linux products are not vulnerable to this problem.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
NetBSD __ Not Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Not Affected
Vendor Statement
The FTP client shipped with currently supported versions of NetBSD is not vulnerable to this issue.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Netscreen __ Not Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Not Affected
Vendor Statement
NetScreen is not vulnerable to this issue.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Network Appliance __ Not Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
NetApp products are not affected by this.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Nokia __ Not Affected
Notified: January 16, 2003 Updated: January 24, 2003
Status
Not Affected
Vendor Statement
Nokia IP Security Platforms based on the IPSO operating system are not susceptible to this vulnerability.
Nokia Small Office Products do not contain an ftp client and so are not susceptible to this vulnerability.
Nokia VPN products do not contain FTP client or server, and the AlchemyOS operating system does not allow for piping. Nokia VPN products are not susceptible to this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Openwall GNU/*/Linux __ Not Affected
Notified: January 16, 2003 Updated: January 20, 2003
Status
Not Affected
Vendor Statement
The “lftp” client used on Openwall GNU/*/Linux doesn’t have the vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Riverstone Networks __ Not Affected
Notified: January 16, 2003 Updated: January 17, 2003
Status
Not Affected
Vendor Statement
Riverstone Networks does not provide an FTP client and is not vulnerable to this problem.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
AT&T Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Alcatel Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Avaya Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
BSDI Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Compaq Computer Corporation Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Computer Associates Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Conectiva Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Data General Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Debian Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Engarde Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
F5 Networks Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Fujitsu Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Intel Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Lachman Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Lotus Software Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Lucent Technologies Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
MandrakeSoft Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Microsoft Corporation Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Multi-Tech Systems Inc. Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Multinet Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
NEC Corporation Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
NeXT Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Nortel Networks Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
OpenBSD Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Oracle Corporation Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Redback Networks Inc. Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
SGI Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Sequent Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Sony Corporation Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
SuSE Inc. Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
The SCO Group (SCO Linux) Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
The SCO Group (SCO UnixWare) Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Unisys Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Wind River Systems Inc. Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
Wirex Unknown
Notified: January 16, 2003 Updated: January 16, 2003
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258721 Feedback>).
View all 55 vendors __View less vendors __
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- <http://online.securityfocus.com/bid/396>
- <http://www.iss.net/security_center/static/605.php>
- <http://online.securityfocus.com/advisories/1448>
Acknowledgements
Thanks to Fozzy of The Hackademy Audit Project for bringing this issue to our attention.
This document was written by Ian A. Finlay & Shawn V. Hernan.
Other Information
| CVE IDs: | CVE-1999-0097 |
|---|---|
| Severity Metric: | 17.69 Date Public: |
Related
