deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-0972
Published: 2003-12-15
Description: Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000809; http://groups.yahoo.com/group/gnu-screen/message/3118; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3873&w=2
CVE: CVE-2003-0973
Published: 2003-12-15
Description: Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.fedora.us/show_bug.cgi?id=1325; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000837; http://www.debian.org/security/2004/dsa-452
CVE: CVE-2003-0974
Published: 2003-12-15
Description: Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as (1) add new users to a console, as demonstrated using appliedsnatch.c, or (2) add spurious IDS rules to sensors, as demonstrated using addrule.c.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6252&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5918&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4376&w=2
CVE: CVE-2003-0975
Published: 2003-12-15
Description: Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=61798; http://lists.apple.com/mhonarc/security-announce/msg00042.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8552&w=2
CVE: CVE-2003-0976
Published: 2003-12-15
Description: NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not properly enforce sys:\etc\exports when hostname aliases from sys:etc\hosts file are used, which could allow users to mount file systems when XNFS should deny the host.
CVSS Score: 7.5 (HIGH)
References: http://support.novell.com/cgi-bin/search/searchtid.cgi?/10089375.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/13915; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10089375.htm
CVE: CVE-2003-1198
Published: 2003-12-26
Description: connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
CVSS Score: 5.0 (MEDIUM)
References: http://freshmeat.net/redir/cherokee/20646/url_changelog/ChangeLog; http://secunia.com/advisories/10518; http://www.osvdb.org/3306
CVE: CVE-2003-1200
Published: 2003-12-29
Description: Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
CVSS Score: 7.5 (HIGH)
References: http://hat-squad.com/bugreport/mdaemon-raw.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9354&w=2; http://secunia.com/advisories/10512
CVE: CVE-2003-1215
Published: 2003-12-29
Description: SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0885&w=2; http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=161943; http://www.securityfocus.com/bid/9314
CVE: CVE-2003-0249
Published: 2003-12-31
Description: PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive.  NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method.  A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods.  It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=97; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=97
CVE: CVE-2003-0317
Published: 2003-12-31
Description: iisPROTECT 2.1 and 2.2 allows remote attackers to bypass authentication via an HTTP request containing URL-encoded characters.
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=25; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=25
CVE: CVE-2003-0351
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0306.  Reason: This candidate is a reservation duplicate of CVE-2003-0306.  Notes: All CVE users should reference CVE-2003-0306 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0363
Published: 2003-12-31
Description: Format string vulnerability in LICQ 1.2.6, 1.0.3 and possibly other versions allows remote attackers to perform unknown actions via format string specifiers.
CVSS Score: 7.5 (HIGH)
References: http://csdl.computer.org/comp/proceedings/hicss/2004/2056/09/205690277.pdf; http://csdl.computer.org/comp/proceedings/hicss/2004/2056/09/205690277.pdf
CVE: CVE-2003-0463
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2003-0582
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0504.  Reason: This candidate is a duplicate of CVE-2003-0504.  Notes: All CVE users should reference CVE-2003-0504 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0627
Published: 2003-12-31
Description: psdoccgi.exe in PeopleSoft PeopleTools 8.4 through 8.43 allows remote attackers to cause a denial of service (application crash), possibly via the headername and footername arguments.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q4/0042.html; http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/013652.html; http://www.secunia.com/advisories/10225/
CVE: CVE-2003-0691
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not associated with any specific security issue.  Notes: none
CVE: CVE-2003-0698
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0743.  Reason: This candidate is a duplicate of CVE-2003-0743.  Notes: All CVE users should reference CVE-2003-0743 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0857
Published: 2003-12-31
Description: The (1) ipq_read and (2) ipulog_read functions in iptables allow local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=108574; https://bugzilla.redhat.com/show_bug.cgi?id=108574
CVE: CVE-2003-0885
Published: 2003-12-31
Description: Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, and (3) pong screensavers, and allows local users to overwrite arbitrary files via a symlink attack.
CVSS Score: 6.4 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=41253; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286; http://bugs.gentoo.org/show_bug.cgi?id=41253
CVE: CVE-2003-0887
Published: 2003-12-31
Description: ez-ipupdate 3.0.11b7 and earlier creates insecure temporary cache files, which allows local users to conduct unauthorized operations via a symlink attack on the ez-ipupdate.cache file.
CVSS Score: 2.1 (LOW)
References: http://cvs.mandriva.com/cgi-bin/viewcvs.cgi/SPECS/ez-ipupdate/ez-ipupdate.spec?r1=1.4&r2=1.5; http://cvs.mandriva.com/cgi-bin/viewcvs.cgi/SPECS/ez-ipupdate/ez-ipupdate.spec?rev=1.6; http://cvs.mandriva.com/cgi-bin/viewcvs.cgi/SPECS/ez-ipupdate/ez-ipupdate.spec?r1=1.4&r2=1.5
CVE: CVE-2003-0900
Published: 2003-12-31
Description: Perl 5.8.1 on Fedora Core does not properly initialize the random number generator when forking, which makes it easier for attackers to predict random numbers.
CVSS Score: 5.0 (MEDIUM)
References: https://bugzilla.redhat.com/bugzilla/long_list.cgi?buglist=108711; https://bugzilla.redhat.com/bugzilla/long_list.cgi?buglist=108711
CVE: CVE-2003-0954
Published: 2003-12-31
Description: Buffer overflow in rcp for AIX 4.3.3, 5.1 and 5.2 allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10276/; http://securitytracker.com/id?1008258; http://www-1.ibm.com/support/search.wss?rs=0&q=IY48272&apar=only
CVE: CVE-2003-0956
Published: 2003-12-31
Description: Multiple race conditions in the handling of O_DIRECT in Linux kernel prior to version 2.4.22 could cause stale data to be returned from the disk when handling sparse files, or cause incorrect data to be returned when a file is truncated as it is being read, which might allow local users to obtain sensitive data that was originally owned by other users, a different vulnerability than CVE-2003-0018.
CVSS Score: 2.6 (LOW)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403ef33d95ym_22QH2xwhDMt264M55Fg; https://exchange.xforce.ibmcloud.com/vulnerabilities/42942; http://linux.bkbits.net:8080/linux-2.4/cset%403ef33d95ym_22QH2xwhDMt264M55Fg
CVE: CVE-2003-0959
Published: 2003-12-31
Description: Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 allows attackers to cause a denial of service or gain root privileges via unspecified vectors that trigger copy_from_user function calls with improper length arguments.
CVSS Score: 10.0 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403ed382f7UfJ9Q2LKCJq1Tc5B7-EC5A; https://exchange.xforce.ibmcloud.com/vulnerabilities/43072; http://linux.bkbits.net:8080/linux-2.4/cset%403ed382f7UfJ9Q2LKCJq1Tc5B7-EC5A
CVE: CVE-2003-0986
Published: 2003-12-31
Description: Various routines for the ppc64 architecture on Linux kernel 2.6 prior to 2.6.2 and 2.4 prior to 2.4.24 do not use the copy_from_user function when copying data from userspace to kernelspace, which crosses security boundaries and allows local users to cause a denial of service.
CVSS Score: 1.7 (LOW)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403fdd54b3u9Eq0Wny2Nn1HGfI3pofOQ; http://linux.bkbits.net:8080/linux-2.6/cset%403ffcf122S7e3xPZCpibrXq6KRRjwqw; http://www.redhat.com/support/errata/RHSA-2004-017.html
CVE: CVE-2003-1005
Published: 2003-12-31
Description: The PKI functionality in Mac OS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (service crash) via malformed ASN.1 sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2003/Dec/msg00001.html; http://secunia.com/advisories/10474/; http://www.auscert.org.au/render.html?it=3704
CVE: CVE-2003-1066
Published: 2003-12-31
Description: Buffer overflow in the syslog daemon for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (syslogd crash) and possibly execute arbitrary code via long syslog UDP packets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/8944/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-55440-1; http://www.securityfocus.com/archive/1/324015
CVE: CVE-2003-1073
Published: 2003-12-31
Description: A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.
CVSS Score: 1.2 (LOW)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0044.html; http://isec.pl/vulnerabilities/isec-0008-sun-at.txt; http://secunia.com/advisories/7960/
CVE: CVE-2003-1076
Published: 2003-12-31
Description: Unknown vulnerability in sendmail for Solaris 7, 8, and 9 allows local users to cause a denial of service (unknown impact) and possibly gain privileges via certain constructs in a .forward file.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/8235/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-50904-1; http://www.ciac.org/ciac/bulletins/n-050.shtml
CVE: CVE-2003-1082
Published: 2003-12-31
Description: Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4705891, a different vulnerability than CVE-2003-1068.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/7892; http://sunsolve.sun.com/search/document.do?assetkey=1-26-50008-1; http://www.ciac.org/ciac/bulletins/n-105.shtml
CVE: CVE-2003-1083
Published: 2003-12-31
Description: Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/10280; http://security.gentoo.org/glsa/glsa-200403-14.xml; http://www.kb.cert.org/vuls/id/623854
CVE: CVE-2003-1085
Published: 2003-12-31
Description: The HTTP server in the Thomson TWC305, TWC315, and TCW690 cable modem ST42.03.0a allows remote attackers to cause a denial of service (unstable service) via a long GET request, possibly caused by a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/014062.html; http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/014068.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4678&w=2
CVE: CVE-2003-1087
Published: 2003-12-31
Description: Unknown vulnerability in diagmond and possibly other applications in HP9000 Series 700/800 running HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows remote attackers to cause a denial of service (program failure) via certain network traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8851&w=2; http://secunia.com/advisories/8971; http://www.securityfocus.com/bid/7827
CVE: CVE-2003-1089
Published: 2003-12-31
Description: index.php for Zorum 3.4 allows remote attackers to determine the full path of the web root via invalid parameter names, which reveals the path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5536&w=2; http://securitytracker.com/id?1013365; http://www.securityfocus.com/bid/8396
CVE: CVE-2003-1091
Published: 2003-12-31
Description: Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed ID3 tags in MP3 files.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2003-05/0245.html; http://securitytracker.com/id?1006822; http://www.kb.cert.org/vuls/id/148564
CVE: CVE-2003-1092
Published: 2003-12-31
Description: Unknown vulnerability in the "Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to "a memory allocation problem," has unknown impact.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/100937; http://www.securityfocus.com/archive/1/313847; http://www.securityfocus.com/bid/7009
CVE: CVE-2003-1093
Published: 2003-12-31
Description: BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a ResourceAllocationException.
CVSS Score: 4.6 (MEDIUM)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-24.jsp; http://www.kb.cert.org/vuls/id/331937; http://www.securityfocus.com/bid/6586
CVE: CVE-2003-1094
Published: 2003-12-31
Description: BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-35.jsp; http://www.kb.cert.org/vuls/id/999788; http://www.securityfocus.com/bid/8320
CVE: CVE-2003-1096
Published: 2003-12-31
Description: The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain privileges via brute force password guessing attacks.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1965&w=2; http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml; http://www.kb.cert.org/vuls/id/473108
CVE: CVE-2003-1097
Published: 2003-12-31
Description: Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2003-04/0374.html; http://www.ciac.org/ciac/bulletins/n-088.shtml; http://www.kb.cert.org/vuls/id/322540
CVE: CVE-2003-1098
Published: 2003-12-31
Description: The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.kb.cert.org/vuls/id/862401; http://www.kb.cert.org/vuls/id/IAFY-5HVQDJ; http://www.securityfocus.com/bid/6638
CVE: CVE-2003-1099
Published: 2003-12-31
Description: shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/10339; http://www.ciac.org/ciac/bulletins/o-032.shtml; http://www.kb.cert.org/vuls/id/509454
CVE: CVE-2003-1100
Published: 2003-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allow remote attackers to inject arbitrary web script or HTML via certain vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/9985; http://www.kb.cert.org/vuls/id/488684; http://www.procheckup.com/security_info/vuln_pr0305.html
CVE: CVE-2003-1101
Published: 2003-12-31
Description: Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allows remote attackers to obtain the full path of the DM Web Server via invalid login credentials, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/9985; http://www.kb.cert.org/vuls/id/715548; http://www.procheckup.com/security_info/vuln_pr0303.html
CVE: CVE-2003-1102
Published: 2003-12-31
Description: Hummingbird CyberDOCS 3.5, 3.9, and 4.0, when running on IIS, uses insecure permissions for script source code files, which allows remote attackers to read the source code.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/9985; http://www.kb.cert.org/vuls/id/989580; http://www.procheckup.com/security_info/vuln_pr0302.html
CVE: CVE-2003-1103
Published: 2003-12-31
Description: SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before 3.9 allows remote attackers to execute arbitrary SQL commands.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/9985; http://www.kb.cert.org/vuls/id/368300; http://www.procheckup.com/security_info/vuln_pr0304.html
CVE: CVE-2003-1104
Published: 2003-12-31
Description: Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) 1.2 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2003-03/0307.html; http://secunia.com/advisories/8349; http://www.kb.cert.org/vuls/id/210937
CVE: CVE-2003-1105
Published: 2003-12-31
Description: Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook Express crash) via HTML with certain input tags that are not properly rendered.
CVSS Score: 2.6 (LOW)
References: http://www.kb.cert.org/vuls/id/813208; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032; https://exchange.xforce.ibmcloud.com/vulnerabilities/13029
CVE: CVE-2003-1106
Published: 2003-12-31
Description: The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail message with a malformed time stamp in the FILETIME attribute.
CVSS Score: 5.0 (MEDIUM)
References: http://support.microsoft.com/default.aspx?kbid=330716; http://www.kb.cert.org/vuls/id/155252; http://www.securityfocus.com/bid/8195
CVE: CVE-2003-1107
Published: 2003-12-31
Description: The DHTML capability in Microsoft Windows Media Player (WMP) 6.4, 7.0, 7.1, and 9 may run certain URL commands from a security zone that is less trusted than the current zone, which allows attackers to bypass intended access restrictions.
CVSS Score: 5.1 (MEDIUM)
References: http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B828026; http://www.kb.cert.org/vuls/id/222044; https://exchange.xforce.ibmcloud.com/vulnerabilities/13375
CVE: CVE-2003-1108
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/; http://www.kb.cert.org/vuls/id/528719
CVE: CVE-2003-1109
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in multiple Cisco products including IP Phone models 7940 and 7960, IOS versions in the 12.2 train, and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.cisco.com/warp/public/707/cisco-sa-20030221-protos.shtml; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/
CVE: CVE-2003-1110
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in Columbia SIP User Agent (sipc) 1.74 and other versions before sipc 2.0 build 2003-02-21 allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1006167; http://www.cert.org/advisories/CA-2003-06.html; http://www.cs.columbia.edu/~xiaotaow/sipc/ouspg.html
CVE: CVE-2003-1111
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in multiple dynamicsoft products including y and certain demo products for AppEngine allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.dynamicsoft.com/support/advisory/ca-2003-06.php; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/