CVSS: 5.0EPSS: 2%CPEs: 18EXPL: 1CVE-2003-0078 – OpenSSL 0.9.x - CBC Error Information Leakage
https://notcve.org/view.php?id=CVE-2003-0078
ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack." ssl3_get_record en s3_ptk.c de OpenSSL anteriores a 0.9.7a y 0.9.6 anteriores a 0.9.6i no realiza un cálculo MAC si un relleno de bloque de cifra incorrecto es usado, lo que causa una fuga de información (discrepancia en temporización) que puede hacer más fácil lanzar ataques criptográficos que dependan de distinguir entren errores de relleno o de verificación de MAC, posiblemente conducentes a la extracción del texto plano original, también conocida como "Ataque de temporización de Vaudenay". • https://www.exploit-db.com/exploits/22264 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-001.txt.asc ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000570 http://marc.info/?l=bugtraq&m=104567627211904&w=2 http://marc.info/?l=bugtraq&m=104568426824439&w=2 http://marc.info/?l=bugtraq&m=104577183206905&w=2 http://www.ciac.org/ciac/bulletins/n-051.shtml http://www& • CWE-203: Observable Discrepancy •
CVSS: 5.3EPSS: 2%CPEs: 37EXPL: 3CVE-2003-0001 – Linux Kernel 2.0.x/2.2.x/2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure
https://notcve.org/view.php?id=CVE-2003-0001
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. Múltiples controladores de dispositivo (device drivers) de Tarjetas de Interfaz de Red (Network Interface Card - NIC) Ethernet no rellenan las tramas con bytes nulos, lo que permite a atacantes remotos obtener información de paquetes anteriores o memoria del kernel usando paquetes malformados, como ha sido demostrado por Etherleak. • https://www.exploit-db.com/exploits/22131 https://www.exploit-db.com/exploits/26076 https://www.exploit-db.com/exploits/3555 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0016.html http://marc.info/?l=bugtraq&m=104222046632243&w=2 http://secunia.com/advisories/7996 http://www.atstake.com/research/advisories/2003/a010603-1.txt http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf http://www.kb.cert.org/vuls/id/412115 http://www.ora • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 3EXPL: 0CVE-2002-1669
https://notcve.org/view.php?id=CVE-2002-1669
pkg_add in FreeBSD 4.2 through 4.4 creates a temporary directory with world-searchable permissions, which may allow local users to modify world-writable parts of the package during installation. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:01.pkg_add.asc http://www.securityfocus.com/bid/3819 https://exchange.xforce.ibmcloud.com/vulnerabilities/7852 •
CVSS: 1.2EPSS: 0%CPEs: 6EXPL: 0CVE-2002-1674
https://notcve.org/view.php?id=CVE-2002-1674
procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:09.fstatfs.asc http://www.securityfocus.com/bid/4040 https://exchange.xforce.ibmcloud.com/vulnerabilities/8112 •
CVSS: 5.5EPSS: 0%CPEs: 38EXPL: 0CVE-2002-1915
https://notcve.org/view.php?id=CVE-2002-1915
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file. • http://online.securityfocus.com/archive/1/283033 http://www.iss.net/security_center/static/9633.php http://www.securityfocus.com/bid/5265 • CWE-667: Improper Locking •