Sign-up

ID

VAR-200102-0114


CVE

CVE-2001-1439


TITLE

Hewlett Packard HP-UX text editors contain buffer overflow

Trust: 0.8

sources: CERT/CC: VU#268848

DESCRIPTION

Buffer overflow in the text editor functionality in HP-UX 10.01 through 11.04 on HP9000 Series 700 and Series 800 allows local users to cause a denial of service ("system availability") via text editors such as (1) e, (2) ex, (3) vi, (4) edit, (5) view, and (6) vedit. A buffer overflow in the text editor on certain Hewlett-Packard systems could compromise system availability. Multiple Cisco networking products contain a denial-of-service vulnerability. There is an information integrity vulnerability in the SSH1 protocol that allows packets encrypted with a block cipher to be modified without notice. There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root. The program pgp4pine version 1.75.6 fails to properly identify expired keys when working with the Gnu Privacy Guard program (GnuPG). This failure may result in the clear-text transmission of senstive information when used with the PINE mail reading package. The SEDUM web server permits intruders to access files outside the web root. While addressing vulnerabilities described in http://www.cisco.com/warp/public/707/SSH-multiple-pub.html, a denial of service condition has been inadvertently introduced into firmware upgrades. Firmware for routers and switches (IOS), Catalyst 6000 switches running CatOS, Cisco PIX Firewall and Cisco 11000 Content Service Switch devices may be vulnerable. Cisco has reported that scanning for SSH vulnerabilities on affected devices will cause excessive CPU consumption. The condition is due to a failure of the Cisco SSH implementation to properly process large SSH packets. Repeated and concurrent attacks may result in a denial of device service. As many of these devices are critical infrastructure components, more serious network outages may occur. Cisco has released upgrades that will eliminate this vulnerability. HP-UX is prone to a denial-of-service vulnerability

Trust: 7.2

sources: NVD: CVE-2001-1439 // CERT/CC: VU#268848 // CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#651994 // CERT/CC: VU#315308 // BID: 5114 // BID: 88702

AFFECTED PRODUCTS

vendor:ssh securitymodel: - scope: - version: -

Trust: 3.2

vendor:ciscomodel:catalyst csxscope:eqversion:60005.3

Trust: 2.4

vendor:hpmodel:hp-uxscope:eqversion:10.24

Trust: 1.9

vendor:hpmodel:hp-uxscope:eqversion:10.20

Trust: 1.9

vendor:hpmodel:hp-uxscope:eqversion:10.10

Trust: 1.9

vendor:ciscomodel: - scope: - version: -

Trust: 1.6

vendor:opensshmodel: - scope: - version: -

Trust: 1.6

vendor:hpmodel:hp-uxscope:eqversion:11.00

Trust: 1.6

vendor:hpmodel:hp-uxscope:eqversion:10.01

Trust: 1.6

vendor:hpmodel:hp-uxscope:eqversion:11.04

Trust: 1.6

vendor:ciscomodel:ios 12.1 exscope: - version: -

Trust: 1.2

vendor:ciscomodel:catalystscope:eqversion:60006.1

Trust: 0.9

vendor:ciscomodel:catalystscope:eqversion:60005.5

Trust: 0.9

vendor:hewlett packardmodel: - scope: - version: -

Trust: 0.8

vendor:core sdimodel: - scope: - version: -

Trust: 0.8

vendor:debianmodel: - scope: - version: -

Trust: 0.8

vendor:freebsdmodel: - scope: - version: -

Trust: 0.8

vendor:smoothwallmodel: - scope: - version: -

Trust: 0.8

vendor:susemodel: - scope: - version: -

Trust: 0.8

vendor:holger lammmodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel:pix firewallscope:eqversion:6.2

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.1

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.0

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:5.3

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:5.2

Trust: 0.3

vendor:ciscomodel:ios 12.2yhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ygscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2yfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ydscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ycscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ybscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2yascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xwscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xtscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xsscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xrscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xqscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xnscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xlscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xkscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xjscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xgscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xescope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xdscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2tscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2sscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ddscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2dascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2bcscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2bscope: - version: -

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:12.2

Trust: 0.3

vendor:ciscomodel:ios 12.1yiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1yfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1yescope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ydscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ycscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ybscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xuscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xtscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xqscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xpscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xlscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xjscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xgscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xcscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1tscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ecscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1escope: - version: -

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:12.0xv

Trust: 0.3

vendor:ciscomodel:ios 12.0xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0stscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0spscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0sscope: - version: -

Trust: 0.3

vendor:ciscomodel:css11000 content services switchscope: - version: -

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60007.1(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60007.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.3(4)

Trust: 0.3

vendor:ciscomodel:catalyst panscope:eqversion:60006.3

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.2(0.111)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.2(0.110)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.1(2.13)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.1(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(4)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(3)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(13)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(4)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(3)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4

Trust: 0.3

vendor:hpmodel:hp-uxscope:eqversion:11.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.04scope: - version: -

Trust: 0.3

sources: CERT/CC: VU#268848 // CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#315308 // BID: 5114 // BID: 88702 // CNNVD: CNNVD-200102-083 // NVD: CVE-2001-1439

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2001-1439
value: LOW

Trust: 1.0

CARNEGIE MELLON: VU#268848
value: 5.61

Trust: 0.8

CARNEGIE MELLON: VU#290140
value: 21.09

Trust: 0.8

CARNEGIE MELLON: VU#13877
value: 6.84

Trust: 0.8

CARNEGIE MELLON: VU#25309
value: 0.39

Trust: 0.8

CARNEGIE MELLON: VU#945216
value: 99.00

Trust: 0.8

CARNEGIE MELLON: VU#566640
value: 0.68

Trust: 0.8

CARNEGIE MELLON: VU#651994
value: 1.50

Trust: 0.8

CARNEGIE MELLON: VU#315308
value: 2.06

Trust: 0.8

CNNVD: CNNVD-200102-083
value: LOW

Trust: 0.6

NVD: CVE-2001-1439
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

sources: CERT/CC: VU#268848 // CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#651994 // CERT/CC: VU#315308 // CNNVD: CNNVD-200102-083 // NVD: CVE-2001-1439

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-1439

THREAT TYPE

local

Trust: 0.9

sources: BID: 88702 // CNNVD: CNNVD-200102-083

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200102-083

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2001-1439

EXTERNAL IDS
db:CERT/CCid:VU#13877
Trust: 3.2
db:CERT/CCid:VU#268848
Trust: 2.7
db:CERT/CCid:VU#945216
Trust: 2.4
db:CERT/CCid:VU#25309
Trust: 2.4
db:AUSCERTid:ESB-2001.066
Trust: 1.9
db:NVDid:CVE-2001-1439
Trust: 1.9
db:BIDid:5114
Trust: 1.1
db:XFid:6111
Trust: 0.9
db:CERT/CCid:VU#290140
Trust: 0.8
db:XFid:6449
Trust: 0.8
db:BIDid:2347
Trust: 0.8
db:XFid:6083
Trust: 0.8
db:XFid:6135
Trust: 0.8
db:BIDid:2405
Trust: 0.8
db:CERT/CCid:VU#566640
Trust: 0.8
db:BIDid:2335
Trust: 0.8
db:XFid:6063
Trust: 0.8
db:CERT/CCid:VU#651994
Trust: 0.8
db:XFid:6472
Trust: 0.8
db:CERT/CCid:VU#315308
Trust: 0.8
db:HPid:HPSBUX0011-132
Trust: 0.6
db:CNNVDid:CNNVD-200102-083
Trust: 0.6
db:BIDid:88702
Trust: 0.3
sources:
            
            
            CERT/CC: VU#268848 // 
            
            
            
            CERT/CC: VU#290140 // 
            
            
            
            CERT/CC: VU#13877 // 
            
            
            
            CERT/CC: VU#25309 // 
            
            
            
            CERT/CC: VU#945216 // 
            
            
            
            CERT/CC: VU#566640 // 
            
            
            
            CERT/CC: VU#651994 // 
            
            
            
            CERT/CC: VU#315308 // 
            
            
            
            BID: 5114 // 
            
            
            
            BID: 88702 // 
            
            
            
            CNNVD: CNNVD-200102-083 // 
            
            
            
            NVD: CVE-2001-1439

REFERENCES
url:http://www.kb.cert.org/vuls/id/13877
Trust: 2.4
url:http://www.ssh.com/products/ssh/cert/
Trust: 2.4
url:http://www.auscert.org.au/render.html?it=1176
Trust: 1.9
url:http://www.securityfocus.com/archive/1/163910
Trust: 1.9
url:http://www.kb.cert.org/vuls/id/268848
Trust: 1.9
url:http://www.cert.org/advisories/ca-2001-35.html
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/945216
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/25309
Trust: 1.6
url:http://www.cisco.com/warp/public/707/ssh-scanning.shtml
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/6111
Trust: 1.0
url:http://xforce.iss.net/xforce/xfdb/6111
Trust: 0.9
url:about vulnerability notes
Trust: 0.8
url:contact us about this vulnerability
Trust: 0.8
url:provide a vendor statement
Trust: 0.8
url:http://www.securityfocus.com/bid/5114
Trust: 0.8
url:http://www.cisco.com/warp/public/707/ssh-multiple-pub.html
Trust: 0.8
url:http://www.corest.com/files/files/11/crc32.pdf
Trust: 0.8
url:http://www1.corest.com/common/showdoc.php?idx=131&idxseccion=10
Trust: 0.8
url:http://xforce.iss.net/static/6449.php
Trust: 0.8
url:http://razor.bindview.com/publish/advisories/adv_ssh1crc.html
Trust: 0.8
url:http://www1.corest.com/common/showdoc.php?idx=81&idxsection=10#
Trust: 0.8
url:http://www.openssh.com/security.html
Trust: 0.8
url:http://www.securityfocus.com/bid/2347
Trust: 0.8
url:http://www.ssh.com/products/ssh/advisories/ssh1_crc-32.cfm
Trust: 0.8
url:http://xforce.iss.net/static/6083.php
Trust: 0.8
url:http://xforce.iss.net/alerts/advise100.php
Trust: 0.8
url:http://www.cryptnet.net/fcp/audit/pgp4pine/01.html
Trust: 0.8
url:http://www.securityfocus.com/bid/2405
Trust: 0.8
url:http://xforce.iss.net/static/6135.php
Trust: 0.8
url:http://devrandom.net/lists/archives/2001/2/bugtraq/0383.html
Trust: 0.8
url:http://security-archive.merton.ox.ac.uk/bugtraq-200102/0389.html
Trust: 0.8
url:http://pgp4pine.flatline.de/
Trust: 0.8
url:http://www.securityfocus.com/bid/2335
Trust: 0.8
url:http://xforce.iss.net/static/6063.php
Trust: 0.8
url:http://www.securityfocus.com/archive/1/160452
Trust: 0.8
url:http://xforce.iss.net/static/6472.php
Trust: 0.8
sources:
            
            
            CERT/CC: VU#268848 // 
            
            
            
            CERT/CC: VU#290140 // 
            
            
            
            CERT/CC: VU#13877 // 
            
            
            
            CERT/CC: VU#25309 // 
            
            
            
            CERT/CC: VU#945216 // 
            
            
            
            CERT/CC: VU#566640 // 
            
            
            
            CERT/CC: VU#651994 // 
            
            
            
            CERT/CC: VU#315308 // 
            
            
            
            BID: 5114 // 
            
            
            
            BID: 88702 // 
            
            
            
            CNNVD: CNNVD-200102-083 // 
            
            
            
            NVD: CVE-2001-1439

CREDITS
Credited to Cisco Systems.
Trust: 0.3
sources:
            
            
            BID: 5114

SOURCES
db:CERT/CCid:VU#268848
db:CERT/CCid:VU#290140
db:CERT/CCid:VU#13877
db:CERT/CCid:VU#25309
db:CERT/CCid:VU#945216
db:CERT/CCid:VU#566640
db:CERT/CCid:VU#651994
db:CERT/CCid:VU#315308
db:BIDid:5114
db:BIDid:88702
db:CNNVDid:CNNVD-200102-083
db:NVDid:CVE-2001-1439

LAST UPDATE DATE
2022-05-06T22:18:22.186000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#268848date:2001-08-10T00:00:00
db:CERT/CCid:VU#290140date:2002-12-12T00:00:00
db:CERT/CCid:VU#13877date:2003-05-20T00:00:00
db:CERT/CCid:VU#25309date:2002-03-05T00:00:00
db:CERT/CCid:VU#945216date:2003-05-20T00:00:00
db:CERT/CCid:VU#566640date:2002-01-15T00:00:00
db:CERT/CCid:VU#651994date:2001-06-26T00:00:00
db:CERT/CCid:VU#315308date:2002-03-05T00:00:00
db:BIDid:5114date:2002-06-27T00:00:00
db:BIDid:88702date:2001-02-16T00:00:00
db:CNNVDid:CNNVD-200102-083date:2005-10-20T00:00:00
db:NVDid:CVE-2001-1439date:2017-07-11T01:29:00

SOURCES RELEASE DATE
db:CERT/CCid:VU#268848date:2001-05-04T00:00:00
db:CERT/CCid:VU#290140date:2002-06-27T00:00:00
db:CERT/CCid:VU#13877date:2001-11-07T00:00:00
db:CERT/CCid:VU#25309date:2000-09-26T00:00:00
db:CERT/CCid:VU#945216date:2001-10-24T00:00:00
db:CERT/CCid:VU#566640date:2001-07-12T00:00:00
db:CERT/CCid:VU#651994date:2001-05-16T00:00:00
db:CERT/CCid:VU#315308date:2001-01-18T00:00:00
db:BIDid:5114date:2002-06-27T00:00:00
db:BIDid:88702date:2001-02-16T00:00:00
db:CNNVDid:CNNVD-200102-083date:2001-02-16T00:00:00
db:NVDid:CVE-2001-1439date:2001-02-16T05:00:00