<?xml version="1.0" encoding="utf-8"?>
<nvd xmlns="http://nvd.nist.gov/feeds/cve/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://...nvdcve.xsd" nvd_xml_version="1.2" pub_date="2007-09-13">
  <entry type="CVE" name="CVE-2003-0001" seq="2003-0001" published="2003-01-17" modified="2005-10-20" severity="Medium" CVSS_score="5.0" CVSS_vector="(AV:N/AC:L/Au:N/C:P/I:N/A:N)" CVSS_version="2.0 incomplete approximation" CVSS_base_score="5.0" CVSS_impact_subscore="2.9" CVSS_exploit_subscore="10.0">
    <desc>
      <descript source="cve">Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.</descript>
    </desc>
    <loss_types>
      <conf />
    </loss_types>
    <vuln_types>
      <design />
    </vuln_types>
    <range>
      <network />
    </range>
    <refs>
      <ref source="AtStake.com" url="http://www.atstake.com/research/advisories/2003/a010603-1.txt" adv="1">Ethernet frame padding information leakage</ref>
      <ref source="CERT" url="http://www.kb.cert.org/vuls/id/412115" adv="1">Network device drivers reuse old frame buffer data to pad packets</ref>
      <ref source="Security Focus" url="http://online.securityfocus.com/bid/6535" adv="1">bid  6535 </ref>
      <ref source="Bugtraq" url="http://marc.theaimsgroup.com/?l=bugtraq&m=104222046632243&w=2" adv="1"> More information regarding Etherleak</ref>
      <ref source="VULNWATCH" url="http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0016.html"> 20030110  More information regarding Etherleak</ref>
      <ref source="MISC" url="http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf">http://www.atstake.com/research/advisories/ 2003 /atstake_etherleak_report.pdf</ref>
      <ref source="REDHAT" url="http://www.redhat.com/support/errata/RHSA-2003-025.html">RHSA- 2003 : 025 </ref>
      <ref source="OVAL" url="http://oval.mitre.org/oval/definitions/data/oval2665.html" sig="1">OVAL2665</ref>
      <ref source="REDHAT" url="http://www.redhat.com/support/errata/RHSA-2003-088.html">RHSA- 2003 : 088 </ref>
      <ref source="OSVDB" url="http://www.osvdb.org/9962"> 9962 </ref>
      <ref source="OVAL" url="http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2665" sig="1">oval:org.mitre.oval:def: 2665 </ref>
    </refs>
    <vuln_soft>
      <prod name="NetBSD" vendor="NetBSD">
        <vers num="1.5" />
        <vers num="1.5.1" />
        <vers num="1.5.2" />
        <vers num="1.5.3" />
        <vers num="1.6" />
      </prod>
      <prod name="Windows 2000" vendor="Microsoft">
        <vers num="Advanced Server SP2" />
        <vers num="Advanced Server SP1" />
        <vers num="Advanced Server" />
        <vers num="Datacenter Server SP2" />
        <vers num="Datacenter Server SP1" />
        <vers num="Datacenter Server" />
        <vers num="Professional SP2" />
        <vers num="Professional SP1" />
        <vers num="Professional" />
        <vers num="Server SP2" />
        <vers num="Server SP1" />
        <vers num="Server" />
        <vers num="Terminal Services SP2" />
        <vers num="Terminal Services SP1" />
        <vers num="Terminal Services" />
      </prod>
      <prod name="FreeBSD" vendor="FreeBSD">
        <vers num="4.2" />
        <vers num="4.3" />
        <vers num="4.4" />
        <vers num="4.5" />
        <vers num="4.6" />
        <vers num="4.7" />
      </prod>
      <prod name="Kernel" vendor="Linux">
        <vers num="2.4.1" />
        <vers num="2.4.2" />
        <vers num="2.4.3" />
        <vers num="2.4.4" />
        <vers num="2.4.5" />
        <vers num="2.4.6" />
        <vers num="2.4.7" />
        <vers num="2.4.8" />
        <vers num="2.4.9" />
        <vers num="2.4.10" />
        <vers num="2.4.11" />
        <vers num="2.4.12" />
        <vers num="2.4.13" />
        <vers num="2.4.14" />
        <vers num="2.4.15" />
        <vers num="2.4.16" />
        <vers num="2.4.17" />
        <vers num="2.4.18" />
        <vers num="2.4.19" />
        <vers num="2.4.20" />
      </prod>
    </vuln_soft>
  </entry>
  <entry type="CVE" name="CVE-2003-0002" seq="2003-0002" published="2003-02-07" modified="2005-05-13" severity="Medium" CVSS_score="6.8" CVSS_vector="(AV:N/AC:M/Au:N/C:P/I:P/A:P)" CVSS_version="2.0 incomplete approximation" CVSS_base_score="6.8" CVSS_impact_subscore="6.4" CVSS_exploit_subscore="8.6">
    <desc>
      <descript source="cve">Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS)  2001  allows remote attackers to execute arbitrary script via the REASONTXT parameter.</descript>
    </desc>
    <loss_types>
      <avail />
      <conf />
      <int />
      <sec_prot other="1" />
    </loss_types>
    <vuln_types>
      <input />
    </vuln_types>
    <range>
      <network />
    </range>
    <refs>
      <ref source="The Aims Group" url="http://marc.theaimsgroup.com/?l=bugtraq&m=103417794800719&w=2" adv="1">CSS on Microsoft Content Management Server</ref>
      <ref source="Microsoft" url="http://www.microsoft.com/technet/security/bulletin/ms03-002.asp" adv="1" patch="1">Cumulative Patch for Microsoft Content Management Server ( 810487 )</ref>
      <ref source="Security Focus" url="http://online.securityfocus.com/bid/5922" adv="1">bid  5922 </ref>
      <ref source="ISS X-Force" url="http://www.iss.net/security_center/static/10318.php" adv="1" patch="1">mcms-manuallogin-reasontxt-xss ( 10318 )</ref>
      <ref source="BID" url="http://www.securityfocus.com/bid/5922"> 5922 </ref>
    </refs>
    <vuln_soft>
      <prod name="Content Management Server" vendor="Microsoft">
        <vers num="2001 SP1" />
        <vers num="2001" />
      </prod>
    </vuln_soft>
  </entry>