CVE-2005-1238

CVE-2005-1238 affects the built-in FTP server for IBM iSeries AS/400 systems. The root cause is failure to enforce a restricted document root, enabling an attacker to read or write arbitrary files, including sensitive QSYS databases, by sending a full pathname in a GET or PUT request. Impact per ...

CVE-2005-1242

Directory traversal vulnerability in the third party tool from Bsafe, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1240

Directory traversal vulnerability in the third party tool from Castlehill, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1241

Directory traversal vulnerability in the third party tool from Powertech, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1243

CVE-2005-1243 describes a directory traversal vulnerability in a third‑party SafeStone tool used to secure the iSeries AS/400 FTP server. The issue allows remote attackers to access arbitrary files (including those under qsys.lib) via ".." sequences in a GET request, due to a canonicalization/pat...

CVE-2005-1239

Directory traversal vulnerability in the third party tool from Raz-Lee, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1242

The CVE-2005-1242 entry describes a directory traversal vulnerability in the third‑party Bsafe tool used to secure the iSeries AS/400 FTP server. The flaw allows remote attackers to access arbitrary files, including those in qsys.lib, by using ".." sequences in a GET request. Affected software is...

CVE-2005-1243

Directory traversal vulnerability in the third party tool from SafeStone, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1244

Directory traversal vulnerability in the third party tool from NetIQ, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request. NOTE: the vendor has disputed this issue, saying that...

CVE-2005-1240

Directory traversal vulnerability in the third party tool from Castlehill, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

CVE-2005-1241

Directory traversal vulnerability in the third party tool from Powertech, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request...

PT-2005-2257 · Netiq +1 · Netiq Security Manager +2

Name of the Vulnerable Software and Affected Versions: NetIQ Security Manager affected versions not specified iSeries Security Solutions affected versions not specified Description: A directory traversal issue in a third-party tool used to secure the iSeries AS/400 FTP server may allow remote...

CVE-2005-1133

The CVE-2005-1133 entry corresponds to the IBM iSeries AS/400 POP3 server that reveals whether a username exists by returning different error messages. This enables remote user enumeration (valid user IDs). Related Nessus data notes additional disclosure risk and lack of login throttling/brute-fo...

CVE-2005-1133

The POP3 server in IBM iSeries AS/400 returns different error messages when the user exists or not, which allows remote attackers to determine valid user IDs on the server...

IBM AS400 and iSeries POP3 Server Remote Information Disclosure

The remote host appears to be running the POP3 service that comes with all modern AS/400 and iSeries servers. Further, this service is prone to an information disclosure vulnerability due to the responses it provides to username / password combinations. This allows a remote attacker to determine...

IBM iSeries AS400 LDAP Server - Remote Information Disclosure

source: https://www.securityfocus.com/bid/12991/info A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. This issue is due to a failure of the application to properly secure sensitive information. An authenticated attacker may leverage this issue to disclose user names an...

IBM iSeries AS400 LDAP Server - Remote Information Disclosure

IBM iSeries AS400 LDAP Server - Remote Information Disclosure source: https://www.securityfocus.com/bid/12991/info A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. This issue is due to a failure of the application to properly secure sensitive information. An...

Important: Red Hat Security Advisory: : : : Updated ypserv packages fix various vulnerabilities

Updated ypserv packages which fix a denial of service DoS vulnerability and a memory leak are now available for Red Hat Linux on IBM iSeries and pSeries systems. The ypserv package contains the Network Information Service NIS server. For ypserv versions before 2.5 it was discovered that a memory...

Important: Red Hat Security Advisory: : : : Updated 2.4 kernel for pSeries and iSeries fixes vulnerabilities

Updated kernel packages, based on the 2.4.18 kernel, are now available for Red Hat Linux 7.1 for iSeries and pSeries systems. Please see the NOTE at the end of the description for important information about booting the new kernel on your system. The Linux kernel handles the basic functions of th...

Important: Red Hat Security Advisory: : : : Updated OpenSSL packages fix vulnerabilities

Updated OpenSSL packages that fix potential timing-based and modified Bleichenbacher attacks are available for Red Hat Linux on IBM iSeries and pSeries systems. OpenSSL is a commercial-grade, full-featured, and open source toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer...