CVE-1999-1237

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/archive/1/14384Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/2272Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/14384Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/2272Third Party Advisory, VDB Entry

Timeline

Published: Jun 6, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 1999

CVE-1999-124110.0Internet Explorer, with a security setting below Medium, allows remote attackers to execute arbitrary commands via a malicious web page that CVE-1999-12447.2IPFilter 3.2.3 through 3.2.10 allows local users to modify arbitrary files via a symlink attack on the saved output file.CVE-1999-12455.0vacm ucd-snmp SNMP server, version 3.52, does not properly disable access to the public community string, which could allow remote attackers CVE-1999-12467.5Direct Mailer feature in Microsoft Site Server 3.0 saves user domain names and passwords in plaintext in the TMLBQueue network share, which CVE-1999-12477.2Vulnerability in HP Camera component of HP DCE/9000 in HP-UX 9.x allows attackers to gain root privileges.CVE-1999-12545.0Windows 95, 98, and NT 4.0 allow remote attackers to cause a denial of service by spoofing ICMP redirect messages from a router, which cause CVE-1999-12555.0Hyperseek allows remote attackers to modify the hyperseek configuration by directly calling the admin.cgi program with an edit_file action p CVE-1999-12564.6Oracle Database Assistant 1.0 in Oracle 8.0.3 Enterprise Edition stores the database master password in plaintext in the spoolmain.log file CVE-1999-12592.1Microsoft Office 98, Macintosh Edition, does not properly initialize the disk space used by Office 98 files and effectively inserts data fro CVE-1999-12607.5mSQL (Mini SQL) 2.0.6 allows remote attackers to obtain sensitive server information such as logged users, database names, and server versio CVE-1999-12632.6Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an e-mail message containing a uuencoded attachment that sp CVE-1999-12647.5WebRamp M3 router does not disable remote telnet or HTTP access to itself, even when access has been explicitly disabled.