Novell NDS installation can reveal account names
| novell-nds (1364) |  Low Risk |
Description:
Default settings during NDS installation reveal account names and other information to users who have not logged in. Learning potential account names is usually the first step before an attacker attacks a computer system.
Platforms Affected:
- Novell, NetWare 4.0
- Novell, NetWare 4.01
- Novell, NetWare 4.11
Remedy:
Disable public Read access from the root of your NDS tree. Ensure all accounts have passwords, and that all assigned passwords are not easily guessed. Ensure Intruder Detection is turned on at the root of your NDS tree.
Consequences:
Obtain Information
References:
- BugTraq Mailing List, 18 Sep 1998 04:18:39, NMRC Advisory - Default NDS Rights at http://archives.neohapsis.com/archives/bugtraq/1998_3/0842.html.
- Nomad Mobile Research Centre Advisory, Default NDS Rights at http://www.nmrc.org/pub/advise/19980916.txt.
- BID-484: Netware NDS Default Rights Vulnerability
- CVE-1999-1020: The installation of Novell Netware NDS 5.99 provides an unauthenticated client with Read access for the tree, which allows remote attackers to access sensitive information such as users, groups, and readable objects via CX.EXE and NLIST.EXE.
Reported:
Sep 16, 1998
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net