Legato NetWorker AUTH_UNIX bypass authentication
| legato-authunix-bypass-authentication (21887) |  High Risk |
Description:
Legato NetWorker could allow a remote attacker to bypass authentication. A remote attacker could spoof the username to bypass nwadmin, nsradmin, and nsrports authentication. A remote attacker could exploit this vulnerability to gain access.
NOTE: Sun StorEdge Enterprise Backup Software and Solstice Backup Software are also affected by this vulnerability.
Platforms Affected:
- EMC, Legato NetWorker
- Sun, Solstice Backup 6.0
- Sun, Solstice Backup 6.1
- Sun, StorEdge Enterprise Backup Software 7.0
- Sun, StorEdge Enterprise Backup Software 7.1
- Sun, StorEdge Enterprise Backup Software 7.2
Remedy:
For Sun StorEdge Enterprise Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Solstice Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Legato NetWorker:
Apply the appropriate hotfix as listed in the Legato Technical Product Alert August 16, 2005. See References.
Consequences:
Gain Access
References:
- CIAC INFIORMATION BULLETIN P-281, Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software at http://www.ciac.org/ciac/bulletins/p-281.shtml.
- Legato Technical Product Alert August 16, 2005, Authentication and nwadmin, nsradmin, nsrports at http://www.legato.com/support/websupport/product_alerts/081605_NW_authentication.htm.
- Sun Alert ID: 101886, Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software at http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1.
- BID-14582: EMC Legato Networker Multiple Vulnerabilities
- CVE-2005-0357: EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 rely on AUTH_UNIX authentication, which relies on user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.
- OSVDB ID: 18800: Legato NetWorker AUTH_UNIX Authentication Bypass
- SA16464: Legato NetWorker Multiple Vulnerabilities
- SA16470: Sun StorEdge Enterprise Backup Vulnerabilities
- SECTRACK ID: 1014713: Legato NetWorker AUTH_UNIX, Database, and Portmapper Authentication Can Be Bypassed By Remote Users
- US-CERT VU#606857: EMC Legato NetWorker uses weak AUTH_UNIX authentication
Reported:
Aug 16, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net