Legato NetWorker token gain privileges
| legato-token-gain-privileges (21892) |  High Risk |
Description:
Legato NetWorker could allow a remote authenticated attacker to gain administrative privileges. By modifying the database access token, a remote authenticated attacker could execute arbitrary commands on the server with root privileges or possibly compromise other clients.
NOTE: Sun StorEdge Enterprise Backup Software versions 7.2, 7.1, 7.0, and Solstice Backup Software versions 6.0 and 6.1 are also affected by this vulnerability.
Platforms Affected:
- EMC, Legato NetWorker
- Novell, NetWare Client 4.83
- Sun, Solstice Backup 6.0
- Sun, Solstice Backup 6.1
- Sun, StorEdge Enterprise Backup Software 7.0
- Sun, StorEdge Enterprise Backup Software 7.1
- Sun, StorEdge Enterprise Backup Software 7.2
Remedy:
For Sun StorEdge Enterprise Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Solstice Backup Software:
Apply the appropriate hotfix as listed in the Sun Alert ID: 101886. See References.
For Legato NetWorker:
Apply the appropriate hotfix as listed in the Legato Technical Product Alert August 16, 2005. See References.
Consequences:
Gain Privileges
References:
- CIAC INFORMATION BULLETIN P-281, Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software at http://www.ciac.org/ciac/bulletins/p-281.shtml.
- Legato Technical Product Alert August 16, 2005, Token Authentication and Access to Legato NetWorker Server as Root at http://www.legato.com/support/websupport/product_alerts/081605_NW_token_authentication.htm.
- Sun Alert ID: 101886, Security Vulnerabilities in the Sun StorEdge Enterprise Backup Software at http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1.
- BID-14582: EMC Legato Networker Multiple Vulnerabilities
- CVE-2005-0358: EMC Legato NetWorker, Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 6.0 through 7.2 do not properly verify authentication tokens, which allows remote attackers to gain privileges by modifying an authentication token.
- SA16464: Legato NetWorker Multiple Vulnerabilities
- SA16470: Sun StorEdge Enterprise Backup Vulnerabilities
- SECTRACK ID: 1014713: Legato NetWorker AUTH_UNIX, Database, and Portmapper Authentication Can Be Bypassed By Remote Users
- US-CERT VU#407641: EMC Legato NetWorker database services use insufficient authentication
Reported:
Aug 16, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net