Danware NetOp Remote Control Unauthenticated File Transfer Vulnerability

Bugtraq ID:	1263
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	May 23 2000 12:00AM
Updated:	May 23 2000 12:00AM
Credit:	Discovered by axess <[email protected]> and publicized in a buffer0verfl0w security advisory (b0f-SA2000-002) on April 12, 2000.
Vulnerable:	Danware Data NetOp 6.50 - Microsoft Windows 3.11 - Microsoft Windows 3.11 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Danware Data NetOp 6.0 - Microsoft Windows 3.11 - Microsoft Windows 3.11 - Microsoft Windows 3.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Danware NetOp Remote Control Unauthenticated File Transfer Vulnerability

NetOp is a remote control utility, offering console access via network or serial connections. On NT and Windows 2000 machines, the software runs in the SYSTEM context by default.

The software includes the ability to perform direct file transfers to and from the host machine. By default, no authentication is required to perform this activity, meaning that any user with the freely-downloadable client and network access to the target can perform read/write/create operations to any file on the system, including password and configuration data.

Danware NetOp Remote Control Unauthenticated File Transfer Vulnerability

see discussion

Danware NetOp Remote Control Unauthenticated File Transfer Vulnerability

Solution:
NetOp version 6.50 has the ability to use either NetOp or Windows security to authenticate users immediately upon connection, although this is not enabled by default.

Danware NetOp Remote Control Unauthenticated File Transfer Vulnerability

References:

• Danware Data Homepage (Danware Data)
  
• Security Statement (NetOp Product Support)