EMC Legato Networker Multiple Remote Vulnerabilities

Bugtraq ID:	16275
Class:	Boundary Condition Error
CVE:	CVE-2005-3659 CVE-2005-3658
Remote:	Yes
Local:	No
Published:	Jan 17 2006 12:00AM
Updated:	Jan 29 2007 07:39PM
Credit:	Jo Goossens is credited with the discovery of these issues.
Vulnerable:	Sun StorEdge Enterprise Backup Software 7.2 L Sun StorEdge Enterprise Backup Software 7.2 _x86 Sun StorEdge Enterprise Backup Software 7.2 Sun StorEdge Enterprise Backup Software 7.1 L Sun StorEdge Enterprise Backup Software 7.1 _x86 Sun StorEdge Enterprise Backup Software 7.1 Sun StorEdge Enterprise Backup Software 7.0 _x86 Sun StorEdge Enterprise Backup Software 7.0 Sun Solstice Backup Software 6.1 _x86 Sun Solstice Backup Software 6.1 Sun Solstice Backup Software 6.0 _x86 Sun Solstice Backup Software 6.0 EMC Legato Networker 7.2.1 EMC Legato Networker 7.2 build 172 EMC Legato Networker 7.2 EMC Legato Networker 7.1.3 EMC Legato Networker 6.0 x
Not Vulnerable:	Sun StorEdge Enterprise Backup Software 7.3_x86 Sun StorEdge Enterprise Backup Software 7.3

EMC Legato Networker Multiple Remote Vulnerabilities

EMC Legato Networker is affected by multiple remote vulnerabilities. A denial-of-service issue and two remote code-execution issues have been identified.

Version 7.2.1 of Legato Networker is vulnerable to these issues; prior versions may also be affected.

EMC Legato Networker Multiple Remote Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EMC Legato Networker Multiple Remote Vulnerabilities

Solution:
Please see the referenced advisories for more information.


Sun StorEdge Enterprise Backup Software 7.1

• Sun 119670-01
  SPARC Platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119670-01-1


• Sun 119671-01
  x86 Platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119671-01-1

Sun StorEdge Enterprise Backup Software 7.1 L

• Sun 120649-01
  SPARC Platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120649-01-1

EMC Legato Networker 7.1.3

• EMC networker_security_hotfix.htm
  http://www.legato.com/support/websupport/patches_updates/networker_sec urity_hotfix.htm

EMC Legato Networker 7.2

• EMC networker_security_hotfix.htm
  http://www.legato.com/support/websupport/patches_updates/networker_sec urity_hotfix.htm

Sun StorEdge Enterprise Backup Software 7.2 L

• Sun 116834-01
  SPARC Platform
  http://sunsolve.sun.com/

Sun StorEdge Enterprise Backup Software 7.2

• Sun 116831-01
  SPARC Platform
  http://sunsolve.sun.com/


• Sun 116832-01
  SPARC Platform
  http://sunsolve.sun.com/


• Sun 116833-01
  x86 Platform
  http://sunsolve.sun.com/

EMC Legato Networker Multiple Remote Vulnerabilities

References:

• EMC Legato Networker Homepage (EMC)
  
• EMC Legato Networker nsrd.exe DoS Vulnerability (iDefense)
  
• EMC Legato Networker nsrd.exe Heap Overflow Vulnerability (iDefense)
  
• EMC Legato Networker nsrexecd.exe Heap Overflow Vulnerability (iDefense)
  
• EMC Legato Networker Product Alert (EMC)
  
• EMC Legato Networker Product Alert - January 16, 2006 (EMC)
  
• README for NetWorker 7.2.1.Build.314 iDefense RELEASE - January 2006 (EMC)
  
• Sun Alert ID: 101886 (Sun)
  
• Sun Alert ID: 102148 (Sun)
  
• VU#407641 - EMC Legato NetWorker database services use insufficient authenticati (US-CERT)
  
• VU#606857 - EMC Legato NetWorker uses weak AUTH_UNIX authentication (US-CERT)
  
• VU#801089 - EMC Legato NetWorker portmapper allows remote calls to "pmap_set" an (US-CERT)