Netware NDS Default Rights Vulnerability
BID:484
Info
Netware NDS Default Rights Vulnerability
| Bugtraq ID: | 484 |
| Class: | Configuration Error |
| CVE: |
CVE-1999-1020 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | Posted to bugtraq on September 18, 1998 by Simple Nomad <[email protected]> |
| Vulnerable: |
Novell Netware 4.11 SP5B Novell Netware 4.1 |
| Not Vulnerable: | |
Discussion
Netware NDS Default Rights Vulnerability
Non-authenticated clients have access to CX.EXE and NLIST.EXE in the SYS:LOGIN directory of a Netware 4.x server. The default root access is set to Read. Therefore, by using various switch options in CX.EXE and NLIST.EXE, anyone connecting to the server can gain access to NDS tree information such as account names, group names and membership, tree layout etc. By attaching to different servers and switching contexts an intruder could gain an understanding of the NDS structure for the entire network.
Non-authenticated clients have access to CX.EXE and NLIST.EXE in the SYS:LOGIN directory of a Netware 4.x server. The default root access is set to Read. Therefore, by using various switch options in CX.EXE and NLIST.EXE, anyone connecting to the server can gain access to NDS tree information such as account names, group names and membership, tree layout etc. By attaching to different servers and switching contexts an intruder could gain an understanding of the NDS structure for the entire network.
Exploit / POC
Netware NDS Default Rights Vulnerability
The following commands can be issued by a client connected to a NetWare 4.x or IntranetWare server, revealing most if not all user account names, in addition to most of if not the entire tree layout.
CX /T /A /R - list all readable user and container object names in tree, and can give a rather accurate layout of the containers and basic contents
NLIST USER /D - list info regarding user names in current context
NLIST GROUPS /D - list groups and group membership in current context
NLIST SERVER /D - list server names and OS versions, and if attached reveal if accounting is installed or not
NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc
The following commands can be issued by a client connected to a NetWare 4.x or IntranetWare server, revealing most if not all user account names, in addition to most of if not the entire tree layout.
CX /T /A /R - list all readable user and container object names in tree, and can give a rather accurate layout of the containers and basic contents
NLIST USER /D - list info regarding user names in current context
NLIST GROUPS /D - list groups and group membership in current context
NLIST SERVER /D - list server names and OS versions, and if attached reveal if accounting is installed or not
NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc
Solution / Fix
Netware NDS Default Rights Vulnerability
Solution:
Remove CX.EXE and NLIST.EXE or disable public Read access from the root of your NDS tree.
Ensure all accounts have passwords, and that all assigned passwords are not easily guessed. Ensure Intruder Detection is turned on at the root of your NDS tree.
Solution:
Remove CX.EXE and NLIST.EXE or disable public Read access from the root of your NDS tree.
Ensure all accounts have passwords, and that all assigned passwords are not easily guessed. Ensure Intruder Detection is turned on at the root of your NDS tree.
References
Netware NDS Default Rights Vulnerability
References:
References: