PT-2002-2494 · Novell · Novell Netware+2

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1772

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novell Netware versions 5.0 through 5.1

Description The issue allows local users to gain Domain Admin rights by logging into a Novell Directory Services (NDS) account and executing a specific command on an NDS ADM account. This account must have domain access rights but not be part of the NT domain, enabling the user to enter a null password.

Recommendations For Novell Netware versions 5.0 through 5.1, consider restricting access to NDS ADM accounts that have domain access rights but are not in the NT domain to minimize the risk of exploitation. As a temporary workaround, limit the use of the net use command on such accounts until a more permanent solution is available.

Correção

Identificadores relacionados

CVE-2002-1772

Produtos afetados

Nds Adm

Novell Directory Services

Novell Netware

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/8065 · Nota
• http://securityfocus.com/bid/4012 · Nota
• http://online.securityfocus.com/archive/1/253373 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1772 · Nota de Segurança