PT-2005-1433 · Sun+1 · Sun Solstice Backup+2

Publicado 2005-08-20 · Atualizado 2017-07-11 · CVE-2005-0357

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Legato NetWorker (affected versions not specified) Sun Solstice Backup versions 6.0 through 6.1 StorEdge Enterprise Backup versions 7.0 through 7.2

Description The issue allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID, as the affected software relies on AUTH UNIX authentication, which uses user ID for authentication.

Recommendations For Sun Solstice Backup versions 6.0 through 6.1, consider disabling the use of AUTH UNIX authentication until a fix is available. For StorEdge Enterprise Backup versions 7.0 through 7.2, restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability in EMC Legato NetWorker.

Correção

Identificadores relacionados

CVE-2005-0357

Produtos afetados

Emc Legato Networker

Storedge Enterprise Backup

Sun Solstice Backup

Referências · 10

• http://legato.com/support/websupport/product_alerts/081605_NW_authentication.htm · Correção
• http://secunia.com/advisories/16464 · Aviso do Fabricante
• http://securityfocus.com/bid/14582 · Correção
• http://secunia.com/advisories/16470 · Aviso do Fabricante
• http://securitytracker.com/id?1014713 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21887 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0357 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1 · Aviso do Fabricante
• http://osvdb.org/18800 · Nota
• http://kb.cert.org/vuls/id/606857 · Correção