PT-2002-2494 · Novell · Novell Netware+2

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1772

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novell Netware versions 5.0 through 5.1

Description The issue allows local users to gain Domain Admin rights by logging into a Novell Directory Services (NDS) account and executing a specific command on an NDS ADM account. This account must have domain access rights but not be part of the NT domain, enabling the user to enter a null password.

Recommendations For Novell Netware versions 5.0 through 5.1, consider restricting access to NDS ADM accounts that have domain access rights but are not in the NT domain to minimize the risk of exploitation. As a temporary workaround, limit the use of the net use command on such accounts until a more permanent solution is available.

Fix

Related Identifiers

CVE-2002-1772

Affected Products

Nds Adm

Novell Directory Services

Novell Netware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1772 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8065 · Note
• http://securityfocus.com/bid/4012 · Note
• http://online.securityfocus.com/archive/1/253373 · Note