PT-2014-3697 · Novell+1 · Novell Client For Linux+2

Published 2014-05-08 · Updated 2020-02-24 · CVE-2014-0595

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2

Description The issue arises from improper management of a certain array by the /opt/novell/ncl/bin/nwrights in Novell Client for Linux. This allows local users to obtain the S permission under specific circumstances, by taking advantage of the granting of the F permission by an administrator.

Recommendations For Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2, consider restricting access to the /opt/novell/ncl/bin/nwrights until a proper fix is available. Additionally, administrators should be cautious when granting the F permission to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-0595

SUSE-SU-2014_0847-1

Affected Products

Novell Client For Linux

Novell Open Enterprise Server

Suse

References · 11

• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00030.html · Vendor Advisory
• http://novell.com/support/kb/doc.php?id=7014932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0595 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0595 · Security Note
• https://bugzilla.novell.com/show_bug.cgi?id=872796 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2014-June/000892.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://bugzilla.novell.com/872796 · Note
• http://securityfocus.com/bid/67144 · Note
• http://support.novell.com/security/cve/CVE-2014-0595.html · Note
• http://download.suse.com/patch/finder/?keywords=5bdf8cabc0ee4ea4ea2e5c84d2171189 · Note