Title: NCPFS Multiple Remote Vulnerabilities
Severity: CRITICAL
Description:
The ncpfs software is a Linux utility designed to facilitate integration with Novell NetWare technologies; a Linux computer may mount NetWare volumes and print and spool NetWare print queues.
Multiple remote vulnerabilities affect ncpfs. The utility fails to manage access privileges securely and to validate the length of user-supplied strings before copying them into finite process buffers.
The first issue is a remote buffer-overflow vulnerability. Malicious network-based NetWare data sent to the ncplogin functionality may trigger the overflow. This issue may likely be exploited prior to authentication, but this is unconfirmed. This will likely facilitate unauthorized access and potentially privilege escalation.
The second issue is an access-validation vulnerability due to the setuid privileges of ncpfs utilities. Apparently, attackers may be able to access arbitrary files with escalated privileges by using symbolic links or by manipulating the HOME environment variable in some unspecified way. This issue occurs in the 'nwclient.c' file. It is currently unknown whether this issue will allow both reading and writing to affected files, but this is likely. This issue will facilitate privilege escalation.
An attacker may leverage these issues to execute arbitrary code with the privileges of the affected application and to access arbitrary files with the escalated privileges.
Affected Products:
- Conectiva Linux 10.0.0
- Conectiva Linux 8.0.0
- Conectiva Linux 9.0.0
- Conectiva Linux Enterprise Edition 1.0.0
- Debian Linux 3.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- Gentoo Linux
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Linux Mandrake 10.0.0
- MandrakeSoft Linux Mandrake 10.0.0 amd64
- MandrakeSoft Linux Mandrake 10.1.0
- MandrakeSoft Linux Mandrake 10.1.0 x86_64
- RedHat Advanced Workstation for the Itanium Processor 2.1.0
- RedHat Advanced Workstation for the Itanium Processor 2.1.0 IA64
- RedHat Enterprise Linux AS 2.1
- RedHat Enterprise Linux AS 2.1 IA64
- RedHat Enterprise Linux ES 2.1
- RedHat Enterprise Linux ES 2.1 IA64
- RedHat Fedora Core1
- RedHat Fedora Core2
- RedHat Fedora Core3
- RedHat Linux 7.3.0 i386
- RedHat Linux 9.0.0 i386
- S.u.S.E. Linux 8.0.0
- S.u.S.E. Linux 8.0.0 i386
- S.u.S.E. Linux 8.1.0
- S.u.S.E. Linux Connectivity Server
- S.u.S.E. Linux Database Server
- S.u.S.E. Linux Desktop 1.0.0
- S.u.S.E. Linux Enterprise Server 8
- S.u.S.E. Linux Enterprise Server 9
- S.u.S.E. Linux Personal 8.2.0
- S.u.S.E. Linux Personal 9.0.0
- S.u.S.E. Linux Personal 9.0.0 x86_64
- S.u.S.E. Linux Personal 9.1.0
- S.u.S.E. Linux Personal 9.2.0
- ncpfs ncpfs 2.2.0
- ncpfs ncpfs 2.2.1
- ncpfs ncpfs 2.2.2
- ncpfs ncpfs 2.2.3
- ncpfs ncpfs 2.2.4
- ncpfs ncpfs 2.2.5
References:
- Debian: DSA-665-1 ncpfs -- missing privilege release
- Mandrake: MDKSA-2005:028 - ncpfs
- RedHat: RHSA-2005:371-06 : ncpfs security update
- ncpfs: ncpfs Project Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
