__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Novell NetWare 6.0 RConsoleJ Authentication Bypass Vulnerability [Novell Technical Information Document - 2963349] August 22, 2002 18:00 GMT Number M-115 ______________________________________________________________________________ PROBLEM: Novell NetWare RCONAG6 allows users to remotely administer a Novell server. An unauthenticated user may be allowed to remotely access a host server through RConsoleJ when used with SSL. PLATFORM: NetWare 6.0 SP2 DAMAGE: A remote attacker could gain local access to the vulnerable system without the need for a password. SOLUTION: Apply NetWare 6.0 SP2 patches. Must have a Novell-support login account number to access patches. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. To exploit this vulnerability, a remote ASSESSMENT: attacker must be aware of a vulnerable system and be able to connect using the RConsoleJ client, and then may gain local access. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/m-115.shtml ORIGINAL BULLETIN: http://support.novell.com/servlet/tidfinder/2963349 ______________________________________________________________________________ [***** Start Novell Technical Information Document - 2963349 *****] Technical Information Document RCONAG6.NLM for servers running NW6SP2 (Last modified: 21AUG2002) This document (2963349) is provided subject to the disclaimer at the end of this document. Associated File Click filename to download: nw6rconj2a.exe; 106662 bytes; Date/Time: 08-21-2002/02:30PM Abstract These files fix the security issue running RconJ in secure mode where you can gain access to the server without a password. This is only a problem on NetWare 6 servers after applying SP2. Installation Instructions: Copy RCONAG6.NLM to SYS:\SYSTEM Copy RCONAG6.MSG to SYS:SYSTEM/NLS/4 then RESTART SERVER Issue N/A File Contents Self-Extracting File Name: NW6Rconj2a.exe Files Included Size Date Time Version Checksum \ NW6RCONJ2A.TXT 1556 08-21-2002 02:30PM \NW6Rconj2a RCONAG6.MSG 3930 08-20-2002 03:05PM RCONAG6.NLM 40846 08-20-2002 03:05PM Document Title: RCONAG6.NLM for servers running NW6SP2 Document ID: 2963349 Creation Date: 20AUG2002 Modified Date: 21AUG2002 Document Revision: 2 Novell Product Class: NetWare Novell Product and Version: NetWare 6 DISCLAIMER The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information. Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information. [***** End Novell Technical Information Document - 2963349 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Novell, Inc. for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) M-105: Unchecked Buffer in MDAC Function Vulnerability M-106: Cisco Concentrator RADIUS PAP Authentication Vulnerability M-107: Unchecked Buffer in Content Management Server M-108: Vulnerability in HP Apache Server PHP M-109: Common Desktop Environment (CDE) ToolTalk Buffer Overflow M-110: Buffer Overflow in Multiple Domain Name System (DNS) Libraries M-111: Integer Overflow in External Data Representation (XDR) Library M-112: Microsoft Cumulative Patch for SQL Server M-113: Microsoft Network Connection Manager (NCM) Flaw Could Enable Privilege Elevation M-114: Apache 2.0 Path Disclosure Vulnerability