Netware NDS Object Enumeration
|
|
Article ID: 10988
Last updated: 27 Jan, 2009
|
|
|
|
Views: 506
|
|
Posted: 22 Jan, 2009
by: Tech Pubs S.
Updated: 27 Jan, 2009
by: Tech Pubs S.
|
|
Netware NDS Object Enumeration |
|
| This script is Copyright (C) 2002 Digital Defense, Inc |
|
|
| Family | Netware |
| Plugin ID | 10988 |
| Bugtraq ID |
|
| CVE ID |
|
|
| Description: |
Synopsis :
Remote directory server leaks information.
Description :
This host is a Novell Netware (eDirectory) server, and has browse
rights on the PUBLIC object.
It is possible to enumerate all NDS objects, including users, with
crafted queries. An attacker can use this to gain information about
this host.
Solution :
The NDS object PUBLIC should not have Browse rights the tree should
be restricted to authenticated users only.
Removing Browse rights from the object will fix this issue. If this
is an external system it is recommended that access
to port 524 be blocked from the Internet.
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N) |
|
