nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.

This update fixes the following security issues :

  - a buffer overflow in ncplogin and ncpmap. Both     applications are installed setuid-root on SuSE Linux,     but only users of group 'trusted' are allowed to execute     the binaries. If successfully exploited this     vulnerabilities could be used to gain local root access.

  - missing file permisions checks for ~/.nwclient.
    (CVE-2005-0013)

  - a buffer overflow in ncplogin. (CVE-2005-0014)

This update also fixes the following non-security issues :

  - On SLES9 translations for several languages have been     added

An updated ncpfs package is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ncpfs is a file system that understands the Novell NetWare(TM) NCP protocol.

A bug was found in the way ncpfs handled file permissions. ncpfs did not sufficiently check if the file owner matched the user attempting to access the file, potentially violating the file permissions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0013 to this issue.

All users of ncpfs are advised to upgrade to this updated package, which contains backported fixes for this issue.

The remote host is affected by the vulnerability described in GLSA-200501-44 (ncpfs: Multiple vulnerabilities)

    Erik Sjolund discovered two vulnerabilities in the programs     bundled with ncpfs: there is a potentially exploitable buffer overflow     in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities     using the NetWare client functions insecurely access files with     elevated privileges (CAN-2005-0013).
  Impact :

    The buffer overflow might allow a malicious remote NetWare server     to execute arbitrary code on the NetWare client. Furthermore, a local     attacker may be able to create links and access files with elevated     privileges using SUID ncpfs utilities.
  Workaround :

    There is no known workaround at this time.

Erik Sjolund discovered several bugs in ncpfs that provides utilities to use resources from NetWare servers of which one also applies to the stable Debian distribution. Due to accessing a configuration file without further checks with root permissions it is possible to read arbitrary files.

Erik Sjolund discovered two vulnerabilities in programs bundled with ncpfs. Due to a flaw in nwclient.c, utilities that use the NetWare client functions insecurely access files with elevated privileges (CVE-2005-0013), and there is a potentially exploitable buffer overflow in the ncplogin program (CVE-2005-0014).

As well, an older vulnerability found by Karol Wiesek is corrected with these new versions of ncpfs. Karol found a buffer overflow in the handling of the '-T' option in the ncplogin and ncpmap utilities (CVE-2004-1079).

ID	Name	Product	Family	Severity
41344	SuSE9 Security Update : ncpfs (YOU Patch Number 9805)	Nessus	SuSE Local Security Checks	high
18278	RHEL 2.1 : ncpfs (RHSA-2005:371)	Nessus	Red Hat Local Security Checks	high
16435	GLSA-200501-44 : ncpfs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16311	Debian DSA-665-1 : ncpfs - missing privilege release	Nessus	Debian Local Security Checks	high
16294	Mandrake Linux Security Advisory : ncpfs (MDKSA-2005:028)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2005-0013

high

Tenable Plugins

high

high

high

high

high