Novell NetWare ncp Service NDS Object Enumeration

This script is Copyright (C) 2002-2015 Digital Defense, Inc


Synopsis :

Remote directory server leaks information.

Description :

This host is a Novell NetWare (eDirectory) server, and has browse
rights on the PUBLIC object.

It is possible to enumerate all NDS objects, including users, with
crafted queries. An attacker can use this to gain information about
this host.

Solution :

The NDS object PUBLIC should not have Browse rights the tree should
be restricted to authenticated users only.

Removing Browse rights from the object will fix this issue. If this
is an external system it is recommended that access
to port 524 be blocked from the Internet.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Family: Netware

Nessus Plugin ID: 10988 ()

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now