Mandrake Linux Security Advisory : ncpfs (MDKSA-2005:028)

high Nessus Plugin ID 16294

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

Erik Sjolund discovered two vulnerabilities in programs bundled with ncpfs. Due to a flaw in nwclient.c, utilities that use the NetWare client functions insecurely access files with elevated privileges (CVE-2005-0013), and there is a potentially exploitable buffer overflow in the ncplogin program (CVE-2005-0014).

As well, an older vulnerability found by Karol Wiesek is corrected with these new versions of ncpfs. Karol found a buffer overflow in the handling of the '-T' option in the ncplogin and ncpmap utilities (CVE-2004-1079).

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 16294

File Name: mandrake_MDKSA-2005-028.nasl

Version: 1.18

Type: local

Family: Mandriva Local Security Checks

Published: 2/2/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:ipxutils, p-cpe:/a:mandriva:linux:lib64ncpfs2.3, p-cpe:/a:mandriva:linux:lib64ncpfs2.3-devel, p-cpe:/a:mandriva:linux:libncpfs2.3, p-cpe:/a:mandriva:linux:libncpfs2.3-devel, p-cpe:/a:mandriva:linux:ncpfs, cpe:/o:mandrakesoft:mandrake_linux:10.0, cpe:/o:mandrakesoft:mandrake_linux:10.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2/1/2005

Reference Information

CVE: CVE-2004-1079, CVE-2005-0013, CVE-2005-0014

MDKSA: 2005:028

Detections

Analytics