According to its version, the Novell NetWare install on the remote host is no longer supported by its vendor.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The version of OpenSSH running on the remote Novell NetWare host has a stack-based buffer overflow vulnerability.  When attempting to resolve an absolute path on the server, data is copied into a 512 byte buffer without any bounds checking.  A remote, authenticated attacker could exploit this to execute arbitrary code.

According to the list of enumerated software packages, the version of Novel NetWare installed on the remote host may have an information disclosure vulnerability.  Admin/install passwords are stored in the NIOUTPUT.TXT and NI.LOG installation log files.  A local attacker could exploit this to gain access to sensitive information.

Systems are vulnerable if an installation/upgrade was performed using the NetWare 6.5 Support Pack 1.1 Overlay CDs, and when the OpenSSH component is selected during Custom Installation.

The Novell Groupwise servlet server is configured with a default password.  As a result, users could be denied access to mail and other servlet based resources. 

To test this finding:

https://<host>/servlet/ServletManager/

enter 'servlet' for the user and 'manager' for the password.

The Apache Tomcat server distributed with NetWare 6.0 has a directory traversal vulnerability. As a result, sensitive information could be obtained from the NetWare server, such as the RCONSOLE password located in AUTOEXEC.NCF.

Example : 

http://target/examples/jsp/source.jsp?%2e%2e/%2e%2e/%2e%2e/%2e%2e/system/autoexec.ncf

The server's directory base is set to NULL. This allows information to be enumerated without any prior knowledge of the directory structure.

Novell Netbasic Scripting Server Directory Traversal

It is possible to escape out of the root directory of the scripting server by substituting a forward or backward slash for %5C. As a result, system information, such as environment and user information, could be obtained from the NetWare server.

Example: http://server/nsn/..%5Cutil/userlist.bas

Novell NetWare default Novonyx web server files.

A default installation of Novell 5.x will install the Novonyx web server. Numerous web server files included with this installation could reveal system information.

The installed version of Nombas ScriptEase Web Server Edition for NetWare on the remote host fails to sanitize input to the 'sewse.nlm' page and associated 'viewcode.jse' script before using it to display the source code of a file. 

By passing in a specially crafted URL argument, an attacker can view the contents of files, even files outside the web root.  This can lead to disclosure of sensitive information from the affected host, such as the RCONSOLE password located in AUTOEXEC.NCF.

The remote web server crashes when it receives a too long URL for the Perl handler.

It might be possible to make it execute arbitrary code through this flaw.

The installed version of Novell FTPServ does not handle certain types of input properly. An attacker can exploit this flaw to crash the FTP service.

Novell NetWare contains multiple default web server installations.  The NetWare Enterprise Web Server (Netscape/IPlanet) has a perl handler that will run arbitrary code given in a POST request. Versions 5.x (through SP4) and 6.x (through SP1) are affected.

This host is a Novell NetWare (eDirectory) server, and has browse rights on the PUBLIC object.

It is possible to enumerate all NDS objects, including users, with crafted queries.  An attacker can use this to gain information about this host.

The NetWare Management Portal software is installed on this machine.
It allows anyone to view the current server configuration and locate other Portal servers on the network. It is possible to browse the server's filesystem by requesting the volume in the URL. However, a valid user account is needed to do so.

ID	Name	Severity
65632	Unsupported Novell NetWare Operating System	critical
44066	Novell NetWare 6.5 OpenSSH Remote Stack Buffer Overflow	high
44064	Novell NetWare 6.5 Support Pack 1.1 Admin/Install Local Information Disclosure	low
12122	Novell Groupwise Servlet Manager Default Password	medium
12119	Novell NetWare 6.0 Tomcat source.jsp Traversal Arbitrary File Access	high
12104	Novell NetWare LDAP Server Anonymous Bind	medium
12050	Novell NetBasic Scripting Server Encoded Traversal Arbitrary File Access	medium
12049	Novonyx Web Server Multiple Sample Application Files Present	high
12048	Novell NetWare Web Server sewse.nlm (viewcode.jse) Traversal Arbitrary File Access	medium
11827	Novell NetWare Web Server CGI2PERL.NLM PERL Handler Remote Overflow	high
11614	Novell NetWare FTPServ Malformed Input Remote DoS	medium
11158	Novell NetWare Web Handler Multiple Vulnerabilities	high
10988	Novell NetWare ncp Service NDS Object Enumeration	medium
10826	Novell NetWare Management Portal Unrestricted Access	medium

Detections

Analytics

Netware Family for Nessus

critical

high

low

medium

high

medium

medium

high

medium

high

medium

high

medium

medium