SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Novell Client Vendors:   Novell
Novell Client Lets Local Users Gain Kernel Level Privileges
SecurityTracker Alert ID:  1018943
SecurityTracker URL:  http://securitytracker.com/id/1018943
CVE Reference:   CVE-2007-5667   (Links to External Site)
Date:  Nov 13 2007
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.91 SP4 and prior service packs
Description:   A vulnerability was reported in Novell Client for Windows. A local user can obtain kernel level privileges on the target system.

The 'NWFILTER.SYS' driver does not properly validate user-supplied data. A local user can supply specially crafted data to 'NWFILTER.SYS' to execute arbitrary commands on the target system with kernel level privileges.

The vendor was notified on September 25, 2007.

Stephen Fewer of Harmony Security reported this vulnerability via VeriSign iDefense.

Impact:   A local user can obtain root privileges on the target system.
Solution:   The vendor has issued the following patches.

Novell Client 4.91 SP4:
Title: Novell Client post-4.91 SP4 NWFILTER
Filename: 491psp4_nwfilter.zip
Readme: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5006982.html

Novell Client 4.91 SP3:
Title: Novell Client post-4.91 SP3 NWFILTER
Filename: 491psp3_nwfilter.zip
Readme: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5006862.html

Novell Client 4.91, 4.91 SP1, 4.91 SP1a and 4.91 SP2:
Title: Novell Client post-4.91, SP1, and SP2 NWFILTER
Filename: 491presp3_nwfilter.zip
Readme: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5006983.html

The Novell advisory is available at:

https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html

Vendor URL:  secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC