Novell Netware vulnerabilities

CVE-2002-1418 [MEDIUM] CVE-2002-1418: Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to cause a denial of service (ABEND) via a long module name.

CVE-2002-1438 [MEDIUM] CVE-2002-1438: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain Perl version information via the -v option.

CVE-2002-1417 [MEDIUM] CVE-2002-1417: Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, a Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to read arbitrary files via a URL containing a "..%5c" sequence (modified dot-dot), which is mapped to the directory separator.

CVE-2002-1437 [MEDIUM] CVE-2002-1437: Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWar Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" (URL-encoded dot-dot backslash) sequences.

CVE-2002-2096 [HIGH] CVE-2002-2096: Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows re Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.

CVE-2002-1634 [MEDIUM] CVE-2002-1634: Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive info Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl.

CVE-2002-1772 [MEDIUM] CVE-2002-1772: Novell Netware 5.0 through 5.1 may allow local users to gain "Domain Admin" rights by logging into a Novell Netware 5.0 through 5.1 may allow local users to gain "Domain Admin" rights by logging into a Novell Directory Services (NDS) account, and executing "net use" on an NDS_ADM account that is not in the NT domain but has domain access rights, which allows the user to enter a null password.

CVE-2002-0930 [MEDIUM] CVE-2002-0930: Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 (NWFTPD) allows remote atta Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 (NWFTPD) allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command.

CVE-2002-0929 [MEDIUM] CVE-2002-0929: Buffer overflows in the DHCP server for NetWare 6.0 SP1 allow remote attackers to cause a denial of Buffer overflows in the DHCP server for NetWare 6.0 SP1 allow remote attackers to cause a denial of service (reboot) via long DHCP requests.

CVE-2002-0791 [MEDIUM] CVE-2002-0791: Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service ( Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service (CPU consumption) via a connection to the server followed by a carriage return, and possibly other invalid commands with improper syntax or length.

CVE-2001-1580 [MEDIUM] CVE-2001-1580: Directory traversal vulnerability in ScriptEase viewcode.jse for Netware 5.1 before 5.1 SP3 allows r Directory traversal vulnerability in ScriptEase viewcode.jse for Netware 5.1 before 5.1 SP3 allows remote attackers to read arbitrary files via ".." sequences in the query string.

CVE-2001-1233 [MEDIUM] CVE-2001-1233: Netware Enterprise Web Server 5.1 running GroupWise WebAccess 5.5 with Novell Directory Services (ND Netware Enterprise Web Server 5.1 running GroupWise WebAccess 5.5 with Novell Directory Services (NDS) enabled allows remote attackers to enumerate user names, group names and other system information by accessing ndsobj.nlm.

CVE-1999-0805 [MEDIUM] CVE-1999-0805: Novell NetWare Transaction Tracking System (TTS) in Novell 4.11 and earlier allows remote attackers Novell NetWare Transaction Tracking System (TTS) in Novell 4.11 and earlier allows remote attackers to cause a denial of service via a large number of requests.

CVE-2000-0669 [MEDIUM] CVE-2000-0669: Novell NetWare 5.0 allows remote attackers to cause a denial of service by flooding port 40193 with Novell NetWare 5.0 allows remote attackers to cause a denial of service by flooding port 40193 with random data.

CVE-2000-0600 [HIGH] CVE-2000-0600: Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or ex Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed URL.

CVE-2000-0257 [HIGH] CVE-2000-0257: Buffer overflow in the NetWare remote web administration utility allows remote attackers to cause a Buffer overflow in the NetWare remote web administration utility allows remote attackers to cause a denial of service or execute commands via a long URL.

CVE-1999-1320 [MEDIUM] CVE-1999-1320: Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spo Vulnerability in Novell NetWare 3.x and earlier allows local users to gain privileges via packet spoofing.

CVE-1999-1086 [CRITICAL] CVE-1999-1086: Novell 5 and earlier, when running over IPX with a packet signature level less than 3, allows remote Novell 5 and earlier, when running over IPX with a packet signature level less than 3, allows remote attackers to gain administrator privileges by spoofing the MAC address in IPC fragmented packets that make NetWare Core Protocol (NCP) calls.

CVE-1999-0929 [MEDIUM] CVE-1999-0929: Novell NetWare with Novell-HTTP-Server or YAWN web servers allows remote attackers to conduct a deni Novell NetWare with Novell-HTTP-Server or YAWN web servers allows remote attackers to conduct a denial of service via a large number of HTTP GET requests.

CVE-1999-0470 [MEDIUM] CVE-1999-0470: A weak encryption algorithm is used for passwords in Novell Remote.NLM, allowing them to be easily d A weak encryption algorithm is used for passwords in Novell Remote.NLM, allowing them to be easily decrypted.