Vulnerability Note VU#159203

Novell NetWare default installation contains sample files that disclose sensitive server information

Overview

Novell NetWare 5.1 is a network management operating system that enables access to files, printers, directories, email, databases, and other network interfaces, as well as providing a web interface. There is an insecure default configuration that places several sample applications in the webroot. Remote users may be able to use these applications to gain sensitive information about the server's configuration, and passwords.

I. Description

There are several sample applications that ship with Novell NetWare 5.1 and are installed in the webroot by default. If these applications are left in the webroot of a production machine, remote users may be able to gain sensitive information about the server's configuration, including passwords.

II. Impact

Remote users may be able to use these applications to gain sensitive information about the server's configuration, including passwords.

III. Solution

Please see http://support.novell.com/cgi-bin/search/searchtid.cgi?/10064452.htm.

Remove sample applications prior to placing the server into production.

Systems Affected

Vendor	Status	Date Updated
Novell	Vulnerable	19-Sep-2002

References

http://www.procheckup.com/security_info/vuln_pr0201.html
http://www.procheckup.com/security_info/vuln_pr0203.html
http://www.securityfocus.com/bid/4874

Credit

Thanks to ProCheckUp for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public	05/29/2002
Date First Published	06/11/2002 04:11:54 PM
Date Last Updated	04/03/2003
CERT Advisory
CVE Name
US-CERT Technical Alerts
Metric	7.50
Document Revision	13

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader