Vulnerability

CERT-In Vulnerability Note CIVN-2005-0098
Vulnerability in the Client Services for Netware

Original Issue Date:October 12, 2005

Severity Rating: MEDIUM

Systems Affected

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1

Overview

A remote Code Execution vulnerability has been reported in the Client Service for Netware CSNW , which could be exploited by malicious people to compromise a vulnerable system.

Description

The Client Service for NetWare CSNW allows the client to access NetWare file, print, and directory services. An unchecked buffer in the Client Service for NetWare can cause Remote Code Execution.

This can be exploited to execute arbitrary code on a vulnerable system via a series of specially crafted network messages. An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system.

Workaround

Microsoft suggested following workarounds to mitigate the attack vectors.

Remove the Client Service for NetWare if you do not need it.
Block TCP ports 139 and 445 at the firewall.
To protect from network-based attempts to exploit this vulnerability, use a personal firewall, block the affected ports by using IPSec on the affected systems and enable advanced TCP/IP filtering on systems that support this feature.

Solution

Apply appropriate security update as mentioned in the Microsoft Security Bulletin MS05-046

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms05-oct.mspx

References

Microsoft Security Bulletin MS05-046
http://www.microsoft.com/technet/security/bulletin/MS05-046.mspx

Secunia Advisory
http://secunia.com/advisories/17165/

CVE Name
CAN-2005-1985

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India