[19600] in bugtraq
Re: Vulnerability in Novell Netware
daemon@ATHENA.MIT.EDU (Ben Ponting)
Mon Mar 12 04:24:09 2001
Message-ID: <20010312005436.22086.qmail@securityfocus.com>
Date: Mon, 12 Mar 2001 00:54:36 -0000
Reply-To: bponting@HOTMAIL.COM
From: Ben Ponting <bponting@HOTMAIL.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
We've tested this exploit with NW 5.1 SP2a using a
queue based Print Server object.
We could login as the object with no password, but
the object only had public rights (ie, browse, compare
and read).
No volume scan, read or write rights.
Though it must have read rights to the print spool
location.
By default the Print Server should not security
equivelance to the container.
But this may have been manually assigned in the
environment where the vulnerability was discovered.
Ben Ponting
