|
NCP Secure Entry/Enterprise Client Two Vulnerabilities
|
|
Secunia Advisory:
|
SA19082
|
|
|
Release Date:
|
2006-03-02
|
|
Last Update:
|
2006-07-20
|
|
Popularity:
|
5,988 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Privilege escalation
|
|
Where:
|
Local system
|
|
Solution Status:
|
Unpatched
|
|
| Software: | NCP Secure Enterprise Client 8.x
NCP Secure Entry Client 8.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-0965
CVE-2006-0968
|
|
Description:
Ramon 'ports' Kukla has reported two vulnerabilities in NCP Secure Entry/Enterprise Client, which can be exploited by malicious, local users to gain escalated privileges.
1) A design error in the handling of command line options passed to ncpmon.exe can be exploited to bypass the "Configuration Locks" settings and to make certain configuration changes by running ncpmon.exe with a command line argument of more than 261 characters.
2) Insecure permissions in the installation directory can be exploited by malicious users to create files within the directory. This reportedly can be further exploited by creating a "connect.bat" file that will be run with SYSTEM privileges when a VPN connection is established.
The vulnerabilities have been reported in version 8.11 Build 146. Other versions may also be affected.
Solution:
Restrict access to affect systems.
Vulnerability #1 will reportedly be fixed in version 8.30.
Provided and/or discovered by:
Ramon 'ports' Kukla
Changelog:
2006-03-09: Updated "Description", "Solution" and "Original Advisory" sections.
2006-07-20: Added CVE references.
Original Advisory:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/042640.html
http://www.ncp.de/deutsch/filedownload/Statement_NCP_VPN_PKI-Kukla.pdf
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
