Secunia

NOAA NCIRT Lab has reported three vulnerabilities in Legato NetWorker, which can be exploited by malicious people to cause a DoS (Denial of Service), gain knowledge of sensitive information, or bypass certain security restrictions.

1) An error in the AUTH_UNIX authentication for the RPC service can be exploited to bypass the authentication to the nwadmin, nsradmin, and nsrports components by providing a fake user name or to the recover and nsrececd components by providing a fake UID.

2) An error in the token-based authentication to the database services can be exploited to gain administrative privileges without being listed in the administrator list by sending a specially crafted token.

3) The portmapper (lgtomapper) allows calls to pmap_set and pmap_unset, which can be exploited to register and unregister RPC services thereby causing a DoS or potentially eavesdrop on NetWorker process communication.

Solution
Apply patches LGTpa74792, LGTpa78968, and LGTpa78969 (for versions 7.1.3 and 7.2).
Further details available in Customer Area

Provided and/or discovered by
NOAA NCIRT Lab.

Changelog
Further details available in Customer Area

Original Advisory
EMC Corporation:
http://www.legato.com/support/websupport/product_alerts/081605_NW-7x.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area