Legato NetWorker contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the AUTH_UNIX authentication mechanism used for RPC services allows username spoofing by remote users in the nwadmin, nsradmin, and nsrports programs, or UID spoofing in the recover and nsrexecd programs. This flaw may allow a remote attacker to execute arbitrary commands on a NetWorker client system, modify the NetWorker server configuration, and view backed up files from any system, leading to a loss of confidentiality, integrity and availability.

Currently, there are no known workarounds or upgrades to correct this issue. However, EMC and Sun have released patches to address this vulnerability.

• Security Tracker: 1014713
• Bugtraq ID: 14582
• Secunia Advisory ID: 16464 16470
• Related OSVDB ID: 18801 18802
• CVE ID: 2005-0357 (see also: NVD)
• ISS X-Force ID: 21887
• CERT VU: 606857
• Other Advisory URL: http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1
• Generic Informational URL: http://www.cnn.com/2005/TECH/internet/07/25/hackers.backup.software.reut/index.html
• Vendor Specific Advisory URL: http://www.legato.com/support/websupport/product_alerts/081605_NW-7x.htm
  http://www.legato.com/support/websupport/product_alerts/081605_NW_authentication.htm

Unknown or Incomplete