-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0032 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
 EMC Legato NetWorker Management Console weak authentication vulnerability
                               6 March 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              EMC NetWorker 7.3.2 and prior
Publisher:            US-CERT
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Administrative Compromise
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-3892

Original Bulletin:    http://www.kb.cert.org/vuls/id/498553

Comment: EMC have released a patch fixing this vulnerability. The patch
         is NetWorker 7.3.2 Jumbo Update 1, available for download at:
         ftp://ftp.legato.com/pub/NetWorker/Updates/732JumboUpdate1

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#498553
EMC NetWorker Management Console weak authentication vulnerability

Overview

	A vulnerability in the authentication mechanism used by the Legato
	NetWorker Management Console may allow an attacker to execute arbitrary
	commands.

I. Description

	The EMC NetWorker (formerly Legato NetWorker) family of products
	provides solutions for backup and recovery of data. It includes the
	EMC NetWorker Management Console option which provides a Java-based
	interface for monitoring, administration, and reporting for NetWorker
	environments. 

	The NetWorker Management Console configures and uses a weak form of
	authentication to connect to managed NetWorker backup servers. Any
	remote attacker with knowledge of this authentication mechanism could
	impersonate the NetWorker Management Console system and connect to
	the affected servers with root privileges.

II. Impact

	A remote attacker may be able to execute arbitrary commands on a
	vulnerable system. The attacker-supplied commands would be executed
	with root privileges. Secondary impacts include, but are not limited
	to, compromise of backup archive integrity.

III. Solution

	Apply an update

	EMC has published patches to address this issue. Please see the Systems
	Affected section of this document for additional details.

	Restrict access to the affected component

	Users, particularly those who are unable to apply the patches, are
	encouraged to block access to ports 2638/tcp and 2638/udp at the
	network perimeter and on the host running the EMC NetWorker Management
	Console.

Systems Affected

	Vendor         Status      Date Updated
	EMC Software   Vulnerable  27-Feb-2007
	http://www.kb.cert.org/vuls/id/MIMG-6VMLWA

References

	ftp://ftp.legato.com/pub/NetWorker/Updates/732JumboUpdate1/README%20732%20Jumbo%20Update%201.txt
	http://secunia.com/advisories/24362/

Credit

	Thanks to the National Oceanic and Atmospheric Administration (NOAA)
	Computer Incident Response Team (N-CIRT) Lab for reporting this issue.

	This document was written by Chad R Dougherty.

	Other Information
	Date Public	02/26/2007
	Date First Published	03/02/2007 11:26:08 AM
	Date Last Updated	03/05/2007
	CERT Advisory	 
	CVE Name	CVE-2006-3892
	Metric	19.91
	Document Revision	12

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRezPGSh9+71yA2DNAQKVtwP8D6IRhnpcy8Ax8yooqI5U0BFaD3Xi3s3u
9mT2rVQbVbn/QQ3bqPG3vBuksiaIhM2h9N8ohd/X7+midamEaUvbBlq+3ZUvJPq4
hBXeTux1nEs3WPBSAKqfHQgM/qcsS2q1K9AIKKH8efGPyZ4SBUEYMM+R2x1dcmT3
/AYmVRroZ7U=
=lNDx
-----END PGP SIGNATURE-----