-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2004.0758 -- Novell NetMail/NIMS/IMS NMAP Default
                  Authentication Credential Vulnerability
                              7 December 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           NetMail
                   IMS
                   NIMS
Operating System:  Windows
                   Linux variants
                   Novell Netware
Impact:            Inappropriate Access
Access:            Remote/Unauthenticated


PROBLEM:

	Novell has acknowledged a security issue in NetMail, IMS and NIMS in 
	the authentication for the Network Messaging Application Protocol (NMAP).

	At install time, a default authentication credential is configured for
	NMAP access. If this default credential is not explicitly changed, a 
	remote attacker can use it to gain full read/write access to the
	mailstore and to send unauthorized messages. 

	Further information is available in the Novell advisories linked to 
	below.


VERSIONS: 
	
	Default installations of NetMail 3.52 and prior, IMS 2.5 and NIMS 2.6
	on the Windows, Linux and Netware platforms are vulnerable.


IMPACT:   

	A remote attacker who can connect to port 689 on the server can gain 
	full read/write access to the mailstore and/or send unauthorized 
	messages to local or remote users.

	
MITIGATION: 

	Use the nmapcred utility provided by Novell to change the NMAP 
	authentication credential from the default. This utility is available 
	from the Novell Technical Information Documents describing this 
	vulnerability, which can be found at the following locations for each
	platform:

	Windows: 
	http://support.novell.com/cgi-bin/search/searchtid.cgi?/2970344.htm

	Linux:
	http://support.novell.com/cgi-bin/search/searchtid.cgi?/2970324.htm

	Netware: 
	http://support.novell.com/cgi-bin/search/searchtid.cgi?/2970343.htm


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQbUKFCh9+71yA2DNAQJ/wgP/V1UBoIeh43JvBHo5hi9wR7NGKSOrDf2l
0s0u6azqCBsyCEXbZX+S0yNAfxhHPGeJUoq55yUoRYsYZG4Z6FpyNqJUSlu/xTNf
YlcTNyYPeSqhfQ7pcNF3r3LLiCYJumPXvcRG82uWo0z94qpz93SEtK3OZqS1Pm3c
N1Pc0nJwp84=
=odTx
-----END PGP SIGNATURE-----