ID

VAR-200603-0495

CVE

CVE-2006-0965

TITLE

NCP 'ncpmon.exe' Secure Client Multi-Vulnerability

DESCRIPTION

NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a buffer overflow. NCP Secure Client is susceptible to multiple vulnerabilities. The following issues have been identified: - Firewall rules designed to allow only specific applications to access the network may be bypassed. - Some applications are prone to local command-line-argument buffer-overflow vulnerabilities. - The VPN client is susceptible to a remote denial-of-service vulnerability. - The VPN client is susceptible to a local privilege-escalation vulnerability. These issues allow local attackers to gain SYSTEM-level privileges, allowing them to completely compromise affected computers. Remote attackers may consume excessive CPU resources, denying service to legitimate users. NCP Secure Client version 8.11 Build 146 on the Microsoft Windows platform is vulnerable to these issues; other versions may also be affected. TITLE: NCP Secure Entry Client Two Vulnerabilities SECUNIA ADVISORY ID: SA19082 VERIFY ADVISORY: http://secunia.com/advisories/19082/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: NCP Secure Entry Client 8.x http://secunia.com/product/8515/ DESCRIPTION: Ramon 'ports' Kukla has reported two vulnerabilities in NCP Secure Entry Cilent, which can be exploited by malicious, local users to gain escalated privileges. 1) A design error in the handling of command line options passed to ncpmon.exe can be exploited to bypass the "Configuration Locks" settings and to make certain configuration changes by running ncpmon.exe with a command line argument of more than 261 characters. 2) Insecure permissions in the installation directory can be exploited by malicious users to create files within the directory. This reportedly can be further exploited by creating a "connect.bat" file that will be run with SYSTEM privileges when a VPN connection is established. The vulnerabilities have been reported in version 8.11 Build 146. Other versions may also be affected. SOLUTION: Restrict access to affect systems. PROVIDED AND/OR DISCOVERED BY: Ramon 'ports' Kukla ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/042640.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

buffer overflow

EXTERNAL IDS

REFERENCES

CREDITS

Ramon 'ports' Kukla <ml2@portsonline.net> discovered these issues.

SOURCES

LAST UPDATE DATE

2024-08-14T14:08:36.520000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE