===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : CERT-NL                                     Index  :    S-92-17
Distribution  : SURFnet Constituency                        Page   :          1
Classification: External                                    Version:      final
Subject       : Novell Access Rights Vulnerability	    Date   :  23-sep-92
===============================================================================

CERT-NL (SURFnet Computer Emergency Response Team) has received
information concerning a security problem in Novell NetWare regarding
Access Rights. This security problem is present in NetWare 386, but
other versions of Novell NetWare are apparently vulnerable as well.

* DESCRIPTION

  Novell NetWare 386 is vulnerable on Access Rights, which can be gained by
  any other user. This vulnerability probably affects all versions of
  Novell NetWare.

* IMPACT

  The impact of the problem lies in the fact that every Novell user,
  equipped with a special program, is able to gain the Access Rights of
  any other user on the attached Novell server, including the
  Supervisor.


* SOLUTION

  Up till now no fix exists to this vulnerability. The problem is however
  known to Novell HQ in Provo, Utah, who are working on the problem. As
  soon as the fix is available, the information about obtaining the fix
  will be published in a CERT-NL Security Bulletin.
  CERT-NL advises all Novell system managers:
  - not to log on as Supervisor equivalent user, when there are other users
    on the file server.
  - to remove the "Access Control Right" from all users (this right is
    necessary to change trustees, and is often handed out to "normal
    users", who do not need this right to run applications).
  - to install "showevnt.nlm" in order to be able to monitor changes in
    network Rights (by means of "showevnt.nlm" the system manager is able
    detect changes in trustees). The program "showevnt.nlm" is available
    from the anonymous FTP-server of SURFnet, called ftp.nic.surfnet.nl 
    [192.87.46.2] in the directory "netman/cert-nl/novell". Currently the
    following files are in this directory:
    showevnt.nlm - the NLM itself                             (6538 bytes)
    showevnt.doc - manual page of the NLM                     (4125 bytes)
    showevnt.txt - README file                                ( 286 bytes)
    showevnt.zip - ZIP file, containing the three files above (6050 bytes)
    Please read the "showevnt.doc" file carefully before installing the
    NLM.


CERT-NL wishes to thank Bart Mellink of Cyco Automation for providing the
"showevnt.nlm" and putting it in the Public Domain. CERT-NL wishes to
thank Novell Benelux for the good cooperation.

==============================================================================
CERT-NL is the Computer Emergency Response Team, located in The
Netherlands. CERT-NL is a Full Member of the Forum of Incident Response
and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet
connected institutions.

Past CERT-NL Security Bulletins and other CERT-NL related material can
be found on the anonymous FTP server of SURFnet bv:
"ftp.nic.surfnet.nl" [192.87.46.3], in the directory "netman/cert-nl".
This information is also available using email. Send an email saying
"help" to "mailserv@nic.surfnet.nl".

In case of computer or network security problems please contact CERT-NL
or the CERT of your own constituency. Please be aware of the fact that
we are are one hour ahead of Universal Time Coordinated (i.e. UTC+0100).
Email:     cert-nl@surfnet.nl
Phone:     +31 30 310290
Fax:       +31 30 340903
Snailmail: SURFnet bv
           Attn. CERT-NL
           P.O. Box 19035
           NL - 3501 DA  UTRECHT
           The Netherlands
A 7*24h phonenumber is available to SURFnet SSC's and FIRST members on request
==============================================================================