First published: Thu Jul 15 1999(Updated: )
Novell 5 and earlier, when running over IPX with a packet signature level less than 3, allows remote attackers to gain administrator privileges by spoofing the MAC address in IPC fragmented packets that make NetWare Core Protocol (NCP) calls.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Novell NetWare | =4.11-sp5b | |
Novell NetWare | <=5.0 | |
Novell NetWare | =4.1 | |
<=5.0 | ||
=4.1 | ||
=4.11-sp5b |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-1999-1086 is considered a critical vulnerability due to the potential for remote attackers to gain administrator privileges.
To fix CVE-1999-1086, ensure that packet signature level is set to 3 or higher on affected versions of Novell NetWare.
CVE-1999-1086 affects Novell NetWare versions 4.1, 4.11 (SP5B), and all versions up to 5.0.
CVE-1999-1086 allows attackers to spoof MAC addresses to execute IPC fragmented packets making NCP calls.
A possible workaround for CVE-1999-1086 is to disable IPX support if not required, reducing the attack surface.