CVE-2005-0357

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 rely on AUTH_UNIX authentication, which relies on user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16464Patch, Vendor Advisory
http://secunia.com/advisories/16470Vendor Advisory
http://securitytracker.com/id?1014713Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/606857Patch, Third Party Advisory, US Government Resource
http://www.legato.com/support/websupport/product_alerts/081605_NW_authentication.htmPatch
http://www.osvdb.org/18800
http://www.securityfocus.com/bid/14582Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21887
http://secunia.com/advisories/16464Patch, Vendor Advisory
http://secunia.com/advisories/16470Vendor Advisory
http://securitytracker.com/id?1014713Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101886-1Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/606857Patch, Third Party Advisory, US Government Resource
http://www.legato.com/support/websupport/product_alerts/081605_NW_authentication.htmPatch
http://www.osvdb.org/18800
http://www.securityfocus.com/bid/14582Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21887

Timeline

Published: Aug 23, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-03587.5EMC Legato NetWorker, Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 6.0 through 7.2 do not properly verify authentication toke CVE-2005-03596.4The Legato PortMapper in EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 does not rest CVE-2005-03605.0The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote att CVE-2005-03624.6awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadp CVE-2005-03637.5awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.CVE-2005-03645.0Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.CVE-2005-03652.1The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitr CVE-2005-03665.0The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers CVE-2005-03674.6Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arb CVE-2005-03687.5Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) EntryID or (2) search CVE-2005-03695.3Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application cra CVE-2005-03705.0Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (network disc