CVE-2006-0968 - The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146, and possibly other v

CVE-2006-0968

Summary

The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.

References

Vulnerable Configurations

cpe:2.3:a:ncp_network_communications:secure_client:8.11_build_146:*:*:*:*:*:*:*
cpe:2.3:a:ncp_network_communications:secure_client:8.11_build_146:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 18-10-2018 - 16:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	16906
bugtraq	20060301 NCP VPN/PKI Client - various Bugs
fulldisc	20060301 NCP VPN/PKI Client - various Bugs
secunia	19082
sreason	524
xf	ncp-connect-command-execution(25251)

Last major update

18-10-2018 - 16:29

Published

02-03-2006 - 23:02

Last modified

18-10-2018 - 16:29