CVE-2016-5763 – This vulnerability in Novell Open Enterprise Se... (How to Fix)

Q: What is the severity of CVE-2016-5763?

CVE-2016-5763 has a CVSS score of 9.1 (CRITICAL). This vulnerability in Novell Open Enterprise Server allows authenticated remote attackers to access and modify files without proper authorization. It affects OES2015 SP1, OES2015, OES11 SP3, and OES11 SP2 before specific maintenance updates. Attackers with valid credentials can exploit this to compromise system integrity.

📋 TL;DR

This vulnerability in Novell Open Enterprise Server allows authenticated remote attackers to access and modify files without proper authorization. It affects OES2015 SP1, OES2015, OES11 SP3, and OES11 SP2 before specific maintenance updates. Attackers with valid credentials can exploit this to compromise system integrity.

💻 Affected Systems

Products:

Novell Open Enterprise Server

Versions: OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989

Operating Systems: Linux (Novell SUSE Linux Enterprise Server based)

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access; affects all default installations of the specified versions.

📦 What is this software?

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Authenticated attackers could gain full control over the server, modify critical system files, steal sensitive data, or install persistent backdoors leading to complete system compromise.

🟠

Likely Case

Attackers with legitimate credentials could access and modify files they shouldn't have permission to, potentially exposing sensitive information or altering business-critical data.

🟢

If Mitigated

With proper access controls and network segmentation, impact would be limited to specific file systems accessible to the authenticated user's account.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires valid authentication credentials; once authenticated, the file access/modification vulnerability is straightforward to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: OES2015 SP1: Scheduled Maintenance Update 10992, OES2015: Scheduled Maintenance Update 10990, OES11 SP3: Scheduled Maintenance Update 10991, OES11 SP2: Scheduled Maintenance Update 10989

Vendor Advisory: http://download.novell.com/Download?buildid=3Ho1yp5JOXA~

Restart Required: Yes

Instructions:

1. Download the appropriate maintenance update from Novell's download portal. 2. Apply the update using the standard Novell update process. 3. Restart affected services or the entire server as required.

🔧 Temporary Workarounds

Restrict Network Access

all

Limit access to OES servers to only trusted networks and required users

Configure firewall rules to restrict access to OES services (typically ports 80, 443, 524, 636, 2000-2003, 8008-8009, 8443)

Implement Least Privilege

linux

Minimize user privileges and implement strict access controls

Review and restrict file system permissions for all OES user accounts

🧯 If You Can't Patch

Implement strict network segmentation to isolate OES servers from untrusted networks
Enforce multi-factor authentication and monitor all authenticated access to OES services

🔍 How to Verify

Check if Vulnerable:

Check OES version via command line: 'cat /etc/novell-release' or 'rpm -qa | grep -i oes' and compare against vulnerable versions

Check Version:

cat /etc/novell-release

Verify Fix Applied:

Verify maintenance update is installed: 'rpm -qa | grep -E "(10989|10990|10991|10992)"' should show the update package

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns in OES audit logs
Multiple failed authentication attempts followed by successful login and file operations
Unexpected file modifications in system directories

Network Indicators:

Unusual traffic patterns to OES file services from authenticated users
Multiple authentication requests from single source

SIEM Query:

source="oes_logs" AND (event_type="file_access" OR event_type="file_modify") AND user!="system" AND file_path CONTAINS "/etc/" OR file_path CONTAINS "/var/"

📊 Metadata

CVE ID: CVE-2016-5763

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-254

Published: November 15, 2016

Last Updated: April 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2016-5763, you might also want to check these: