NetWare 'PORTAL.NLM' Crash May Cause the Target User's Password to Be Written to the Log File
|
|
SecurityTracker Alert ID: 1016106 |
|
SecurityTracker URL: http://securitytracker.com/id/1016106
|
|
CVE Reference:
CVE-2006-2185
(Links to External Site)
|
Date: May 16 2006
|
Impact:
Disclosure of authentication information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 6.5 SP5
|
Description:
A vulnerability was reported in Novell NetWare in the HTTP stack. A remote authenticated administrator may be able to view usernames and passwords.
When an error occurs in the groupOperationsMethod() function in PORTAL.NLM, the system will write the username and password of the authenticating user into the log file 'abend.log' in plain text form.
A remote authenticated administrator with access to the file can view the passwords. Also, if the log file is transmitted to another system, the passwords may be disclosed during transmission.
|
Impact:
A user's password may be written to a log file in plain text form.
|
Solution:
The vendor has issued a fixed version, available at:
http://support.novell.com/servlet/filedownload/sec/ftf/httpstk5.exe
The vendor's advisory is available at:
http://support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm
|
Vendor URL: support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
