SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   OS (Other)  >   NetWare Vendors:   Novell
NetWare 'PORTAL.NLM' Crash May Cause the Target User's Password to Be Written to the Log File
SecurityTracker Alert ID:  1016106
SecurityTracker URL:  http://securitytracker.com/id/1016106
CVE Reference:   CVE-2006-2185   (Links to External Site)
Date:  May 16 2006
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.5 SP5
Description:   A vulnerability was reported in Novell NetWare in the HTTP stack. A remote authenticated administrator may be able to view usernames and passwords.

When an error occurs in the groupOperationsMethod() function in PORTAL.NLM, the system will write the username and password of the authenticating user into the log file 'abend.log' in plain text form.

A remote authenticated administrator with access to the file can view the passwords. Also, if the log file is transmitted to another system, the passwords may be disclosed during transmission.

Impact:   A user's password may be written to a log file in plain text form.
Solution:   The vendor has issued a fixed version, available at:

http://support.novell.com/servlet/filedownload/sec/ftf/httpstk5.exe

The vendor's advisory is available at:

http://support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm

Vendor URL:  support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm (Links to External Site)
Cause:   Access control error
Underlying OS:  

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC