Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker

Category:   OS (Other)  >   NetWare Vendors:   Novell
NetWare 'PORTAL.NLM' Crash May Cause the Target User's Password to Be Written to the Log File
SecurityTracker Alert ID:  1016106
SecurityTracker URL:
CVE Reference:   CVE-2006-2185   (Links to External Site)
Date:  May 16 2006
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.5 SP5
Description:   A vulnerability was reported in Novell NetWare in the HTTP stack. A remote authenticated administrator may be able to view usernames and passwords.

When an error occurs in the groupOperationsMethod() function in PORTAL.NLM, the system will write the username and password of the authenticating user into the log file 'abend.log' in plain text form.

A remote authenticated administrator with access to the file can view the passwords. Also, if the log file is transmitted to another system, the passwords may be disclosed during transmission.

Impact:   A user's password may be written to a log file in plain text form.
Solution:   The vendor has issued a fixed version, available at:

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Access control error

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, LLC