Novell Client NWGINA Bug May Prevent User Profiles from Being Deleted

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1017471

SecurityTracker URL: http://securitytracker.com/id/1017471

CVE Reference: CVE-2007-0108 (Links to External Site)

Updated: May 20 2008

Original Entry Date: Jan 5 2007

Impact: Modification of system information

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 4.91 SP3

Description: A vulnerability was reported in Novell Client. A remote authenticated user may be able to bypass certain user profile restrictions in a Citrix environment.

User profiles are not deleted when in a Terminal Server/Citrix session. As a result, a remote authenticated user may be able to invoke an alternate profile.

Impact: User profiles are not deleted, which may allow a remote authenticated user to invoke alternate profiles.

Solution: The vendor has issued a fix, available at:

http://support.novell.com/servlet/filedownload/sec/ftf/491psp3_nwgina.exe

The Novell advisory is available at:

http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm

Vendor URL: support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm (Links to External Site)

Cause: State error

Message History: None.

Date: Thu, 4 Jan 2007 23:46:16 -0500
Subject: Novell Client post-4.91 SP3 NWGINA.DLL - TID2974970


http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm