SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Other)  >   NetWare Vendors:   Novell
NetWare 'PORTAL.NLM' Crash May Cause the Target User's Password to Be Written to the Log File
SecurityTracker Alert ID:  1016106
SecurityTracker URL:  http://securitytracker.com/id/1016106
CVE Reference:   CVE-2006-2185   (Links to External Site)
Date:  May 16 2006
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.5 SP5
Description:   A vulnerability was reported in Novell NetWare in the HTTP stack. A remote authenticated administrator may be able to view usernames and passwords.

When an error occurs in the groupOperationsMethod() function in PORTAL.NLM, the system will write the username and password of the authenticating user into the log file 'abend.log' in plain text form.

A remote authenticated administrator with access to the file can view the passwords. Also, if the log file is transmitted to another system, the passwords may be disclosed during transmission.

Impact:   A user's password may be written to a log file in plain text form.
Solution:   The vendor has issued a fixed version, available at:

http://support.novell.com/servlet/filedownload/sec/ftf/httpstk5.exe

The vendor's advisory is available at:

http://support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm

Vendor URL:  support.novell.com/cgi-bin/search/searchtid.cgi?2973698.htm (Links to External Site)
Cause:   Access control error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC