PT-2004-3306 · Novell+1 · Novell Netware+1

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2414

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Novell NetWare version 6.5 SP 1.1

Description: The issue allows local users to potentially obtain sensitive password information. This is due to the inclusion of password details in the NIOUTPUT.TXT and NI.LOG log files when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH.

Recommendations: For Novell NetWare version 6.5 SP 1.1, consider removing or securing access to the NIOUTPUT.TXT and NI.LOG log files to prevent unauthorized access to sensitive password information. As a temporary workaround, restrict access to these log files until a more permanent solution is available.

Correção

Identificadores relacionados

CVE-2004-2414

Produtos afetados

Novell Netware

Openssh

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/15600 · Nota
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2968534.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2414 · Nota de Segurança
• http://secunia.com/advisories/11188 · Aviso do Fabricante
• http://securityfocus.com/bid/9934 · Correção