PT-2006-6933 · Novell · Novell Client+1

Deral Heiland · Publicado 2006-12-05 · Atualizado 2018-10-17 · CVE-2006-6306

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell Client versions 4.91 SP2 through 4.91 SP3

Description A format string issue in the Novell Modular Authentication Services (NMAS) component allows users with physical access to read stack and memory contents. This is achieved by using format string specifiers in the Username field of the logon window.

Recommendations For Novell Client versions 4.91 SP2 and 4.91 SP3, consider restricting access to the logon window to minimize the risk of exploitation. Avoid using format string specifiers in the Username field until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-6306

Produtos afetados

Novell Client

Novell Modular Authentication Service

Referências · 12

• http://vupen.com/english/advisories/2006/4987 · Nota
• http://secunia.com/advisories/23363 · Nota
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974872.htm · Nota
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974876.htm · Nota
• http://securitytracker.com/id?1017377 · Nota
• https://secure-support.novell.com/KanisaPlatform/Publishing/372/3546910_f.SAL_Public.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30644 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051038.html · Aviso do Fabricante
• http://layereddefense.com/Novell01DEC.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6306 · Nota de Segurança
• http://securityreason.com/securityalert/1970 · Nota
• http://securityfocus.com/archive/1/453176/100/0/threaded · Nota