PT-2007-5697 · Novell · Novell Identity Manager

Publicado 2007-08-25 · Atualizado 2018-09-27 · CVE-2007-4526

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell Identity Manager versions prior to 3.5.1 20070730

Description The issue allows local users to obtain sensitive information, specifically usernames and passwords, by reading a local file where this data is stored. This is due to the way the Client Login Extension (CLE) handles storage of this sensitive information.

Recommendations For versions prior to 3.5.1 20070730, update to version 3.5.1 20070730 or later to resolve the issue. As a temporary workaround, consider restricting access to the local file where the username and password are stored to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2007-4526

Produtos afetados

Novell Identity Manager

Referências · 8

• https://secure-support.novell.com/KanisaPlatform/Publishing/177/3329402_f.SAL_Public.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36215 · Nota
• http://securityfocus.com/bid/25420 · Nota
• http://securitytracker.com/id?1018602 · Nota
• http://osvdb.org/37320 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4526 · Nota de Segurança
• http://secunia.com/advisories/26555 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2957 · Nota