PT-2006-2037 · Novell · Novell Open Enterprise Server+2

Published 2006-03-23 · Updated 2020-02-24 · CVE-2006-0999

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell NetWare version 6.5 Novell Open Enterprise Server (OES)

Description The issue allows a client to force the server to use weak encryption, potentially enabling remote attackers to decrypt contents of an SSL protected session. This occurs when a client claims that a weak cipher is necessary for compatibility.

Recommendations For Novell NetWare version 6.5, consider disabling the SSL server implementation in NILE.NLM until a fix is available. For Novell Open Enterprise Server (OES), restrict the use of weak ciphers in the SSL server configuration to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0999

Affected Products

Nile.Nlm

Novell Netware

Novell Open Enterprise Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-0999 · Security Note
• http://securityfocus.com/bid/17176 · Note
• http://securityfocus.com/bid/64758 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25382 · Note
• http://osvdb.org/24048 · Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm · Note
• http://oracle.com/technetwork/topics/security/cpujan2014-1972949.html · Note
• http://vupen.com/english/advisories/2006/1043 · Note
• http://securitytracker.com/id?1015799 · Note
• http://secunia.com/advisories/19324 · Note