PT-2006-6933 · Novell · Novell Client+1

Deral Heiland · Published 2006-12-05 · Updated 2018-10-17 · CVE-2006-6306

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell Client versions 4.91 SP2 through 4.91 SP3

Description A format string issue in the Novell Modular Authentication Services (NMAS) component allows users with physical access to read stack and memory contents. This is achieved by using format string specifiers in the Username field of the logon window.

Recommendations For Novell Client versions 4.91 SP2 and 4.91 SP3, consider restricting access to the logon window to minimize the risk of exploitation. Avoid using format string specifiers in the Username field until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-6306

Affected Products

Novell Client

Novell Modular Authentication Service

References · 12

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051038.html · Vendor Advisory
• http://layereddefense.com/Novell01DEC.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6306 · Security Note
• http://vupen.com/english/advisories/2006/4987 · Note
• http://secunia.com/advisories/23363 · Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974872.htm · Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974876.htm · Note
• http://securitytracker.com/id?1017377 · Note
• https://secure-support.novell.com/KanisaPlatform/Publishing/372/3546910_f.SAL_Public.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30644 · Note
• http://securityreason.com/securityalert/1970 · Note
• http://securityfocus.com/archive/1/453176/100/0/threaded · Note