PT-2007-1593 · Microsoft+2 · Terminal Service+2

Published 2007-01-09 · Updated 2017-07-29 · CVE-2007-0108

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Novell Client version 4.91 SP3

Description The issue concerns the nwgina.dll component in Novell Client, which fails to delete user profiles during a Terminal Service or Citrix session. This allows remote authenticated users to invoke alternate user profiles.

Recommendations For Novell Client version 4.91 SP3, consider disabling the nwgina.dll component as a temporary workaround until a patch is available. Restrict access to Terminal Service or Citrix sessions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0108

Affected Products

Citrix

Novell Client

Terminal Service

References · 8

• http://secunia.com/advisories/23619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0108 · Security Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm · Vendor Advisory
• http://vupen.com/english/advisories/2007/0064 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31343 · Note
• http://securitytracker.com/id?1017471 · Note
• http://osvdb.org/31358 · Note
• http://securityfocus.com/bid/21886 · Note