PT-2007-5697 · Novell · Novell Identity Manager

Published 2007-08-25 · Updated 2018-09-27 · CVE-2007-4526

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Novell Identity Manager versions prior to 3.5.1 20070730

Description The issue allows local users to obtain sensitive information, specifically usernames and passwords, by reading a local file where this data is stored. This is due to the way the Client Login Extension (CLE) handles storage of this sensitive information.

Recommendations For versions prior to 3.5.1 20070730, update to version 3.5.1 20070730 or later to resolve the issue. As a temporary workaround, consider restricting access to the local file where the username and password are stored to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-4526

Affected Products

Novell Identity Manager

References · 8

• https://secure-support.novell.com/KanisaPlatform/Publishing/177/3329402_f.SAL_Public.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-4526 · Security Note
• http://secunia.com/advisories/26555 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36215 · Note
• http://securityfocus.com/bid/25420 · Note
• http://securitytracker.com/id?1018602 · Note
• http://osvdb.org/37320 · Note
• http://vupen.com/english/advisories/2007/2957 · Note