Novell iChain Multiple Remote Vulnerabilities
BID:11061
Info
Novell iChain Multiple Remote Vulnerabilities
| Bugtraq ID: | 11061 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 27 2004 12:00AM |
| Updated: | Aug 27 2004 12:00AM |
| Credit: | The individual or individuals responsible for discovery of these issues are currently unknown; the vendor disclosed this issue. |
| Vulnerable: |
Novell iChain Server 2.3 |
| Not Vulnerable: | |
Discussion
Novell iChain Multiple Remote Vulnerabilities
Novell iChain has been reported prone to multiple unspecified remote vulnerabilities.
The first issue reported is an access control bypass issue surrounding the processing of UTF-8 encoded strings.
The second issue surrounds the manipulation of login credentials through a cross-site scripting vulnerability.
The third issue is a denial of service vulnerability triggered when a malicious URL request is made against the server.
A fourth issue surrounds an information disclosure vulnerability in the VIA header.
The fifth issue surrounds the insecure transmission of password and username credentials.
These issue might allow an attacker to carry out denial of service attacks against the affected computer, gain unauthorized access to the affected software, manipulate login credentials of unsuspecting users, disclose sensitive iChain configuration information, and steal authentication credentials transmitted insecurely over public networks.
It should be noted that these issues reportedly affected iChain version 2.3, however it is likely that other versions are affected as well.
Novell iChain has been reported prone to multiple unspecified remote vulnerabilities.
The first issue reported is an access control bypass issue surrounding the processing of UTF-8 encoded strings.
The second issue surrounds the manipulation of login credentials through a cross-site scripting vulnerability.
The third issue is a denial of service vulnerability triggered when a malicious URL request is made against the server.
A fourth issue surrounds an information disclosure vulnerability in the VIA header.
The fifth issue surrounds the insecure transmission of password and username credentials.
These issue might allow an attacker to carry out denial of service attacks against the affected computer, gain unauthorized access to the affected software, manipulate login credentials of unsuspecting users, disclose sensitive iChain configuration information, and steal authentication credentials transmitted insecurely over public networks.
It should be noted that these issues reportedly affected iChain version 2.3, however it is likely that other versions are affected as well.
Exploit / POC
Novell iChain Multiple Remote Vulnerabilities
No exploit is required to leverage these vulnerabilities.
No exploit is required to leverage these vulnerabilities.
Solution / Fix
Novell iChain Multiple Remote Vulnerabilities
Solution:
Novell has released a Technical Information Document (TID2969833) along with a support pack dealing with these issues:
Novell iChain Server 2.3
Solution:
Novell has released a Technical Information Document (TID2969833) along with a support pack dealing with these issues:
Novell iChain Server 2.3
-
Novell iChain 2.3 Support Pack 1
http://support.novell.com/servlet/filedownload/sec/pub/ic23sp1.exe
References
Novell iChain Multiple Remote Vulnerabilities
References:
References:
- iChain 2.3 Support Pack 1 - TID2969833 (Novell)
- iChain Homepage (Novell)