BID:27631

Novell Challenge Response Client Local Clipboard Disclosure Weakness

Info

Novell Challenge Response Client Local Clipboard Disclosure Weakness

Bugtraq ID:	27631
Class:	Design Error
CVE:	CVE-2008-0663
Remote:	No
Local:	Yes
Published:	Feb 05 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Novell Modular Authentication Service (NMAS) 3.1.3 Novell Modular Authentication Service (NMAS) 3.1.2 Novell Client 4.83 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Novell Client 4.81 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 Novell Client 4.9 Novell Client 3.4 Novell Client 3.1 Novell Client 3.0.1 Novell Client 3.0 Novell Client 4.91 SP4 Novell Client 4.91 SP3 Novell Client 4.91 SP2 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Novell Client 4.91 SP1a Novell Client 4.91 SP1 Novell Client 4.91 Novell Client 4.90 SP2 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Novell Client 4.83 SP3 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Novell Challenge Response Client (LCM) 2.7.5 Novell Challenge Response Client (LCM) 0

Not Vulnerable:	Novell Challenge Response Client (LCM) 2.7.6

Discussion

Novell Challenge Response Client Local Clipboard Disclosure Weakness

Novell Challenge Response Client is prone to a local information-disclosure weakness because the software fails to properly restrict access to potentially sensitive information.

Successful exploits may allow attackers with physical access to affected computers to obtain the contents of the clipboard, even while the computer is in a locked state. Information harvested may aid in further attacks.

Exploit / POC

Novell Challenge Response Client Local Clipboard Disclosure Weakness

To exploit this issue, attackers must have physical access to affected computers.

Solution / Fix

Novell Challenge Response Client Local Clipboard Disclosure Weakness

Solution:
The vendor released an advisory and fixes to address this issue. Please see the references for more information.

References

Novell Challenge Response Client Local Clipboard Disclosure Weakness

References:

Novell Homepage (Novell)
Challenge Response Client (LCM) allows clipboard contents to be pasted into ques (Novell)