Novell iChain Session Inheritance Vulnerability

Bugtraq ID:	8369
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2003 12:00AM
Updated:	Aug 07 2003 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	Novell iChain Server 2.2 FP1a Novell iChain Server 2.2 FP1 Novell iChain Server 2.2
Not Vulnerable:

Novell iChain Session Inheritance Vulnerability

Novell has announced an issue in iChain that may permit a user to inherit another user's session. This may reportedly occur in circumstances where a new user's session is opened on the same port as another user.

Novell iChain Session Inheritance Vulnerability

There is no exploit required.

Novell iChain Session Inheritance Vulnerability

Solution:
This issue has been addressed in iChain 2.2 Field Patch 2. Please refer to the Novell TID2966683 for further information about caveats associated with this fix and for additional instructions on how to apply the fix.

Novell has released iChain Support Pack 2 Beta 2 to address this issue. Please see TID-2967231 for more information regarding this release.


Novell iChain Server 2.2

• Novell b2ic22sp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/b2ic22sp2.exe


• Novell ic22fp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/ic22fp2.exe

Novell iChain Server 2.2 FP1a

• Novell b2ic22sp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/b2ic22sp2.exe


• Novell ic22fp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/ic22fp2.exe

Novell iChain Server 2.2 FP1

• Novell b2ic22sp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/b2ic22sp2.exe


• Novell ic22fp2.exe
  http://support.novell.com/servlet/filedownload/sec/ftf/ic22fp2.exe

Novell iChain Session Inheritance Vulnerability

References:

• iChain 2.2 Field Patch 2 - TID2966683 (Novell)
  
• iChain 2.2 Support Pack 2 beta - TID2967231 (Novell)
  
• New user getting a previous user's session. - TID10085711 (Novell)