Novell GroupWise Plain Text Password Vulnerability.

From: Security Team (securityteam_at_truedson.com)
Date: 06/20/05

  • Next message: Hat-Squad Security Team: "[Hat-Squad] i-Gallery directory traversal" 
    To: <bugtraq@securityfocus.com>
Date: Mon, 20 Jun 2005 11:04:22 -0400

    --------------------------------------------
    Novell GroupWise Plain Text Password Vulnerability.
    --------------------------------------------

    Overview:
    A Vulnerability exsists in the Novell GroupWise Client that will allow an
    attacker to identify the id and password of the users GroupWise email
    account.

    I. Technical Description:
    The username and password can be dumped out of memory for the process
    grpWise.exe while GroupWise is running. Using a tool such a pmdump to dump
    the memory of the process the username and password are clearly visible in
    plain text. This can be exploited remotely as well, by using pmdump with
    something like psexe form Sysinternals

    II. Impact:
    A GroupWise user could have someone accessing their email, they would never
    even know it.

    III. Affected Products:
    Novell GroupWise Windows Client

    IV. Tested Vulnerable versions:
     6.5.2 & 6.0 and 5.5

    V. Solution:
    Still waiting..

    V. Vendor timeline:
    3/30/2005 - Contacted Vendor.
    4/11/2005 -Vendor duplicated problem.
    5/11/2005 -Vendor released a patch.
    5/17/2005 - Contacted Vendor and told them the patch did not work.
    5/20/2005 - Vendor agreed patch does not fix the problem.
    6/20/2005 - Have not heard from vendor in 1 Month, so releasing this
    information.

    VI: Credits:
    The vulnerability was discovered by the Securityteam AT truedson.com.

  • Next message: Hat-Squad Security Team: "[Hat-Squad] i-Gallery directory traversal"

    Relevant Pages