--------------------------------------------
Novell GroupWise Plain Text Password
Vulnerability.
--------------------------------------------
Overview:
A Vulnerability exsists in the Novell GroupWise Client that will allow an attacker to identify the id and password of the users GroupWise email account.
A Vulnerability exsists in the Novell GroupWise Client that will allow an attacker to identify the id and password of the users GroupWise email account.
I. Technical Description:
The username and password can be dumped out of memory for the process grpWise.exe while GroupWise is running. Using a tool such a pmdump to dump the memory of the process the username and password are clearly visible in plain text. This can be exploited remotely as well, by using pmdump with something like psexe form Sysinternals
The username and password can be dumped out of memory for the process grpWise.exe while GroupWise is running. Using a tool such a pmdump to dump the memory of the process the username and password are clearly visible in plain text. This can be exploited remotely as well, by using pmdump with something like psexe form Sysinternals
II. Impact:
A GroupWise user could have someone accessing their email, they would never even know it.
A GroupWise user could have someone accessing their email, they would never even know it.
III. Affected Products:
Novell GroupWise Windows Client
Novell GroupWise Windows Client
IV. Tested Vulnerable
versions:
6.5.2 & 6.0 and 5.5
6.5.2 & 6.0 and 5.5
V. Solution:
Still waiting….
Still waiting….
V. Vendor timeline:
3/30/2005 – Contacted Vendor.
4/11/2005 –Vendor duplicated problem.
5/11/2005 –Vendor released a patch.
5/17/2005 – Contacted Vendor and told them the patch did not work.
5/20/2005 - Vendor agreed patch does not fix the problem.
6/20/2005 – Have not heard from vendor in 1 Month, so releasing this information.
3/30/2005 – Contacted Vendor.
4/11/2005 –Vendor duplicated problem.
5/11/2005 –Vendor released a patch.
5/17/2005 – Contacted Vendor and told them the patch did not work.
5/20/2005 - Vendor agreed patch does not fix the problem.
6/20/2005 – Have not heard from vendor in 1 Month, so releasing this information.
VI: Credits:
The vulnerability was discovered by the Securityteam AT truedson.com.
The vulnerability was discovered by the Securityteam AT truedson.com.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/