bugtraq - NOVL-2003-10085583 GroupWise (Wireless) WebAccess 6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 01 Aug 2003 13:56:03 -0600
From: "Ed Reed" <ereed@...ell.com>
To: "Secure Secure" <Secure@...ell.com>
Subject: NOVL-2003-10085583 GroupWise (Wireless) WebAccess 6_5 Log Info
	Leak

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

For Immediate Disclosure

============================== Summary ==============================

 Security Alert: NOVL-2003-10085583
          Title: GroupWise (Wireless) WebAccess 6.5 Log Info Leak
           Date: 31-Jul-2003
       Revision: Original
   Product Name: GroupWise 6.5 WebAccess (Wireless)
 OS/Platform(s): N/A
  Reference URL: http://support.novell.com/servlet/tidfinder/10085583 
    Vendor Name: Novell, Inc. 
     Vendor URL: http://www.novell.com 
Security Alerts: http://support.novell.com/security-alerts 
        Affects: Various
    Identifiers: None
        Credits: Adam Gray, Novacoast, Inc. <agray@...acoast.com>

============================ Description ============================

When wireless phone users login to GroupWise WebAccess the userid and
password are recorded in the webserver's access_log file.  

============================== Impact ===============================

When wireless phone users login to GroupWise WebAccess the userid and
password are recorded in the webserver's access_log file.  

The access_log is located //server/sys/apache/logs/access_log  

It is not a problem for FRAMES or SIMPLE templates.  

GroupWise Webaccess users using their desktop or laptop computers do 
NOT have this problem. 

Only happens with WML & HDML. 

Only happens when using Wireless Phones. 

======================== Recommended Actions ========================

Workaround for webserver logging, until GW 6.5 SP1 can be applied:

This can be configured through the LogFormat and CustomLog directives
in the HTTPD.conf file.  Turning off the access_log is done by 
commenting out the CustomLog directive that defines it.  Altering the
content of the access log is done by changing the LogFormat directive
that corresponds to the access_log's CustomLog entry.  Both of these 
directives are documented at http://httpd.apache.org/docs- 
2.0/mod/mod_log_config.html 

    LogFormat "%h %l %u %t \"%r\" %>s %b" common 
    CustomLog logs/access_log common

Long-term fix:  Apply GroupWise WebAccess 6.5 SP1

See detailed instructions in the referenced Technical Information 
Document (TID) http://support.novell.com/servlet/tidfinder/10085583 

============================ DISCLAIMER =============================

The content of this document is believed to be accurate at the time 
of publishing based on currently available information. However, the 
information is provided "AS IS" without any warranty or 
representation. Your use of the document constitutes acceptance of 
this disclaimer. Novell disclaims all warranties, express or implied,
regarding this document, including the warranties of merchantability 
and fitness for a particular purpose. Novell is not liable for any 
direct, indirect, or consequential loss or damage arising from use 
of, or reliance on, this document or any security alert, even if 
Novell has been advised of the possibility of such damages and even 
if such damages are foreseeable.

============================ Appendices =============================

None

================ Contacting Novell Security Alerts ==================

To report suspected security vulnerabilities in Novell products, send
email to
            secure@...ell.com 

or use the web form at our website

            http://support.novell.com/security-alerts 

PGP users may send signed/encrypted information to us using our PGP 
key, available from the pgpkeys.mit.edu server, or our website.

Users wishing to be notified when Novell Security Alerts are issued 
may register their email address at

            http://www.novell.com/info/list/ 

Security Alerts, Novell, Inc. PGP Key Fingerprint:

F5AE 9265 0A34 F84E 580E  9B87 3AC1 1974 DE05 0FDB

========================= Revision History ==========================
       Original: 31-Jul-2003 - Original Publication

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3

iQA/AwUBPyrFEDrBGXTeBQ/bEQKVCACgsoAl5fUFrbBnfManb/FaOLnjKXEAoJtA
BbtTaoCQJAVrbPuBMAN7h0xj
=/vNN
-----END PGP SIGNATURE-----