bugtraq - Novell GroupWise Plain Text Password Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000f01c575a9$5716c500$0611a8c0@truedson.com>
Date: Mon, 20 Jun 2005 11:04:22 -0400
From: "Security Team" <securityteam@...edson.com>
To: <bugtraq@...urityfocus.com>
Subject: Novell GroupWise Plain Text Password Vulnerability.

--------------------------------------------
Novell GroupWise Plain Text Password Vulnerability.
--------------------------------------------

Overview:
A Vulnerability exsists in the Novell GroupWise Client that will allow an 
attacker to identify the id and password of the users GroupWise email 
account.

I. Technical Description:
The username and password can be dumped out of memory for the process 
grpWise.exe while GroupWise is running.  Using a tool such a pmdump to dump 
the memory of the process the username and password are clearly visible in 
plain text. This can be exploited remotely as well, by using pmdump with 
something like psexe form Sysinternals

II. Impact:
A GroupWise user could have someone accessing their email, they would never 
even know it.

III. Affected Products:
Novell GroupWise Windows Client

IV. Tested Vulnerable versions:
 6.5.2 & 6.0 and 5.5

V. Solution:
Still waiting..

V. Vendor timeline:
3/30/2005 - Contacted Vendor.
4/11/2005 -Vendor duplicated problem.
5/11/2005 -Vendor released a patch.
5/17/2005 - Contacted Vendor and told them the patch did not work.
5/20/2005  - Vendor agreed patch does not fix the problem.
6/20/2005 - Have not heard from vendor in 1 Month, so releasing this 
information.

VI: Credits:
The vulnerability was discovered by the Securityteam AT truedson.com.