-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0001                  AUSCERT Advisory

                                   [Win]
              Novell Client patches fix four vulnerabilities
                              8 January 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Novell Client 4.91 SP3 and prior
Operating System:     Windows
Impact:               Administrator Compromise
                      Inappropriate Access
                      Access Privileged Data
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-5854 CVE-2006-6306 CVE-2006-6114
Member content until: Monday, February 05 2007

Ref:                  AL-2006.0114


OVERVIEW:

	Novell Client versions up to and including 4.91 SP3 contain four 
	vulnerabilities. Patches for these are now available from Novell.


IMPACT:

	1. As reported in AL-2006.0114, a remote attacker can potentially 
	   compromise the client computer, executing arbitrary code via an 
	   RPC to the Spooler service. [1][2]

	2. A local unauthenticated attacker can read arbitrary memory from
	   the winlogon process. A proof of concept exploit has demonstrated 
	   stealing RSA private keys. [3][4]

	3. Where Terminal Services or Citrix is used, an authenticated user 
	   may be able to login using another user's profile. [5][6]
	
	4. A local user may gain Administrator access. [7]


MITIGATION:

	Fixed versions of the four affected Novell Client components have
	been released and are available at:
	http://support.novell.com/filefinder/security/index.html


DETAILS:

	1. The Spooler service is vulnerable to remote buffer overflow via RPC 
	   to the OpenPrinter() and EnumPrinters() functions in nwspool.dll, 
	   potentially allowing execution of arbitrary code. This issue is
	   described in AusCERT Alert AL-2006.0114.

	2. A format string vulnerability in the processing of the username input
	   in the Novell Client allows a local attacker to read arbitrary memory. 

	3. nwgina.dll does not correctly delete user profiles in a Terminal
	   Server or Citrix session.

	4. Novell states that the Novell Client exposes the Windows 
	   AutoAdminLogon password in the registry.


REFERENCES:

	1. Novell TID 3125538
	   https://secure-support.novell.com/KanisaPlatform/Publishing/583/3125538_f.SAL_Public.html

	2. AusCERT Alert AL-2006.0114
	   http://www.auscert.org.au/7027

	3. LayeredDefense advisory
	   http://www.layereddefense.com/Novell01DEC.html

	4. Novell TID 3546910
	   https://secure-support.novell.com/KanisaPlatform/Publishing/372/3546910_f.SAL_Public.html

	5. Secunia advisory
	   http://secunia.com/advisories/23619/

	6. Novell TID 2974970
	   http://support.novell.com/cgi-bin/search/searchtid.cgi?2974970.htm

	7. Novell TID 2974872
	   http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974872.htm


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRaHtJyh9+71yA2DNAQJPcgP/eFst7nUS5HZJvTdUTC7YU5zifYYp0cyH
o1XPswELiz9VC3x7JgNl/7Q/s10n4SNdh47cL91YydnUDGkx3PNOGnhtrNq+LpMp
Hcg13MaLA8yDJ21e1wMYjOpEqkMf9mGvvtUdR4xfG3q12jwcTRMS8ppLuBL83iAE
2ZSULpkrdWc=
=tjzF
-----END PGP SIGNATURE-----