CVE-2007-3200

NMASINST in Novell Modular Authentication Service (NMAS) 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file.

CVSS v2.0 4.9 MEDIUM

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/35943
http://secunia.com/advisories/25592	Vendor Advisory
http://securitytracker.com/id?1018215
http://www.securityfocus.com/bid/24405
http://www.vupen.com/english/advisories/2007/2118
https://exchange.xforce.ibmcloud.com/vulnerabilities/34806
https://secure-support.novell.com/KanisaPlatform/Publishing/249/3260550_f.SAL_Public.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:novell:modular_authentication_service:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-06-12 23:30

Updated : 2017-07-29 01:32

NVD link : CVE-2007-3200

Mitre link : CVE-2007-3200

CVE.ORG link : CVE-2007-3200

JSON object : View

Products Affected

novell

modular_authentication_service

CWE

NVD-CWE-Other

{"id": "CVE-2007-3200", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-06-12T23:30:00.000", "references": [{"url": "http://osvdb.org/35943", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/25592", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1018215", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/24405", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/2118", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34806", "source": "cve@mitre.org"}, {"url": "https://secure-support.novell.com/KanisaPlatform/Publishing/249/3260550_f.SAL_Public.html", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "NMASINST in Novell Modular Authentication Service (NMAS) 3.1.2 and earlier on NetWare logs its invoking command line to NMASINST.LOG, which might allow local users to obtain the admin username and password by reading this file."}, {"lang": "es", "value": "NMASINST en Novell Modular Authentication Service (NMAS) 3.1.2 y anteriores en NetWare registra el comando que lo invoca en NMASINST.LOG, lo cual puede permitir a usuarios locales obtener el nombre de usuario y la contrase\u00f1a del administrador leyendo este fichero."}], "lastModified": "2017-07-29T01:32:02.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:novell:modular_authentication_service:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FAD831F-024A-4762-BA06-8CCFAE6B4510", "versionEndIncluding": "3.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}