[ISR] - Novell iChain Mini FTP Server Bruteforce Problem

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Mini FTP Server Bruteforce Problem .:: BACKGROUND The Novell iChain product provides identity-based web security services that control access to application and network resources across...

[ISR] Insecure communication and Reproduce the Session authentication

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Administration HTTP Server: - Insecure communication - Reproduce the Session authentication Version: IChain Version v2.3, It is suspected that all previous versions of IChan are vulnerable. ....

[ISR] - Novell iChain Mini FTP Server Valid User Disclosure Vulnerability

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Mini FTP Server Valid User Disclosure Vulnerability Version: IChain Version v2.3, It is suspected that all previous versions of IChan are vulnerable. .:: BACKGROUND The Novell iChain product...

CVE-2005-0797

Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2005-0798

Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks...

CVE-2005-0744

The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by 1 sniffing the connection on TCP port 51100 and replaying the authentication information or 2 obtaining and replaying the PCZQX02 authentication cookie from the browser...

CVE-2005-0746

CVE-2005-0746 affects the Mini FTP server component of Novell iChain 2.2 and 2.3 SP2 and earlier, where remote unauthenticated attackers can obtain the full server path by issuing the PWD command. The available connected documents confirm the vulnerability description and affected versions, but d...

CVE-2005-0744

The CVE-2005-0744 issue affects the web GUI of Novell iChain versions 2.2 and 2.3 SP2/SP3. The underlying risk is session hijacking leading to administrator privileges via two methods: (1) sniffing the connection on TCP port 51100 and replaying authentication data, and (2) obtaining and replaying...

CVE-2005-0746

The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the server via the PWD command...

[SA14527] Novell iChain Administrator Session Hijacking Vulnerability

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

[SA14537] Novell iChain FTP Server Path Disclosure Weakness

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

[SA14010] iChain Mutual Authentication Unauthorised Resource Access

TITLE: iChain Mutual Authentication Unauthorised Resource Access SECUNIA ADVISORY ID: SA14010 VERIFY ADVISORY: http://secunia.com/advisories/14010/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network SOFTWARE: Novell iChain 2.x http://secunia.com/product/1423/ DESCRIPTION: A...

CVE-2004-2314

The Telnet listener for Novell iChain Server before 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote attackers to gain access...

CVE-2004-2580

Cross-site scripting XSS vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors...

CVE-2004-2582

Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sensitive information...

CVE-2004-2581

Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."...

CVE-2004-2757

Cross-site scripting XSS vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship FCS allows remote attackers to inject arbitrary web script or HTML via url parameter...

CVE-2004-2579

ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."...

[SA12366] iChain Multiple Vulnerabilities

TITLE: iChain Multiple Vulnerabilities SECUNIA ADVISORY ID: SA12366 VERIFY ADVISORY: http://secunia.com/advisories/12366/ CRITICAL: Moderately critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of system information, DoS WHERE: From remote SOFTWARE: Novell iChain 2.x...

CVE-2003-0637

Novell iChain 2.2 before Support Pack 1 uses a shorter timeout for a non-existent user than a valid user, which makes it easier for remote attackers to guess usernames and conduct brute force password guessing...