CVE-2005-0744

The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by 1 sniffing the connection on TCP port 51100 and replaying the authentication information or 2 obtaining and replaying the PCZQX02 authentication cookie from the browser...

CVE-2005-0746

The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the server via the PWD command...

CVE-2005-0797

The CVE-2005-0797 entry concerns Novell iChain Mini FTP Server 2.3, where authentication error handling reveals whether a user exists. This information disclosure can facilitate brute-force attempts, since attackers can iterate valid usernames more efficiently. The available sources confirm the a...

CVE-2005-0798

The CVE-2005-0798 entry concerns Novell iChain Mini FTP Server 2.3 (and possibly earlier versions) failing to limit incorrect login attempts, enabling brute-force login attacks over the network. The underlying issue is insufficient authentication attempt throttling on the FTP service, allowing re...

CVE-2005-0798

Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks...

CVE-2005-0797

Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2005-0798: Undefined Security Weakness

Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks...

CVE-2005-0797: Exposure of Sensitive Information to an Unauthorized Actor

Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

[ISR] - Novell iChain Mini FTP Server Unauthorized Remote Path Disclosure Vulnerability

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Mini FTP Server Unauthorized Remote Path Disclosure Vulnerability Version: IChain Version v2.3, It is suspected that all previous versions of IChan are vulnerable. .:: BACKGROUND The Novell...

[ISR] - Novell iChain Mini FTP Server Bruteforce Problem

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Mini FTP Server Bruteforce Problem .:: BACKGROUND The Novell iChain product provides identity-based web security services that control access to application and network resources across...

[ISR] Insecure communication and Reproduce the Session authentication

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Administration HTTP Server: - Insecure communication - Reproduce the Session authentication Version: IChain Version v2.3, It is suspected that all previous versions of IChan are vulnerable. ....

Novell iChain access control solution multiple bugs

DoS, information leak including authentication data, crossite scripting, session hijacking...

[ISR] - Novell iChain Mini FTP Server Valid User Disclosure Vulnerability

|| || ISR || Infobyte Security Research || www.infobyte.com.ar || 03.15.2005 || .:: SUMMARY Novell iChain Mini FTP Server Valid User Disclosure Vulnerability Version: IChain Version v2.3, It is suspected that all previous versions of IChan are vulnerable. .:: BACKGROUND The Novell iChain product...

CVE-2005-0798

Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks...

CVE-2005-0797

Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2005-0744

The CVE-2005-0744 issue affects the web GUI of Novell iChain versions 2.2 and 2.3 SP2/SP3. The underlying risk is session hijacking leading to administrator privileges via two methods: (1) sniffing the connection on TCP port 51100 and replaying authentication data, and (2) obtaining and replaying...

CVE-2005-0746

CVE-2005-0746 affects the Mini FTP server component of Novell iChain 2.2 and 2.3 SP2 and earlier, where remote unauthenticated attackers can obtain the full server path by issuing the PWD command. The available connected documents confirm the vulnerability description and affected versions, but d...

CVE-2005-0744

The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by 1 sniffing the connection on TCP port 51100 and replaying the authentication information or 2 obtaining and replaying the PCZQX02 authentication cookie from the browser...

CVE-2005-0746

The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the server via the PWD command...

CVE-2005-0744: Undefined Security Weakness

The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by 1 sniffing the connection on TCP port 51100 and replaying the authentication information or 2 obtaining and replaying the PCZQX02 authentication cookie from the browser...