Vulnerability Name:

CVE-2008-0663 (CCN-40287)

Assigned:2008-02-04
Published:2008-02-04
Updated:2011-03-08
Summary:Novell Challenge Response Client (LCM) 2.7.5 and earlier, as used with Novell Client for Windows 4.91 SP4, allows users with physical access to a locked system to obtain contents of the clipboard by pasting the contents into the Challenge Question field.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2008-0663

Source: CCN
Type: SA28792
Novell Client Challenge Response Client Clipboard Disclosure Weakness

Source: SECUNIA
Type: Vendor Advisory
28792

Source: CCN
Type: SECTRACK ID: 1019304
Novell Modular Authentication Service Challenge Response Client Discloses Clipboard Contents to Local Users

Source: CCN
Type: OSVDB ID: 41151
Novell Client Challenge Response Client Challenge Question Field Clipboard Content Disclosure

Source: BID
Type: UNKNOWN
27631

Source: CCN
Type: BID-27631
Novell Challenge Response Client Local Clipboard Disclosure Weakness

Source: SECTRACK
Type: UNKNOWN
1019304

Source: VUPEN
Type: UNKNOWN
ADV-2008-0423

Source: XF
Type: UNKNOWN
novell-challenge-response-info-disclosure(40287)

Source: CCN
Type: Novell Security Alert Document ID: 3726376
Challenge Response Client (LCM) allows clipboard contents to be pasted into question response fields when workstation is locked

Source: CONFIRM
Type: UNKNOWN
https://secure-support.novell.com/KanisaPlatform/Publishing/686/3726376_f.SAL_Public.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:novell:challenge_response_client:*:*:*:*:*:*:*:* (Version <= 2.7.5)
  • OR cpe:/a:novell:novell_client_for_windows:4.91_sp4:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:novell:client:4.91:sp4:*:*:*:*:*:*
  • OR cpe:/a:novell:challenge_response_client:2.7.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    novell challenge response client *
    novell novell client for windows 4.91_sp4
    novell client 4.91 sp4
    novell challenge response client 2.7.5