----------------------------------------------------------------------

Secunia Network Software Inspector 2.0 (NSI) - Public Beta

The Public Beta has ended. Thanks to all that participated.

Learn more:
http://secunia.com/network_software_inspector_2/

----------------------------------------------------------------------

TITLE:
Novell Client Login Long Username/Context Buffer Overflow

SECUNIA ADVISORY ID:
SA30126

VERIFY ADVISORY:
http://secunia.com/advisories/30126/

CRITICAL:
Less critical

IMPACT:
DoS, System access

WHERE:
Local system

SOFTWARE:
Novell Client for Windows NT/2000/XP 4.x
http://secunia.com/product/1516/

DESCRIPTION:
laurent gaffié has discovered a vulnerability in Novell Client, which
can be exploited by malicious people with physical access to cause a
DoS (Denial of Service) or compromise a vulnerable system.

The vulnerability is caused due to a boundary error within
LOGINW32.DLL when processing usernames and eDirectory "Context"
strings in the Novell Client login window. This can be exploited to
cause a stack-based buffer overflow by entering an overly-long
username and eDirectory "Context" strings, clicking on the "Did you
forget your password?" link, and clicking "Ok".

Successful exploitation allows execution of arbitrary code in context
of the winlogon.exe process when e.g. the workstation is locked or no
user is currently logged in.

The vulnerability is confirmed in version 4.91 SP4 and including
LOGINW32.DLL version 4.19.6.0. Other versions may also be affected.

SOLUTION:
Grant only trusted users access to affected systems.

PROVIDED AND/OR DISCOVERED BY:
laurent gaffié

ORIGINAL ADVISORY:
http://archives.neohapsis.com/archives/bugtraq/2008-05/0109.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------