CERT-In Vulnerability Note
CIVN-2003-0010
Novell iChain Session Inheritance Vulnerability
Original Issue Date:October 28, 2003
Severity Rating: HIGH
Systems Affected
Novell iChain Server 2.2 FP1a Novell iChain Server 2.2 FP1 Novell iChain Server 2.2
Overview
A vulnerability has been identified in iChain that may permit a user to inherit another user's session. This may occur in circumstances where a new user's session is opened on the same port as another user.
Impact
New iChain user getting a previous user's session
Description
A key component of the Novell Nsure secure identity management solution, iChain controls access to application, web and network resources across all boundaries. As iChain is built upon Novell eDirectory, access control lists ACLs are used to provide a reliable security foundation. In addition to ACLs, iChain enhances network security by supporting several types of authentication methods, including smart card, username/password and token authentication.
A vulnerability has been identified in iChain, which can be exploited by an attacker to inherit another users session. A condition in the code exist that allows a new user access if they come in on the same port as a current user. This condition is usually triggered when Persistent Connection to Browser is enabled on iChain and both users are coming through the same PROXY server.
Workaround
Disable Persistent Connections to Browsers in the iChain Admin Utility under the "Tuning" tab.
Solution
Apply Patch Apply appropriate patch given below - iChain Server 2.2 FP1a:
iChain Server 2.2 FP1:
iChain Server 2.2:
Upgrade ic22fp2.exe
http://support.novell.com/servlet/filedownload/sec/ftf/ic22fp2.exe
Vendor has released iChain Support Pack 2 Beta 2 to address this issue, refer TID2967231 for further information.
Vendor Information
Novell Refer Novell Technical Information Document. - iChain - TID10085711
References
SecurityFocus Vulnerability Description
http://www.securityfocus.com/bid/8369
Novell Technical Information Document - iChain - TID10085711
http://support.novell.com/cgi-bin/search/searchtid.cgi?/10086051.htm
iChain 2.2 Field Patch 2 - TID2966683
http://support.novell.com/cgi-bin/search/searchtid.cgi?/2966683.htm
iChain 2.2 Support Pack 2 beta - TID2967231
http://support.novell.com/cgi-bin/search/searchtid.cgi?/2967231.htm
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|