Design/Logic Flaw

2006-03-2311:06:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.01 Low

EPSS

Percentile

83.4%

JSON

The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) permits encryption with a NULL key, which results in cleartext communication that allows remote attackers to read an SSL protected session by sniffing network traffic.

CPENameOperatorVersion
netwareeq6.5 sp3
netwareeq6.5 sp1
netwareeq6.5 sp2
netwareeq6.5 sp1.1a
netwareeq6.5 sp4
netwareeq6.5 sp1.1b
netwareeq6.5

Name	Operator	Version
netware	eq	6.5 sp3
netware	eq	6.5 sp1
netware	eq	6.5 sp2
netware	eq	6.5 sp1.1a
netware	eq	6.5 sp4
netware	eq	6.5 sp1.1b
netware	eq	6.5

References

secunia.com/advisories/19324

securitytracker.com/id?1015799

support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm

www.osvdb.org/24046

www.securityfocus.com/bid/17176

www.vupen.com/english/advisories/2006/1043

exchange.xforce.ibmcloud.com/vulnerabilities/25380