Secunia

Eitan Caspi has reported a weakness in Novell Client, which can be exploited by malicious people to disclose potentially sensitive information and to manipulate certain information.

The weakness is cause due to the Login dialog box of the Novell client failing to restrict access to the contents of the clipboard when the system is "locked". This can be exploited to disclose the text contents of the current user's clipboard by pasting it into the "User Name" field, or to change the clipboard's content by performing a copy from the "User Name" field.

Successful exploitation requires access to the affected system.

The weakness has been reported in Novell Client for Windows versions 4.8 and 4.9. Other versions may also be affected.

Solution
Apply updated login modules (see vendor's advisory for more information).

Provided and/or discovered by
Eitan Caspi

Changelog
Further details available in Customer Area

Original Advisory
Novell:
https://secure-support.novell.com/KanisaPlatform/Publishing/227/2797_f.SAL_Public.html

Deep Links
Links available in Customer Area