Actu
Vigil@nce: Novell iPrint client, exposure of sensitive information
August 2008 by Vigil@nce
SYNTHESIS
A local attacker can use the ’GetFileList()" ActiveX control to
retrieve pictures in directories such as "My pictures", without
knowing victim’s username.
Gravity: 2/4
Consequences: data reading, data flow
Provenance: intranet client
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 26/08/2008
Identifier: VIGILANCE-VUL-8051
IMPACTED PRODUCTS
– Microsoft Windows - plateform
– Microsoft Windows Vista [confidential versions]
DESCRIPTION
Novell iPrint Client is an application for Windows which is used
to manage document printing with the Novell iPrint Server.
This client purpose a functionality to list picture in
directories: "GetFileList()". This function can be used to
retrieve files listed.
A local attacker can therefore use the ’GetFileList()" ActiveX
control to retrieve pictures in directories such as "My pictures",
without knowing victim’s username.
CHARACTERISTICS
Identifiers: CVE-2008-2432, VIGILANCE-VUL-8051
