Clear Text Password Vulnerability in Mail Clients

Clear Text Password Vulnerability in Common Mail Clients on Windows
Statement from GWAVA: Issue Date: June 21, 2005
Author: Joe Bertnick

Overview:
Passwords stored in memory as clear text for multiple mail systems operating on Windows desktops.

Affected Systems:
Outlook 2003
GroupWise 6.5.4 (Windows Client Only)
Thunderbird 1.02 (Windows Client Only)

Note: Other messaging clients operating under the Windows XP platform might also exhibit this vulnerability as it is very common. Please refer to the Recommendations for best practices for reducing your risk for exposure.

Impact:
Unrestricted access to the mailbox of a single user and possible password usage on other directory enabled systems.

Details:
This issue was first reported via insecurity.org by the security team at truedson.com as a vulnerability in GroupWise. A link follows with the original posting.

GWAVA Security Research elected to further research the vulnerability along multiple mail platforms and provide a work around for customers.

There are a number of applications that cache authentication information in memory as plain text. GroupWise, Outlook and Thunderbird mail clients all operate in this manner. With a client loaded into memory and authenticated to the mail system, someone could execute a memory dump of the application and recover the password. The password will always be located at the same offset.

This is a common vulnerability in many client applications operating on the Windows operating system and as such users of Windows should follow the recommendations listed below.

Recommendations:
Implement screen saver password protection and log out of mail clients when leaving your workstation unattended. Install the patch when it is made available by the vendor. Migrating to Linux based Desktops such as Novell Linux Desktop would also prevent this issue.

References:
Original Posting: http://seclists.org/lists/fulldisclosure/2005/Jun/0262.html

eDirectory - A Look Ahead

This summary article, adapted from BrainShare 2005 Tutorial 278, discusses what's current and what's ahead for eDirectory - featuring the upcoming eDirectory version 8.8.

http://www.novell.com/coolsolutions/feature/15105.html

Current and Interim Releases

Version 8.7.3 of eDirectory was released in January 2004. Here are some of its key features:

• Added support for Windows 2003
• Unix package-based installer
• Novell Certificate Server 2.7
• Bundled products
• Novell iManager 2.0.2
• Novell Modular Authentication Service 2.3
• Novell eGuide 2.1.2

Novell has also produced several eDirectory 8.7.3 Interim Releases, from February 2004 to January 2005. These releases have resolved approximately 550 defects.

Version 8.7.3 IR5 was delivered with OES 1.0. It includes bug fixes, NCP engine support on SLES, and installation improvements. Version 8.7.3 IR6 was released in April 2005, featuring better memory management and fixes for localization defects.

Novell eDirectory 8.8 - Focus and Features

Version 8.8 of eDirectory focuses on the following things:

• Installation and Upgrade Enhancements
• Performance Improvements
• Security Enhancements
• New Developer Interfaces

Installation and Upgrade Enhancements

Here are the main install and upgrade improvements in version 8.8:

• Installation is fully scriptable.
• Installs can be done through YaST on SLES.
• FHS and LSB compliance is supported.
• An alternate data (DIB) location can be specified.
• Supervisor rights to the [root] of directory is no longer required to install the service.
• The service can be run as a non-root user on Linux or UNIX.
• Installs are patchable.
• Installs and updates can be done via Ximian Red Carpet.
• SecretStore is installed by default.
• The dependency between eDirectory and iManager is removed.
• Server Health Check and Patch Installer tools are included.

Performance Improvements

Data Import "BulkLoad" Improvements

You can select any of the following options to improve data import performance:

• Disable in-line change cache
• Disable ACL templates on inetOrgperson
• ??? No schema check; Indexing off ???
• Enable Multi-threading on client and server

Priority Sync

Priority Sync is used for instant convergence for real-time attributes such as passwords. It is configurable per attribute. Priority Sync writes change to all replicas at once - the normal replication process negotiates the rest.

Multi-Instance Support

Multi-instance support in Version 8.8 enables you to host more than one instance of eDirectory on a server.

With multi-instance support, you can:

• Maximize high-end host hardware.
• Open up new performance configuration options.
• Use a dedicated IP address per service instance.

Use more than one tree per server.

Use multiple replicas of the same tree or partition on a single server.

Assign an interface for each partition to accelerate searches.

Security Improvements

New Encryption Options

In version 8.8 you can encrypt attributes within the DIB. The attribute is encrypted on a per-server basis. Once encrypted, attributes can be accessed through clear text or secure channel (e.g., SSL).

Encrypted replication can also be done. You can set the replication traffic to be encrypted, on a per-partition or per-replica basis. Per-server is not currently supported but may be in the future.

Case-Sensitive Passwords

In eDirectory 8.7.1 and 8.7.3, when you enabled Universal Password, the password was case-sensitive only when you logged in through Novell Client32. The password was not case-sensitive when you logged in through other clients (for example, the eDirectory SDK or iManager).

With eDirectory 8.8, you can make your passwords case-sensitive for all the clients.

Object-based Backup and Restore

Object-based Backup and Restore is implemented through an extension to LDAP. It is used to back up the attributes and attribute values of one object at a time. This process returns same data as the Target Service Agent (TSANDS). This feature is available through C LDAP and the Java LDAP SDK.

Object-based Backup and Restore has the following advantages:

• You can do incremental backup, where the object is backed up only if changes have been made to it.
• It works on all eDirectory-supported platforms.
• It is reverse-compatible with TSA.

SASL-GSSAPI Support

The LDAP SASL-GSSAPI mechanism is an authentication module that helps the LDAP server authenticate to a user based on a Kerberos ticket. This support is targeted at LDAP application users in environments that already have the Kerberos infrastructure in place.

These users must be able to use the Kerberos tickets obtained from the Kerberos server to authenticate to the LDAP server, without providing a separate LDAP user password.

======
I'm most excited about Multi-Instance Support!

See more on this information at Novell Cool Solutions.
- Bucky

Timesync Tips NW 6.5SP3 and OES NetWare

This was recently posted at Novell Cool Solutions:

Over the past few months I noticed some of our NW 6.5 servers (eDir 8.7.3.3) would lose timesync. We have one reference (gets time via NTP over Internet) and two primary time servers. These 3 servers always appear to be in sync with each other.

The problem is with some of the secondary NW 6.5 servers. If I look at the timesync debug screen on some of these servers they may be several seconds (8 to 10 or more) out of sync. Restarting timesync will fix it but it may drift out again after several hours. I found that if I switched from using NTP (:123) in timesync.cfg to just using the IP address, time stays in sync without a problem. This is a workaround for now, but we would prefer to standardize on NTP for all time synching.

Solution

Two of our Forum experts contributed some practical suggestions on the topic, as follows:

Expert 1: On NetWare 6.5 Sp3 and above if you want to use NTP, use XNTPD.NLM instead of Timesync. You can make this happen automatically by editing TIMESERV.NCF and remming-out the LOAD TIMESYNC line and un-remarking the LOAD xntpd line.

You also need to edit /etc/ntp.conf to point it at the proper NTP server(s).

---

Expert 2: Here are some common gotcha's of timesync ...

* In Monitor > Server parameters > Time, make sure you have "Default Time Server Type" and "TimeSync Type" both set to the exact same thing.

* Set "Configured Sources" to "on" and theIP address with port 123, followed by a semi-colon.

* Make sure the NTP client can hit the NTP server's port 123 (nmap can tell easily, or at least I like it best)?

* Verify that RADIUS is set to just port 2000.

I have twice seen cases where the hardware clock was nuts. In both cases, we watched them rush ahead of real-world time when we disabled timesync and watched the time source and the bad box simultaneously (via rconj, freecon, whatever). That doesn't happen often, but it may be something to check.

News from Premium Service - June

June 16, 2005

Issue 6, Volume 5

News
& Views

100 Best Corporate Citizens for 2005, Business Ethics Magazine, Spring 2005

[Novell ranked #9 on this year's survey. – Editor]

http://www.business-ethics.com/whats_new/100best_2005.html#How%20the%20List%20Is%20Put%20Together

U.S. Health Department Signs Major Linux Deal With Novell, InformationWeek, June 1, 2005

“HHS is already a user of Novell products, however the new deal provides an enterprise license to Novell's Linux and OpenSource products, the spokesman says. The pact doesn't require HHS or NIH to migrate off other platforms used in their environments, he says.

“An NIH source says there are no plans to "unseat" Microsoft products, which are widely used throughout HHS. However, Linux products provides "an attractive low unit cost" for thousands of scientific users within NIH and other HHS agencies, such as the Centers for Disease Control and Prevention, the NIH official says.”

http://informationweek.com/story/showArticle.jhtml?articleID=163702338

Desktop Linux: Ready for Prime Time?, RedmondMag.com, June 2005

“Three of the products reviewed here impressed me as suitable for use on a desktop within a business setting: Novell Linux Desktop 9, Red Hat Professional Workstation, and SuSE Linux Professional 9.2. All three offered the ease of use, administrative tools, and the robustness necessary in a corporate environment.

“Novell is strongly pushing Linux, and essentially betting the company on its success. The company has been very successful with creating a strong server product and is now trying to carry that success down to the workstation. Because two of the three best offerings (SuSE Linux and Novell Linux Desktop) are from Novell, I believe that Linux will make inroads into corporate desktops this year and give Windows XP an honest run for the market.”

http://www.redmondmag.com/features/article.asp?EditorialsID=485

Novell's one-two punch, NetworkWorld, April 25, 2005

“With $1.7 billion in cash and ranking among the top 25 most profitable companies on the NW200, Novell has more than a fighting chance with its Linux-plus-management strategy.

"'Even though Novell's revenue performance in the first quarter was disappointing, with $1.7 billion cash on hand, the company has a lot of room to maneuver in terms of adding to and providing support services [for OES and SuSE Linux],' Hurley adds.” http://www.networkworld.com/nw200/2005/042505novell.html?net

NetWare Platform Is Far From Dead, eWeek.com, April 18, 2005

“Far from sounding a death knell for NetWare, however, the work Novell has done to plaster over the differences between NetWare and Linux in OES should extend the life of NetWare as a platform. This is good news for NetWare shops that aren't ready to migrate off this stalwart platform.” http://www.eweek.com/article2/0,1759,1785989,00.asp

TUX magazine debuts

“TUX is the first and only magazine for the new Linux user and is dedicated to promoting and simplifying the use of Linux on the desktop.

“TUX is published by SSC Publishing, the leading Linux and Open Source authority, publishing reference materials in these fields since 1983. Properties include LinuxGazette.com, DocSearls.com, TuxMagazine.com, LinuxJournal.com, and the the award-winning international print magazine, Linux Journal. http://www.tuxmagazine.com/

Windows can't kill Linux, InfoWorld, May 9, 2005

“In a recent column, Tom Yager provocatively declared, 'Linux can't kill Windows.' Linux is just an OS, he said, whereas commercial offerings such as Windows and Mac OS X give developers a complete platform on which to build applications. His conclusion was that Linux will never be truly ready to compete for a seat at the big table.

“He's wrong, of course.” http://www.infoworld.com/article/05/05/09/19OPopenent_1.html

British study: schools can save by ditching Microsoft, cNet News.com, May 6, 2005

“A study by Britain's Educational Communications and Technology Association found that primary schools in the UK could cut their computer costs significantly by avoiding software from Microsoft.

“Results of the study, which are due to be released next week, were reported on Friday by The Times Educational Supplement, a British paper. The TES said that the study doesn't actually use Microsoft's name, but leaves little doubt by referring to the world's largest software maker.

“According to the paper, the study compared costs at 33 schools that employ commercial software and 15 using open source. The study finds that the open source-based schools saved an average of 24 percent on software, hardware and support, again according to the TES report.” http://news.com.com/2061-10805-5698429.html

Cool SolutioNs – http://www.novell.com/coolsolutions/

Linux Login to NetWare Script

Easy to use script for making an NCP connection to NetWare.

http://www.novell.com/coolsolutions/tools/14952.html

Integrating Novell Linux Desktop into a Novell NetWare network

“As I researched the use of Novell Linux Desktop (NLD) in a NetWare 6.5 Network, I became frustrated with the lack of documentation concerning using NLD as a client to a NetWare server. I started out by scouring the Novell site for Documentation \ TIDS and Cool Solutions. This search turned up very little. I decided that I needed to figure out a path through NetWare's NFAP and LDAP tools to create what I thought would be some crude connectivity. After working for a little while on LDAP authentication I was guided by a fellow Forum reader who had figured out how to get LDAP authentication working by using the directions for authenticating to eDirectory on Linux.” http://www.novell.com/coolsolutions/trench/15201.html

TraiNing – http://www.novell.com/training/

Getting Started With Linux: Novell’s Guide to CompTIA’s Linux+

Getting Started with Linux: Novell’s Guide to CompTIA’s Linux+ (Course 3060) introduces students to the knowledge and skills needed to manage all Linux distributions. Specifically, this course covers the objectives outlined by CompTIA® for its Linux+ exam and certification, an international industry credentials that offers proof of knowledge...

Not only does this course prepare students for the CompTIA Linux+ exam; it offers an excellent way to begin preparing for the Novell Certified Linux Professional (Novell CLP) practicum exam. In fact, after completing this course, students will have acquired one-third the knowledge needed to become a full Novell CLP, the ideal certification for people interested in become Linux administrators.

http://www.novell.com/training/train_product/linuxplus.html

Products & SolutioNs – http://www.novell.com/products/ & http://www.novell.com/solutions/

Linux is about more than software. It's about tech support. It's about consulting expertise. It's about training. And most importantly, it's about you - how will Linux help you run your business better?

Not all Linux distributions are created equally. Perhaps it's time you take a look at SUSE LINUX Enterprise Server from Novell. Read all about it at http://www.novell.com/linux/getservices/

Patches & Fixes – http://support.novell.com/filefinder

These are the “New this week” patches. Note that some are BETA; be sure to check our website for details about them. The symbol indicates a security alert.

Product	Patch Date	Patch Name	Description
SecureLogin	06/10/05	sl351201.exe	Post SP2 updates for SecureLogin 3.51
NetWare 6	06/10/05	nw6nss5c.exe	Post SP5 NSS modules for NetWare 6.0
NetWare	06/10/05	n65nss3a.exe	Post SP3 NSS modules for NetWare 6.5
Novell Clients	06/08/05	491_pka.exe	Novell Client 4.91 Update "A"
NetWare 6	06/08/05	mmft2a.exe	Media Manager and NWPA updates
GroupWise	06/08/05	fwa655c.exe	GroupWise 6.5.5 WebAccess Rev C (NW/Win)
GroupWise	06/08/05	fgwia655e.exe	GroupWise 6.5 SP5 Internet Agent Rev. E
GroupWise	06/08/05	fgw655e.exe	GW 6.5 SP5 Agents Rev 5
ZENworks 6.5 Suite	06/08/05	zen65inv_sd_4.exe	ZENworks 6.5 Inv Software Dict Update 4
NetWare 6.5	06/07/05	iprntnwpcsp12b.exe	iPrint NW Post Consolidated SP 12b
NetMail 3.5, Nterprise Linux Services 1.0	06/06/05	netmail352c_lin.tgz	NetMail 3.52C Update for Linux
NetMail 3.5, Nterprise Linux Services	06/06/05	netmail352c_nw.zip	NetMail 3.52C Update for NetWare
NetMail 3.5, Nterprise Linux Services	06/06/05	netmail352c_win.zip	NetMail 3.52C Update for Windows
NetWare 6.5	06/06/05	nw65os3a.exe	NetWare 6.5 SP3 Updated SERVER.EXE
DirXML, Identity Manager	06/06/05	idm20xnisir1.tgz	Updated NIS driver for IDM2.0.x on Solaris
NetWare 6.5	06/06/05	xvsft2.exe	Xsession Vulnerability Fix

New TIDs – http://www.novell.com/coolsolutions/collector/tids_new.html

Status: 503 Service Unavailable – TID10097986

Tunneling Control is enable in proxy.cfg.

An error is displayed on the browser:

Novell BorderManager Information Alert

HTTP ERROR

Status: 503 Service Unavailable

Description: The requested method is not allowed on this scheme type. Tunneling through the port being used is not allowed

Please contact your Systems Administrator for resolution.

When Tunneling Control is enable in proxy.cfg and few ports are added, only the first one will allow traffic. The rest will fail. If changing the order of the ports, the one becoming now the first one, is the one that will work

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097986.htm

Invalid syntax error when using the eMBox client to backup NICI files via the " - TID10098019

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098019.htm

HP 10.x NFS client hangs when doing ls on NetWare NFS. - TID10096446

HP 10.x NFS client enters infinite loop when getting directory list of a NetWare NFS shared directory.

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10096446.htm

Message body containing too much plain text cuts off part of the content at the – TID10097993

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097993.htm

In Their OwN Words – http://www.novell.com/success/ & http://www.novell.com/news/leadstories/archive/

“Nothing is broken or out of revision, so it doesn't make sense for us to make the move," said Carmen Rahm, senior director of IT Services at Central Washington University. "We have been running Novell GroupWise for years without any virus attacks or unexpected downtime. Novell also offers a solid directory which fully meets our needs and gives us a road map for our plans to move to open systems.”

"Mobility is no longer a luxury," said Rahm. "The ability to provide consistent remote e-mail access is absolutely critical for us to remain efficient in a time of tight budgets. With the BlackBerry Enterprise Server for GroupWise, we didn't have to look elsewhere for mobile support."

"I've had my BlackBerry glued to my hand since we installed the BlackBerry Enterprise Server," said Rahm. "Now I can do e-mail while walking across campus or waiting in line for a latte. We're eliminating an enormous amount of wasted time and helping make our staff far more productive. With GroupWise and BlackBerry, you don't have to go looking for your e-mail - it finds you."

"The BlackBerry doesn't care what's on your desktop - it just synchronizes with a server," said Roland Tollefson, director of Networks and Operations at Central Washington University. "We are reducing the frustrations of our Macintosh users and expect support calls related to PDAs and e-mail to drop to zero.”

"We want to be able to pick and choose our own applications and features, without being tied to a certain vendor," said Tollefson. "It's important that our e-mail system give us that flexibility down the road."

Read more about Central Washington University at http://www.novell.com/success/cwu.html?sourceidint=ic_nb050505_cwu

Totally IrrelevaNt Website(s) of the Day

“I'm a student, with limited funds and a cheap house without air conditioning. To avoid dying this summer, I've built a primitive air conditioner. It's a basic heat pump, using water as the medium. You'll probably need to fiddle a bit with the dimensions of the supplies based on your resources and preferences.

“The system will cool an average room to a comfortable level in approximately 15-20 minutes. Depending on flow rate, a full bucket of water will last approximately 1-3 hours.

“It doesn't rip quite as hard as central air, but for less than $30 CAD I'm not complaining.”

Find out more about this home-made air conditioner at http://www.eng.uwaterloo.ca/~gmilburn/ac/

As always, if you have any questions, please feel free to contact me.

Bucky

Novell, Inc., The leading provider of informatioN solutions

www.novell.com

OES NW and 6.5 SP3 Product Differences.

Differences between Open Enterprise Server NetWare and NetWare 6.5 SP3

-------------------------------------------------------
Non-OES NetWare 6.5 SP3
-------------------------------------------------------
| |iManager 2.0.2 Novell iManager 2.0.2
| |NWS 3.0.2 NetWare Web Search Server
| |VOffice 1.3.0 Novell Virtual Office
-------------------------------------------------------

-------------------------------------------------------
OES NetWare 6.5 SP3
-------------------------------------------------------
| |iManager 2.5.0 Novell iManager 2.5
| |OES 1.0.0 Open Enterprise Server
| |QFind 4.0.1 QuickFinder Server
| |VOffice 1.5.0 Novell Virtual Office
-------------------------------------------------------

NOTE: There are NO schema differences between the 2 variants.

NetWare 6.5 SP3 Updated SERVER.EXE

The new SERVER.EXE 5-23-2005 has been released to Beta. This release also fixes abend issues.

http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971567.htm

With NetWare 6.5 Support Pack 3 customers have reported experiencing memory problems. The files included in this update are designed to address these concerns. Included in this package is an updated SERVER.EXE file and an updated PORTAL.NLM file. Both of these files update code from NetWare 6.5 Support Pack 3 only.

Please see other related posts on Memory Issues in the archives.
- Bucky

About Novell Premium Services Programs

Novell is well known for it's excellent technical service and support. But did you know that Novell also offers many Premium Support Programs? For example, I'm a PSE or Primary Support Engineer. I'm assigned no more than three companies or entities for 24/7 support. PSE's usually exist in different regions to be near their customer base to have a closer relationship.

Program Feature Chart

Novell Premium Support Features

Novell also offeres onsite offerings and scheduled standby services as well as other service modules.

Novell also has many Linux Support offerings

For more information contact your local Novell Sales office or contact Novell at 800-529-3400 or 800-321-4272

- Bucky
Novell Primary Support Engineer

Open Enterprise Server: Quick Start Guide

We've heard from some new Open Enterprise Server customers who are a tad bit confused about how to apply the activation code that lets them access their product updates. Here's something that will help a lot.

This quick start guide is designed to give you an easy reference to the Open Enterprise Server activation. It describes how to download and register the Open Enterprise Server licenses, download your certificate, add users to your company's account, and obtain product updates.

http://www.novell.com/coolsolutions/tip/14627.html

Download PDF Guide Now

---

Here's an excellent fast track to increase your knowledge of Open Enterprise Server. Use the OES Lab Guides to take you step by step through Installation, setting up the eDirectory infrastructure. In Addition these guides have excellent lab projects to get you familiar with Novell Samba, iFolder, Virtual Office, iPrint, Netstorage, eGuide and Linux User Management.

OES for Linux Lab Guide

Download OES Linux Lab Guide PDF Now

OES for NetWare Lab Guide

Download OES NetWare Lab Guide PDF Now

Enjoy
- Bucky

Novell Brainshare Presentations Available

Did you miss Brainshare 2005 this year? Well, did you know that you can still obtain the ALL the Novell Brainshare sessions?

Download all the PDF Brainshare Sessions now. 184 MB

Download all the Open Office Brainshare Sessions now. 214 MB

More information about Brainshare:
http://www.novell.com/brainshare/index.html

Novell Brainshare Session Index

Don't forget the Novell Marketing Videos

Enjoy!
- Bucky