Novell Teaming vulnerabilities patched
SEC Consult, a security consulting service, has advised of three vulnerabilities in Teaming, Novell's collaboration and conferencing software. The first vulnerability relates to user authentication via a log-in form. Valid and invalid user names receive different responses from the web application, possibly allowing an attacker to generate a list of user names for a dictionary or brute force attack. The other two vulnerabilities could allow for a cross site scripting (XSS) attack.
Teaming 1.0.3 and prior versions are vulnerable. Patches for the log-in vulnerability and for the XSS vulnerabilities are available from Novell.
See also:
- Novell Teaming Multiple Vulnerabilities, security advisory from SEC.
(crve)