This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.

--168455424-455564286-1148319820=:15416
Content-Type: TEXT/PLAIN; charset=ISO-8859-1
Content-Transfer-Encoding: QUOTED-PRINTABLE

> Suggested Risk Level: Low.
>=20
> Type of Risk: Information Leakage, Information Injection, Unauthorized
> Access.
>=20
> Affected Software: Novell Client for Windows, versions 4.9 and 4.8 (On
> windows XP Pro and Windows 2000 Workstation).
> This versions are the only one tested, thus other version may be vulnerab=
le
> as well.
>=20
> Local / Remote activation: Local.
>=20
> Summary:=20
>=20
> 1. Anyone with access to the computer's local operating system console, o=
ne
> using the Novell client login screen (when the console is locked), can vi=
ew
> a textual content of the clipboard of the locally logged in user, by
> performing a paste command into the "user name" field of the login form.


We thank Eitan Caspi for his precise analysis of the problem and for=20
thoroughly working with us on it. Specifically, we confirm the low=20
severity rating of this information leakage, which is why we allow=20
ourselves more time than usual to investigate an entirely satisfactory=20
solution to the problem. If there will be an update for this issue, our=20
customers and users will benefit from it through the regular channels.=20
The publication of Eitan's findings is the correct next step - again, we=20
thank him for his valuable work.

[...]

> Eitan Caspi
> Israel

Roman Drahtm=FCller,
Novell/SUSE Security.
--=20
- -
| Roman Drahtm=FCller <draht@novell.com> // "You don't need eyes to see, =
|
Security Architect Phone: // you need vision!"
| Novell - SUSE Linux +49-911-740530 // Maxi Jazz, Faithless |
- -
--168455424-455564286-1148319820=:15416--