CVE Feed

    Dashboard / CVE / CVE-2006-6306

    CVE-2006-6306

    Format string vulnerability in Novell Modular Authentication Services (NMAS) in the Novell Client 4.91 SP2 and SP3 allows users with physical access to read stack and memory contents via format string specifiers in the Username field of the logon window.

    Published:Dec 5, 2006
    Last Modified:Apr 23, 2026
    EPS:Dec 5, 2006
    EPSS Score:0.00096
    CVSS Score:1.2

    Affected Products

    Vendor
    Novell
    Product
    Client

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2013-3705 (CVSS 4.9) — The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a de…
    CVE-2013-3956 (CVSS 7.2) — The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Cl…
    CVE-2013-3697 (CVSS 7.2) — Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Se…
    CVE-2008-2145 (CVSS 7.2) — Stack-based buffer overflow in Novell Client 4.91 SP4 and earlier allows local users to cause a denial of serv…
    CVE-2008-0639 (CVSS 10) — Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool.dll) in Novell Client…
    CVE-2007-6701 (CVSS 10) — Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP4 for Windo…
    CVE-2007-5667 (CVSS 7.2) — NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilt…
    CVE-2007-2954 (CVSS 10) — Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 through S…
    CVE-2007-3207 (CVSS 7.1) — Buffer overflow in the NFS mount daemon (XNFS.NLM) in Novell NetWare 6.5 SP6, and probably earlier, allows rem…
    CVE-2007-0108 (CVSS 6) — nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal …

    References

    http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051038.html
    http://secunia.com/advisories/23363
    http://securityreason.com/securityalert/1970
    http://securitytracker.com/id?1017377
    http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974872.htm
    http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974876.htm
    http://www.layereddefense.com/Novell01DEC.html
    http://www.securityfocus.com/archive/1/453176/100/0/threaded
    http://www.vupen.com/english/advisories/2006/4987
    https://exchange.xforce.ibmcloud.com/vulnerabilities/30644
    https://secure-support.novell.com/KanisaPlatform/Publishing/372/3546910_f.SAL_Public.html
    http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051038.html
    http://secunia.com/advisories/23363
    http://securityreason.com/securityalert/1970
    http://securitytracker.com/id?1017377
    http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974872.htm
    http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974876.htm
    http://www.layereddefense.com/Novell01DEC.html
    http://www.securityfocus.com/archive/1/453176/100/0/threaded
    http://www.vupen.com/english/advisories/2006/4987
    https://exchange.xforce.ibmcloud.com/vulnerabilities/30644
    https://secure-support.novell.com/KanisaPlatform/Publishing/372/3546910_f.SAL_Public.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High