Vignette and StoryServer /vgn/login template could allow an attacker to determine valid usernames and passwords
| vignette-login-account-bruteforce (12073) |  Medium Risk |
Description:
Vignette CMS and StoryServer could allow a remote attacker to determine valid accounts. The /vgn/login template returns different responses depending on whether a valid or invalid username is entered during authentication. This could allow a remote attacker to use brute force techniques to determine a valid username and password.
Platforms Affected:
- Vignette, StoryServer 5.0
- Vignette, Vignette V5
Remedy:
Contact Vignette Technical Support for upgrade or patch information, as listed in S21sec Security Advisory S21SEC-020-en. See References.
Consequences:
Bypass Security
References:
- S21sec Security Advisory S21SEC-020-en, Vignette user enumeration at http://www.s21sec.com/en/avisos/s21sec-020-en.txt.
- VulnWatch Mailing List, Mon May 26 2003 - 19:28:25 CDT, More S21sec Vignette advisories at http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0085.html.
- BID-7691: Vignette Login Template User Information Leakage Vulnerability
- CVE-2003-0402: The default login template (/vgn/login) in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks.
Reported:
May 26, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net