Nortel Contivity VPN Client Username Enumeration Vulnerability
BID:11623
Info
Nortel Contivity VPN Client Username Enumeration Vulnerability
| Bugtraq ID: | 11623 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2004 12:00AM |
| Updated: | Nov 08 2004 12:00AM |
| Credit: | K. K. Mookhey of Network Intelligence India reported this vulnerability. |
| Vulnerable: |
Nortel Networks Contivity VPN Client 4.91 |
| Not Vulnerable: |
Nortel Networks Contivity VPN Client 5.0 1_030 |
Discussion
Nortel Contivity VPN Client Username Enumeration Vulnerability
It is reported that Nortel Contivity VPN client is susceptible to a username enumeration vulnerability.
Attackers may exploit this vulnerability to discern valid usernames. This may aid them in brute force password cracking, or other attacks.
Versions prior to 5.01_030 are reported susceptible to this issue.
It is reported that Nortel Contivity VPN client is susceptible to a username enumeration vulnerability.
Attackers may exploit this vulnerability to discern valid usernames. This may aid them in brute force password cracking, or other attacks.
Versions prior to 5.01_030 are reported susceptible to this issue.
Exploit / POC
Nortel Contivity VPN Client Username Enumeration Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Nortel Contivity VPN Client Username Enumeration Vulnerability
Solution:
The vendor has released version 5.01_030 of the affected package. Contact the vendor for information about obtaining fixed versions of the package.
Solution:
The vendor has released version 5.01_030 of the affected package. Contact the vendor for information about obtaining fixed versions of the package.
References
Nortel Contivity VPN Client Username Enumeration Vulnerability
References:
References:
- Contivity VPN Client Homepage (Nortel Networks)
- Nortel Networks Information for VU#830214 (US-CERT)
- VU#830214 - Nortel Networks Contivity VPN Client information leakage vulnerabili (US-CERT)