Symantec Enterprise Firewall Username Enumeration Weakness

Bugtraq ID:	25338
Class:	Design Error
CVE:	CVE-2007-4422
Remote:	Yes
Local:	No
Published:	Aug 16 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	The vendor credits Roy Hill of NTA Monitor Ltd with discovering this weakness.
Vulnerable:	Symantec Enterprise Firewall 6.5.2 NT/2000 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Symantec Enterprise Firewall 6.0 [email protected] Network Query Tool 6.5 NT
Not Vulnerable:

Symantec Enterprise Firewall Username Enumeration Weakness

Symantec Enterprise Firewall is prone to a username-enumeration weakness.

An attacker can exploit this issue to enumerate valid user names. This may aid in further attacks.

Symantec Enterprise Firewall Username Enumeration Weakness

An attacker can use brute-force techniques to exploit this issue.

Symantec Enterprise Firewall Username Enumeration Weakness

Solution:
Symantec has released an advisory to address this issue. Symantec will not be releasing any patches however; the vendor recommends applying the suggested workaround. Please see the references for more information.

Symantec Enterprise Firewall Username Enumeration Weakness

References:

• Symantec Enterprise Firewall Product Homepage (Symantec)
  
• Symantec Security Advisory SYM07-023 (Symantec)