OCS Inventory NG Existing/Non-Existing Username Enumeration Weakness

Bugtraq ID:	35023
Class:	Design Error
CVE:	CVE-2009-1769
Remote:	Yes
Local:	No
Published:	May 18 2009 12:00AM
Updated:	Jun 03 2009 05:59PM
Credit:	Will Aoki
Vulnerable:	Red Hat Fedora 9 Red Hat Fedora 10 OCS Inventory Team OCS Inventory NG Server 1.01
Not Vulnerable:

OCS Inventory NG Existing/Non-Existing Username Enumeration Weakness

OCS Inventory NG is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists.

Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks.

This issue affects OCS Inventory NG 1.01; other versions may also be affected.

OCS Inventory NG Existing/Non-Existing Username Enumeration Weakness

Attackers can exploit this issue via a browser.

OCS Inventory NG Existing/Non-Existing Username Enumeration Weakness

Solution:
Updates are available. Please see the references for more information.

OCS Inventory NG Existing/Non-Existing Username Enumeration Weakness

References:

• OCS Inventory NG Homepage (OCS Inventory Team)
  
• ocsinventory-reports: Different errors for bad username and for valid username w (Debian)