pam_captcha Username Enumeration Weakness
BID:41413
Info
pam_captcha Username Enumeration Weakness
| Bugtraq ID: | 41413 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 06 2010 12:00AM |
| Updated: | Jul 06 2010 12:00AM |
| Credit: | Ian Maguire |
| Vulnerable: |
pam_captcha pam_captcha 1.3 |
| Not Vulnerable: | |
Discussion
pam_captcha Username Enumeration Weakness
pam_captcha is prone to a username-enumeration weakness because it responds differently to login attempts, depending on whether or not the username exists.
Attackers may exploit this weakness to discern valid usernames, which may aid them in brute-force password cracking or other attacks.
pam_captcha 1.3 is vulnerable; other versions may also be affected.
pam_captcha is prone to a username-enumeration weakness because it responds differently to login attempts, depending on whether or not the username exists.
Attackers may exploit this weakness to discern valid usernames, which may aid them in brute-force password cracking or other attacks.
pam_captcha 1.3 is vulnerable; other versions may also be affected.
Exploit / POC
pam_captcha Username Enumeration Weakness
Attackers can use readily available tools to exploit this issue.
Attackers can use readily available tools to exploit this issue.
Solution / Fix
pam_captcha Username Enumeration Weakness
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
pam_captcha Username Enumeration Weakness
References:
References:
- pam_captcha Homepage (Jordan Sissel)
- pam_captcha username harvest vulnerability (Ian Maguire