CVE-2007-4422: Critical severity Symantec Enterprise Firewall vulnerability
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4422?
CVE-2007-4422 is considered to have a medium severity level due to its potential exploitation for username enumeration attacks.
How do I fix CVE-2007-4422?
To mitigate CVE-2007-4422, it is recommended to upgrade Symantec Enterprise Firewall to a version that addresses this vulnerability.
What type of attack is possible with CVE-2007-4422?
CVE-2007-4422 allows remote attackers to perform username enumeration attacks through the login interface.
Which versions of Symantec Enterprise Firewall are affected by CVE-2007-4422?
CVE-2007-4422 specifically affects version 6.x of Symantec Enterprise Firewall.
Can CVE-2007-4422 be exploited without authentication?
Yes, CVE-2007-4422 can be exploited without authentication, as it allows attackers to determine valid usernames.