CVE-2009-1293: Infoleak

Published Apr 16, 2009

Updated

The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

Affected Software

7 affected components

Novell Teaming=1.0.2

Novell Teaming=1.0-sp3

Novell Teaming=1.0-sp2

Novell Teaming=1.0.1

Novell Teaming=1.0.3

Novell Teaming=1.0

Novell Teaming=1.0-sp1

Remediation

Patch Available

http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002997&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%2033084737

Event History

Apr 16, 2009

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1293?

CVE-2009-1293 is considered a moderate severity vulnerability due to its potential for facilitating username enumeration.

How do I fix CVE-2009-1293?

To address CVE-2009-1293, it is recommended to upgrade Novell Teaming to a version that resolve the enumeration of usernames.

What versions of Novell Teaming are affected by CVE-2009-1293?

CVE-2009-1293 affects Novell Teaming versions 1.0 through SP3 (1.0.3) including all intermediary versions like 1.0.1, 1.0.2, and 1.0-sp1.

What does CVE-2009-1293 vulnerability entail?

CVE-2009-1293 allows remote attackers to perform username enumeration due to varied error messages returned during login attempts.

Is user data compromised due to CVE-2009-1293?

CVE-2009-1293 does not compromise user data directly but increases the risk of targeted attacks through account enumeration.