CVE-2016-9124: Critical severity revive adserver vulnerability
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9124?
CVE-2016-9124 has a medium severity rating due to its potential for password-guessing attacks.
How do I fix CVE-2016-9124?
To mitigate CVE-2016-9124, upgrade Revive Adserver to version 3.2.3 or later.
What type of vulnerability is CVE-2016-9124?
CVE-2016-9124 is classified as an improper restriction of excessive authentication attempts.
Who is affected by CVE-2016-9124?
CVE-2016-9124 affects all versions of Revive Adserver before 3.2.3.
What can attackers do with CVE-2016-9124?
Attackers can exploit CVE-2016-9124 to perform password-guessing attacks on the login page.