PT-2002-2378 · Netscape · Netscape Enterprise Server+1

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1654

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iPlanet Web Server Enterprise Edition versions 4.0 and 4.1 Netscape Enterprise Server versions 4.0 and 4.1

Description The issue allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command. This provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.

Recommendations For iPlanet Web Server Enterprise Edition versions 4.0 and 4.1, consider disabling the wp-force-auth Web Publisher command as a temporary workaround until a patch is available. For Netscape Enterprise Server versions 4.0 and 4.1, consider disabling the wp-force-auth Web Publisher command as a temporary workaround until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-1654

Produtos afetados

Netscape Enterprise Server

Iplanet Web Server Enterprise Edition

Referências · 10

• 🔥 http://securityfocus.com/bid/3831 · Exploit
• 🔥 http://securiteam.com/securitynews/5IP0G0060Q.html · Exploit
• 🔥 http://securitytracker.com/id?1003157 · Exploit
• 🔥 http://lists.virus.org/vulnwatch-0201/msg00008.html · Exploit
• http://kb.cert.org/vuls/id/AAMN-567NFX · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7845 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1654 · Nota de Segurança
• http://kb.cert.org/vuls/id/985347 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1654 · Nota
• http://procheckup.com/vulnerabilities/pr0105.html · Nota