PT-2004-1339 · Sygate · Sygate Secure Enterprise

Martin Oneal · Publicado 2004-08-18 · Atualizado 2017-07-11 · CVE-2004-0163

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Sygate Secure Enterprise (SSE) versions 3.5MR3 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically resource exhaustion, by capturing a session and repeatedly replaying it. This is due to the software not changing the key used to encrypt data.

Recommendations For versions 3.5MR3 and earlier, consider implementing measures to prevent session replay attacks, such as regenerating encryption keys after a session is closed, until a patch is available.

Correção

Identificadores relacionados

CVE-2004-0163

Produtos afetados

Sygate Secure Enterprise

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2004-0163 · Nota de Segurança
• http://corsaire.com/advisories/c031120-002.txt · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16945 · Nota
• http://marc.info/?l=bugtraq&m=109215685731675&w=2 · Nota