PT-2009-4852 · Ibm · Ibm Lotus Instant Messaging/Web Conferencing

CVE-2009-2435 · Publicado 2009-07-13 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Instant Messaging and Web Conferencing version 6.5.1

Description The issue allows remote attackers to enumerate valid usernames by analyzing the different time delays in error messages generated for failed logon attempts, depending on whether the user account exists.

Recommendations For IBM Lotus Instant Messaging and Web Conferencing version 6.5.1, consider implementing a uniform delay for all failed logon attempts to prevent username enumeration. Additionally, restrict access to the logon functionality to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2009-2435

Produtos afetados

Ibm Lotus Instant Messaging/Web Conferencing

Referências · 3

• http://senseofsecurity.com.au/advisories/SOS-09-004.pdf · Nota
• http://securityfocus.com/bid/35614 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2435 · Nota de Segurança