PT-2010-2311 · Geo++ · Geo++ Gncaster

Publicado 2010-02-04 · Atualizado 2018-10-10 · CVE-2010-0554

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Geo++ GNCASTER versions 1.4.0.7 and earlier

Description The issue concerns the HTTP Authentication implementation, which uses the same nonce for all authentication. This allows remote attackers to hijack web sessions or bypass authentication via a replay attack.

Recommendations For versions 1.4.0.7 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-0554

Produtos afetados

Geo++ Gncaster

Referências · 6

• http://redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication · Nota
• http://secunia.com/advisories/38323 · Aviso do Fabricante
• http://osvdb.org/62014 · Nota
• http://securityfocus.com/archive/1/509199/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0554 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55977 · Nota