PT-2002-1283 · Hosting Controller · Hosting Controller

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0212

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hosting Controller versions 1.1 through 1.4.1

Description The issue allows remote attackers to determine the existence of valid usernames by analyzing different error messages returned during the login process for valid or invalid users, making it easier to conduct a brute force attack.

Recommendations For Hosting Controller versions 1.1 through 1.4.1, consider modifying the login functionality to return generic error messages for both valid and invalid usernames to prevent attackers from identifying existing usernames.

Fix

Related Identifiers

CVE-2002-0212

Affected Products

Hosting Controller

References · 5

• http://iss.net/security_center/static/8006.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0212 · Security Note
• http://securityfocus.com/bid/3971 · Note
• http://hostingcontroller.com/English/patches/ForAll/index.html · Note
• http://marc.info/?l=bugtraq&m=101224151705897&w=2 · Note