PT-2002-2378 · Netscape · Netscape Enterprise Server+1

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1654

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iPlanet Web Server Enterprise Edition versions 4.0 and 4.1 Netscape Enterprise Server versions 4.0 and 4.1

Description The issue allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command. This provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection.

Recommendations For iPlanet Web Server Enterprise Edition versions 4.0 and 4.1, consider disabling the wp-force-auth Web Publisher command as a temporary workaround until a patch is available. For Netscape Enterprise Server versions 4.0 and 4.1, consider disabling the wp-force-auth Web Publisher command as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2002-1654

Affected Products

Netscape Enterprise Server

Iplanet Web Server Enterprise Edition

References · 10

• 🔥 http://securityfocus.com/bid/3831 · Exploit
• 🔥 http://securiteam.com/securitynews/5IP0G0060Q.html · Exploit
• 🔥 http://securitytracker.com/id?1003157 · Exploit
• 🔥 http://lists.virus.org/vulnwatch-0201/msg00008.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1654 · Security Note
• http://kb.cert.org/vuls/id/985347 · Patch
• http://kb.cert.org/vuls/id/AAMN-567NFX · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7845 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1654 · Note
• http://procheckup.com/vulnerabilities/pr0105.html · Note