PT-2005-4276 · Fti Technology · Ringtail Casebook

Published 2005-11-03 · Updated 2008-09-05 · CVE-2005-3480

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ringtail CaseBook version 6.1.0

Description The issue allows remote attackers to determine valid usernames by exploiting the different error messages displayed by the login.asp page, depending on whether a user exists or not.

Recommendations For Ringtail CaseBook version 6.1.0, consider modifying the login.asp page to display generic error messages that do not reveal whether a user exists or not, until a patch is available.

Fix

Related Identifiers

CVE-2005-3480

Affected Products

Ringtail Casebook

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-3480 · Security Note
• http://procheckup.com/Vulner_PR0413.php · Vendor Advisory
• http://secunia.com/advisories/17383 · Vendor Advisory
• http://osvdb.org/20422 · Note