PT-2009-4852 · Ibm · Ibm Lotus Instant Messaging/Web Conferencing

Published 2009-07-13 · Updated 2024-02-14 · CVE-2009-2435

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Instant Messaging and Web Conferencing version 6.5.1

Description The issue allows remote attackers to enumerate valid usernames by analyzing the different time delays in error messages generated for failed logon attempts, depending on whether the user account exists.

Recommendations For IBM Lotus Instant Messaging and Web Conferencing version 6.5.1, consider implementing a uniform delay for all failed logon attempts to prevent username enumeration. Additionally, restrict access to the logon functionality to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-2435

Affected Products

Ibm Lotus Instant Messaging/Web Conferencing

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2009-2435 · Security Note
• http://senseofsecurity.com.au/advisories/SOS-09-004.pdf · Note
• http://securityfocus.com/bid/35614 · Note