PT-2010-2307 · Geo++ · Geo++ Gncaster

Published 2010-02-04 · Updated 2018-10-10 · CVE-2010-0550

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Geo++ GNCASTER versions 1.4.0.7 and earlier

Description The issue concerns the admin.htm page in Geo++ GNCASTER, where HTTP Digest Authentication is not properly enforced, allowing remote authenticated users to bypass the intended server policy by using HTTP Basic Authentication.

Recommendations For versions 1.4.0.7 and earlier, consider disabling HTTP Basic Authentication to enforce the intended server policy until a proper fix is available. Restrict access to the admin.htm page to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0550

Affected Products

Geo++ Gncaster

References · 6

• http://secunia.com/advisories/38323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0550 · Security Note
• http://redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55976 · Note
• http://osvdb.org/62013 · Note
• http://securityfocus.com/archive/1/509199/100/0/threaded · Note