PT-2010-2311 · Geo++ · Geo++ Gncaster

Published 2010-02-04 · Updated 2018-10-10 · CVE-2010-0554

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Geo++ GNCASTER versions 1.4.0.7 and earlier

Description The issue concerns the HTTP Authentication implementation, which uses the same nonce for all authentication. This allows remote attackers to hijack web sessions or bypass authentication via a replay attack.

Recommendations For versions 1.4.0.7 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0554

Affected Products

Geo++ Gncaster

References · 6

• http://secunia.com/advisories/38323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0554 · Security Note
• http://redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication · Note
• http://osvdb.org/62014 · Note
• http://securityfocus.com/archive/1/509199/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55977 · Note