Vulnerability CVE-2007-3022

Vulnerability CVE-2007-3022

Published: 2007-06-05 Modified: 2012-02-12

Description:

Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attackers to conduct brute force attacks.

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Symantec -> Client security
Symantec -> Norton antivirus
Symantec -> Reporting server

References:

http://www.symantec.com/avcenter/security/Content/2007.06.05.html

http://www.vupen.com/english/advisories/2007/2074

http://xforce.iss.net/xforce/xfdb/34740

http://www.securitytracker.com/id?1018196

http://www.securityfocus.com/bid/24312

http://secunia.com/advisories/25543

Copyright 2024, cxsecurity.com