The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2002-2094
This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.
CVE: CVE-2001-1483
Enumeration of valid usernames based on inconsistent responses
CVE: CVE-2001-1528
Account number enumeration via inconsistent responses.
CVE: CVE-2004-2150
User enumeration via discrepancies in error messages.
CVE: CVE-2005-1650
User enumeration via discrepancies in error messages.
CVE: CVE-2004-0294
Bulletin Board displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid users and conduct a brute force password guessing attack.
CVE: CVE-2004-0243
Operating System, when direct remote login is disabled, displays a different message if the password is correct, which allows remote attackers to guess the password via brute force methods.
CVE: CVE-2002-0514
Product allows remote attackers to determine if a port is being filtered because the response packet TTL is different than the default TTL.
CVE: CVE-2002-0515
Product sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.
CVE: CVE-2001-1387
Product may generate different responses than specified by the administrator, possibly leading to an information leak.
CVE: CVE-2004-0778
Version control system allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.
CVE: CVE-2004-1428
FTP server generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames.
| Phase | Note |
|---|---|
| Architecture and Design | An observable response discrepancy frequently occurs during authentication, where a difference in failed-login messages could allow an attacker to determine if the username is valid or not. The discrepancy could be inadvertent (bug) or intentional (design). |
| Implementation | An observable response discrepancy frequently occurs during authentication, where a difference in failed-login messages could allow an attacker to determine if the username is valid or not. The discrepancy could be inadvertent (bug) or intentional (design). |
Intro: The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
Body: In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }