CVE-2007-4422 The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid,....
HighCVSS 9.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symantec enterprise firewall | = 6 | No fix listed |
References
- 26511 third-party-advisory
- 36489 vdb-entry
- 25338 vdb-entry
- 1018578 vdb-entry
- www.symantec.com vendor-advisory
- ADV-2007-2909 vdb-entry
- sef-username-enumeration(36081) vdb-entry