CVE-2010-0551 HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication atte...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response. NOTE: this is referred to as a "memory leak" by some sources, but is better characterized as "memory disclosure."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geopp geo++ gncaster | <= 1.4.0.7 | No fix listed |
| geopp geo++ gncaster | = 1.4.0.0 | No fix listed |
References
- 62015 vdb-entry
- 38323 third-party-advisory vendor-advisory
- www.redteam-pentesting.de exploit
- 20100127 [RT-SA-2010-003] Geo++(R) GNCASTER: Faulty implementation of HTTPDigest Authentication mailing-list
- gncaster-server-info-disclosure(55978) vdb-entry