CVE-2016-1356 Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing diff...
LowCVSS 3.7
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco firesight system software | = _6.1.0 | No fix listed |
References
- 20160302 Cisco FireSIGHT System Software Convert Timing Channel Vulnerability vendor-advisory
- 1035189 vdb-entry