OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Kratter, Dave (davemimeo.com)
Date: Tue Oct 23 2001 - 16:07:05 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Summary:
            SecuRemote will show whether a username is recognized during failed
    login attempts

    Versions Tested:
            4.1 SP4 (4185) VPN+Strong for Windows 2000
            4.1 SP4 (4185) VPN+Strong for Windows NT

    Description:
            During an authentication attempt in the VPN-1 SecuRemote
    Authentication dialog box, a failed login due to an incorrect username or
    password will result in different responses, depending on the nature of the
    failure. If the username is valid and the password is incorrect, SecuRemote
    will return a dialog box with the message "Access denied by FireWall-1
    authentication". However, if the username is invalid, SecuRemote will return
    a dialog box with the message "User <unknown_user> not found". While this is
    not a security hole per se, it does allow someone to determine valid
    firewall usernames (given enough patience).

    Workaround:
            Unknown

    Vendor Status:
            Check Point was notified on October 16, 2001

    David B. Kratter
    Mimeo.com, Inc.
    Quality Assurance Technical Engineer

    Mimeo.com. Click.Print.Bind.Deliver.sm