Description
Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system.
References
- 30545 vdb-entry
- chetcpasswd-error-message-enumeration(30454) vdb-entry
- 22967 third-party-advisory
- 21102 vdb-entry
- 20061113 Chetcpasswd 2.x: multiple vulnerabilities mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454