Description
my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.
References
- https://tech.f5.com/home/solutions/sol6923.html
- http://www.mnin.org/advisories/2007_firepass.pdf
- 32736 vdb-entry
- 23627 third-party-advisory
- 20070106 NNL-Labs & MNIN - F5 FirePass Security Advisory mailing-list
- 21957 vdb-entry