Description
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
References
- 26511 third-party-advisory
- 1018578 vdb-entry
- 25338 vdb-entry
- http://www.symantec.com/avcenter/security/Content/2007.08.16.html
- 36489 vdb-entry
- sef-username-enumeration(36081) vdb-entry
- ADV-2007-2909 vdb-entry