Description
The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
References
- https://www.sec-consult.com/files/20090415-0-novell-teaming.txt
- ADV-2009-1048 vdb-entry
- 34714 third-party-advisory
- http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=7002997&sliceId=1&docTypeID=DT_TID_1_1&dialogID=33090060&stateId=1%200%2033084737
- 20090415 SEC Consult SA-20090415-0 :: Multiple Vulnerabilities in Novell Teaming mailing-list
- 1022063 vdb-entry
- 34531 vdb-entry