Unscored CVE-2016-1356 EUVD-2016-2455GHSA-j66f-ff6x-m5fc

Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote at…

Published Mar 3, 2016 · Updated Aug 5, 2024 · Assigned by cisco

Description

Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615.

References

20160302 Cisco FireSIGHT System Software Convert Timing Channel Vulnerability vendor-advisory
1035189 vdb-entry