---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: e107 Administrator Account Enumeration Weakness SECUNIA ADVISORY ID: SA15733 VERIFY ADVISORY: http://secunia.com/advisories/15733/ CRITICAL: Not critical IMPACT: Exposure of system information WHERE: >From remote SOFTWARE: e107 0.x http://secunia.com/product/1927/ DESCRIPTION: Marc Ruef has discovered a weakness in e107, which can be exploited by malicious people to identify valid administrator accounts. The problem is that different error messages are returned depending on whether an unsuccessful login attempt is performed with a valid or invalid username in the administrator login page. It is also possible to disclose the full path to certain scripts by accessing them directly. The weakness has been confirmed in version 0.6171. Other versions may also be affected. SOLUTION: Edit the source code to ensure that the same error message is returned or restrict access to the administrator directory. PROVIDED AND/OR DISCOVERED BY: Marc Ruef ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------