National Vulnerability Database (CVE-2002-1654)

National Cyber-Alert System Vulnerability Summary: CVE-2002-1654
Orirignal release date: 2002-12-31 Source: US-CERT/NIST ### Overview iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection. ### Impact CVSS Severity: 7 (High) Range: remote Authentication: access Impact Type: sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: VULNWATCH Name: 20020109 Netscape publishing wp-force-auth command Hyperlink: http://lists.virus.org/vulnwatch-0201/msg00008.html External Source: CERT-VN Name: VU#985347 Hyperlink: http://www.kb.cert.org/vuls/id/985347 External Source: MISC Name: http://www.securiteam.com/securitynews/5IP0G0060Q.html Hyperlink: http://www.securiteam.com/securitynews/5IP0G0060Q.html External Source: MISC Name: http://securitytracker.com/id?1003157 Hyperlink: http://securitytracker.com/id?1003157 External Source: BID Name: 3831 Hyperlink: http://www.securityfocus.com/bid/3831 External Source: XF Name: netscape-enterprise-http-brute-force(7845) Hyperlink: http://xforce.iss.net/xforce/xfdb/7845 External Source: NSO Name: http://www.kb.cert.org/vuls/id/AAMN-567NFX Hyperlink: http://www.kb.cert.org/vuls/id/AAMN-567NFX ### Vulnerable Software and Vendor Enterprise Server (Netscape) Web Server Enterprise Edition (iPlanet) Web Server (iPlanet) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1654