CVE-2002-1623
15Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 49%
probabilidad de explotación
49%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote.
Productos afectados
n/a · n/aReferencias
http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.htmlhttp://marc.info/?l=bugtraq&m=103124812629621&w=2http://marc.info/?l=bugtraq&m=103176164729351&w=2https://exchange.xforce.ibmcloud.com/vulnerabilities/10034http://www.checkpoint.com/techsupport/alerts/ike.htmlhttp://www.kb.cert.org/vuls/id/886601http://www.nta-monitor.com/news/checkpoint.htmhttp://www.securiteam.com/securitynews/5TP040U8AW.htmlhttp://www.securityfocus.com/archive/1/290202http://www.securityfocus.com/bid/5607