Vulnerability Name:

CVE-2005-0798 (CCN-19645)

Assigned:2005-03-09
Published:2005-03-09
Updated:2016-10-18
Summary:Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2005-0797

Source: MITRE
Type: CNA
CVE-2005-0798

Source: BUGTRAQ
Type: UNKNOWN
20050315 [ISR] - Novell iChain Mini FTP Server Bruteforce Problem

Source: CCN
Type: SA14607
Novell iChain miniFTP Server Brute Force Weakness

Source: SECUNIA
Type: Vendor Advisory
14607

Source: CCN
Type: SECTRACK ID: 1013408
Novell iChain Mini FTP Server Does Not Limit Invalid Authentication Attempts

Source: SECTRACK
Type: UNKNOWN
1013408

Source: CCN
Type: TID10096887
Security concern - iChain miniFTP server does not limit number of invalid logins

Source: CONFIRM
Type: Vendor Advisory
http://support.novell.com/cgi-bin/search/searchtid.cgi?/10096887.htm

Source: MISC
Type: Vendor Advisory
http://www.infobyte.com.ar/adv/ISR-05.html

Source: CCN
Type: Novell iChain Web Site
Novell iChain: Federated Single Sign-on

Source: OSVDB
Type: UNKNOWN
14648

Source: CCN
Type: OSVDB ID: 14648
Novell iChain Mini FTP Server Unlimited Login Attempt

Source: CCN
Type: OSVDB ID: 14836
Novell iChain Mini FTP Server Error Message User Enumeration

Source: CCN
Type: BID-12811
Novell iChain Mini FTP Server Remote Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
ichain-miniftp-bruteforce(19645)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:novell:ichain:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp1:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp1a:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp2:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp3:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2.113:*:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.3:*:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.3:sp2:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:novell:ichain:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:netware:6.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.3:*:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp1:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp2:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2:sp3:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.3:sp2:*:*:*:*:*:*
  • OR cpe:/a:novell:ichain:2.2.113:*:*:*:*:*:*:*
  • AND
  • cpe:/o:novell:netware:5.1:*:*:*:*:*:*:*
  • OR cpe:/o:novell:netware:6.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    novell ichain 2.2
    novell ichain 2.2 sp1
    novell ichain 2.2 sp1a
    novell ichain 2.2 sp2
    novell ichain 2.2 sp3
    novell ichain 2.2.113
    novell ichain 2.3
    novell ichain 2.3 sp2
    novell ichain 2.2
    novell netware 6.5
    novell ichain 2.3
    novell ichain 2.2 sp1
    novell ichain 2.2 sp2
    novell ichain 2.2 sp3
    novell ichain 2.3 sp2
    novell ichain 2.2.113
    novell netware 5.1
    novell netware 6.0