CVE

Id
6007  
CVE No.
CVE-2002-1623  
Status
Candidate  
Description
The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote.  
Phase
Assigned (20050326)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
34056 6007 CVE-2002-1623 BUGTRAQ:20020903 SecuRemote usernames can be guessed or sniffed using IKE exchange  View
34057 6007 CVE-2002-1623 URL:http://www.securityfocus.com/archive/1/290202  View
34058 6007 CVE-2002-1623 BUGTRAQ:20020911 RE: SecuRemote usernames can be guessed or sniffed using IKE  View
34059 6007 CVE-2002-1623 URL:http://marc.info/?l=bugtraq&m=103176164729351&w=2  View
34060 6007 CVE-2002-1623 MISC:http://www.nta-monitor.com/news/checkpoint.htm  View
34061 6007 CVE-2002-1623 FULLDISC:20020903 Check Point statement on use of IKE Aggressive Mode  View
34062 6007 CVE-2002-1623 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001223.html  View
34063 6007 CVE-2002-1623 BUGTRAQ:20020905 RE: SecuRemote usernames can be guessed or sniffed using IKE exchange  View
34064 6007 CVE-2002-1623 URL:http://marc.info/?l=bugtraq&m=103124812629621&w=2  View
34065 6007 CVE-2002-1623 CONFIRM:http://www.checkpoint.com/techsupport/alerts/ike.html  View
34066 6007 CVE-2002-1623 MISC:http://www.securiteam.com/securitynews/5TP040U8AW.html  View
34067 6007 CVE-2002-1623 CERT-VN:VU#886601  View
34068 6007 CVE-2002-1623 URL:http://www.kb.cert.org/vuls/id/886601  View
34069 6007 CVE-2002-1623 BID:5607  View
34070 6007 CVE-2002-1623 URL:http://www.securityfocus.com/bid/5607  View
34071 6007 CVE-2002-1623 XF:fw1-ike-username-enumeration(10034)  View

Related JVN