HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response. NOTE: this is referred to as a "memory leak" by some sources, but is better characterized as "memory disclosure."
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/509199/100/0/threaded | mailing list |
| http://osvdb.org/62015 | vdb entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/55978 | vdb entry |
| http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-003/-geo-r-gncaster-faulty-implementation-of-http-digest-authentication | exploit |
| http://secunia.com/advisories/38323 | third party advisory vendor advisory |