Detections
Analytics
Lotus Notes Password Hieroglyphics Information Disclosure
low Nessus Network Monitor Plugin ID 1305
Synopsis
The remote host may give an attacker information useful for future attacks.Description
The remote host is running a Lotus Notes 4.6 or 5.x email client. The login dialogue box used by these version of Notes includes a number of security features, including a set of four hieroglyphic characters. The goal of these characters is to increase the difficulty in spoofing the login dialog. An attacker with knowledge of the expected hieroglyphic sequence for a given login may use this dialogue to perform a brute force attack. This will eliminate a number of incorrect passwords, reducing the search space by approximately a factor of two. A conventional brute force attack against the remaining possibilities will then be required.Solution
Contact vendor for an upgrade/patch.Plugin Details
Severity: Low
ID: 1305
Family: SMTP Clients
Published: 8/20/2004
Updated: 3/6/2019
Reference Information
BID: 4324