|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
System administrators will often disable an account after it is no longer being used. This is intended to lock the account out so that it may not be used until the administrator re-enables it. Historically, there have been several vulnerabilities that affect system behavior in regards to disabled accounts. Such vulnerabilities have allowed attackers to log into these accounts by bypassing the lockout. Administrators may also make global account changes that inadvertantly affect disabled accounts.
|
|
Classification |
Location:
Local Access Required,
Remote/Network Access Required
Attack Type:
Authentication Management
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Best Practice
|
|
Solution |
Administrators should maintain a strong user account policy which includes deleting accounts instead of disabling them.
|
|
Products |
|
All Products
 |
All Versions |
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
