Portcullis Security Advisory 06-038

Portcullis Security Advisory 06-038

Vulnerable System:

Movable Type

Vulnerability Title:

Username enumeration is possible via the password reset mechanism.

Vulnerability Discovery And Development:

Portcullis Security Testing Services.

Credit For Discovery:

Tim Brown - Porcullis Computer Security Ltd.

Affected systems:

All known versions of Movable Type, this vulnerability was discovered for version 3.16.

Details:

Requesting the URL http://webserver/path/to/mt.cgi?__mode=recover&amp;name=&lt;username&gt; returns pages containing different error messages dependent on whether an account with that username exists in the authentication database or not. If an account with that username exists, the error message is "'Birthplace' does not match stored 'birthplace' for this author"; however, if no account with that username exists, then the error message "No such author with name '<username>'" is instead returned.

Impact:

An attacker could use this to enumerate the account usernames which exist in the authentication database.

Exploit:

Exploit code is not required.

Copyright:

Copyright © Portcullis Computer Security Limited 2005, All rights reserved worldwide.
Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.