CVE-1999-1324 Security feature bypass in n/a
Attackers can bypass account lockout mechanisms on OpenVMS systems to perform brute-force password guessing and potentially take over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-1999-1324?
CVE-1999-1324 is a critical vulnerability in n/a, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing.
Weakness: CWE-307
Which versions are affected by CVE-1999-1324?
It affects 1 product.
Products include Hp Openvms Vax.
How do I fix CVE-1999-1324?
No fix has been published for CVE-1999-1324 yet. Limit exposure of the affected software until one is available.
Is CVE-1999-1324 being exploited?
There is no known exploitation of CVE-1999-1324 in the wild and no public exploit code.
Sources
Also known as GHSA-5r36-3w36-p2fp.