Secunia

A security issue has been reported in Secure Global Desktop Enterprise Edition and Tarantella Enterprise, which can be exploited by malicious people to enumerate valid user accounts and disclose some system information.

The error message returned for failed logins discloses if the user account exists and if RSA SecurID authentication is in use.

Successful exploitation requires that RSA SecurID is enabled and that users share the same username.

The following products are reportedly affected:
* Secure Global Desktop Enterprise Edition, version 4.00
* Secure Global Desktop Enterprise Edition, version 3.42
* Tarantella Enterprise 3, version 3.40
* Tarantella Enterprise 3, version 3.30

Solution
Ensure that no RSA username is mapped to more than one ENS user object.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Eliot Mansfield.

Original Advisory
http://www.tarantella.com/security/bulletin-11.html

Deep Links
Links available in Customer Area