WordPress Password Reset username enumeration Vulnerability

Affected Versions:
WordPress 2.6.5/WordPress MU 2.7.1

Program introduction:

WordPress is a free forum Blog system.

Vulnerability Analysis:

WordPress returns different results for login attempts using existing and non-existing user names, which reduces the complexity of brute-force guessing attacks. In addition, when requesting a new password through password reset interface, different results are returned for existing and nonexistent user names.


Solution:
Vendor patch:

WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://wordpress.org/

Information Source:
<* Source: Fernando Arnaboldi

Link:Http://marc.info /? L = bugtraq & m = 124709299823452 & w = 2
*>