PT-2012-2818 · Ibm · Ibm Tivoli Directory Server

Publicado 2012-04-22 · Atualizado 2017-12-19 · CVE-2012-0726

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions 6.3 and earlier

Description The default configuration of TLS in the software supports the NULL-MD5 and NULL-SHA ciphers, allowing remote attackers to trigger unencrypted communication via the TLS Handshake Protocol.

Recommendations For versions 6.3 and earlier, consider disabling the NULL-MD5 and NULL-SHA ciphers to prevent unencrypted communication. As a temporary workaround, restrict access to the TLS Handshake Protocol until a more secure configuration can be implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-0726

Produtos afetados

Ibm Tivoli Directory Server

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/74303 · Nota
• http://ibm.com/support/docview.wss?uid=swg1IO15761 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg1IO16035 · Aviso do Fabricante
• http://securitytracker.com/id?1026939 · Nota
• http://securityfocus.com/bid/53043 · Nota
• http://ibm.com/support/docview.wss?uid=swg1IO16036 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21591272 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0726 · Nota de Segurança