PT-2012-4442 · Iconics · Bizviz+1

Publicado 2012-07-31 · Atualizado 2012-07-31 · CVE-2012-3018

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS32 versions 9.22 and earlier BizViz versions 9.22 and earlier

Description The issue concerns the lockout-recovery feature in the Security Configurator component, which uses an improper encryption algorithm for generating an authentication code. This allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response.

Recommendations For ICONICS GENESIS32 versions 9.22 and earlier, update to a version that addresses the improper encryption algorithm used in the lockout-recovery feature. For BizViz versions 9.22 and earlier, update to a version that addresses the improper encryption algorithm used in the lockout-recovery feature.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-3018

Produtos afetados

Bizviz

Iconics Genesis32

Referências · 2

• http://us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3018 · Nota de Segurança