PT-2012-5511 · Websense · Websense Email Security

Publicado 2012-08-23 · Atualizado 2017-08-29 · CVE-2012-4605

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Email Security versions 6.1 through 7.3

Description The default configuration of the SMTP component enables weak SSL ciphers, making it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.

Recommendations For Websense Email Security versions 6.1 through 7.3, consider disabling the use of weak SSL ciphers in the SMTP component to minimize the risk of exploitation. Restrict access to the SMTP configuration to prevent unauthorized changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-4605

Produtos afetados

Websense Email Security

Referências · 4

• http://websense.com/support/article/kbarticle/SSL-TLS-weak-and-export-ciphers-detected-in-Websense-Email-Security-deployments · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78131 · Nota
• http://securityfocus.com/bid/64758 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4605 · Nota de Segurança