PT-2013-3920 · Novell · Novell Kanaka+1

Publicado 2013-04-07 · Atualizado 2020-05-11 · CVE-2013-2770

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Novell Open Enterprise Server (OES) versions prior to 2.8

Description The issue concerns the installation functionality in the Novell Kanaka component, which fails to verify the server's X.509 certificate during an SSL session. This allows man-in-the-middle attackers to spoof servers via an arbitrary certificate.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider disabling SSL sessions until a patch is available. Restrict access to the Novell Kanaka component to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-2770

Produtos afetados

Novell Kanaka

Novell Open Enterprise Server

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-2770 · Nota de Segurança
• http://novell.com/support/kb/doc.php?id=7011965 · Aviso do Fabricante