PT-2014-3209 · Enghouse Interactive+1 · Enghouse Interactive Ivr Pro+1

Publicado 2014-01-28 · Atualizado 2014-01-31 · CVE-2013-6838

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enghouse Interactive IVR Pro (VIP2000) version 9.0.3

Description The issue concerns an unspecified "addon product" in Enghouse Interactive IVR Pro, where the same SSH private key is used across different customers' installations when OpenVZ and fallback customization are utilized. This allows remote attackers to gain privileges by leveraging knowledge of this key.

Recommendations For Enghouse Interactive IVR Pro (VIP2000) version 9.0.3, consider regenerating and using unique SSH private keys for each customer's installation to prevent unauthorized access. As a temporary workaround, restrict access to the SSH service until a more permanent solution can be implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-6838

Produtos afetados

Enghouse Interactive Ivr Pro

Openvz

Referências · 3

• http://seclists.org/fulldisclosure/2014/Jan/103 · Nota
• https://xpd.se/advisories/XPD-2013-001.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6838 · Nota de Segurança