PT-2012-2818 · Ibm · Ibm Tivoli Directory Server

Published 2012-04-22 · Updated 2017-12-19 · CVE-2012-0726

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions 6.3 and earlier

Description The default configuration of TLS in the software supports the NULL-MD5 and NULL-SHA ciphers, allowing remote attackers to trigger unencrypted communication via the TLS Handshake Protocol.

Recommendations For versions 6.3 and earlier, consider disabling the NULL-MD5 and NULL-SHA ciphers to prevent unencrypted communication. As a temporary workaround, restrict access to the TLS Handshake Protocol until a more secure configuration can be implemented.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-0726

Affected Products

Ibm Tivoli Directory Server

References · 8

• http://ibm.com/support/docview.wss?uid=swg1IO15761 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg1IO16035 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg1IO16036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0726 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74303 · Note
• http://securitytracker.com/id?1026939 · Note
• http://securityfocus.com/bid/53043 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21591272 · Note