PT-2012-5454 · Openfabrics Alliance+2 · Librdmacm+2

Florian Weimer + 1 · Published 2012-10-22 · Updated 2023-02-13 · CVE-2012-4516

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions librdmacm version 1.0.16

Description The issue allows remote attackers to specify address resolution information for the application via a malicious ib acm service when ibacm.port is not specified, causing librdmacm to connect to port 6125.

Recommendations For librdmacm version 1.0.16, consider specifying the ibacm.port to avoid connecting to the default port 6125, which can be exploited by a malicious ib acm service. As a temporary workaround, restrict access to the ib acm service to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CESA-2013_1661

CVE-2012-4516

RHSA-2013:1661

RHSA-2013_1661

Affected Products

Centos

Red Hat

Librdmacm

References · 62

• 🔥 http://git.openfabrics.org/git?p=~shefty/librdmacm.git;a=commitdiff;h=4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d · Exploit
• https://ubuntu.com/security/CVE-2012-4516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4516 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4516 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2561 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1661.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-4516 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4516 · Vendor Advisory
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/013955.html · Note
• http://seclists.org/fulldisclosure/2013/Mar/87 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/020542.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/007164.html · Note
• http://openwall.com/lists/oss-security/2012/10/11/9 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/027234.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/027232.html · Note