PT-2012-5511 · Websense · Websense Email Security

Published 2012-08-23 · Updated 2017-08-29 · CVE-2012-4605

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Email Security versions 6.1 through 7.3

Description The default configuration of the SMTP component enables weak SSL ciphers, making it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.

Recommendations For Websense Email Security versions 6.1 through 7.3, consider disabling the use of weak SSL ciphers in the SMTP component to minimize the risk of exploitation. Restrict access to the SMTP configuration to prevent unauthorized changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-4605

Affected Products

Websense Email Security

References · 4

• http://websense.com/support/article/kbarticle/SSL-TLS-weak-and-export-ciphers-detected-in-Websense-Email-Security-deployments · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4605 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78131 · Note
• http://securityfocus.com/bid/64758 · Note