PT-2012-5704 · Forescout · Forescout Counteract

Published 2012-12-05 · Updated 2017-08-29 · CVE-2012-4985

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forescout CounterACT NAC device version 6.3.4.1

Description The issue allows remote attackers to conduct ARP poisoning attacks via crafted packets, as the device does not block ARP and ICMP traffic from unrecognized clients.

Recommendations For version 6.3.4.1, consider configuring the device to block ARP and ICMP traffic from unrecognized clients as a temporary workaround until a patch is available. Restrict access to the network to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4985

Affected Products

Forescout Counteract

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-4985 · Security Note
• http://securityfocus.com/bid/56689 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80284 · Note
• http://osvdb.org/87895 · Note
• http://reactionpenetrationtesting.co.uk/forescout-nac-icmp-arp.html · Note