PT-2013-1497 · Suse · Webyast

Published 2013-01-26 · Updated 2013-01-28 · CVE-2012-0435

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SUSE WebYaST versions prior to 1.2 0.2.63-0.6.1

Description The issue allows remote attackers to modify the hosts list and subsequently conduct man-in-the-middle attacks via a crafted request on TCP port 4984 to the /host endpoint.

Recommendations For versions prior to 1.2 0.2.63-0.6.1, update to version 1.2 0.2.63-0.6.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2012-0435

Affected Products

Webyast

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-0435 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00008.html · Vendor Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=792712 · Note
• http://support.novell.com/security/cve/CVE-2012-0435.html · Note
• http://kb.cert.org/vuls/id/806908 · Note