PT-2013-3920 · Novell · Novell Kanaka+1
Published
2013-04-07
·
Updated
2020-05-11
·
CVE-2013-2770
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Novell Open Enterprise Server (OES) versions prior to 2.8
Description
The issue concerns the installation functionality in the Novell Kanaka component, which fails to verify the server's X.509 certificate during an SSL session. This allows man-in-the-middle attackers to spoof servers via an arbitrary certificate.
Recommendations
For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider disabling SSL sessions until a patch is available. Restrict access to the Novell Kanaka component to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Novell Kanaka
Novell Open Enterprise Server