PT-2014-6437 · Adaptive Computing · Adaptive Computing Moab

Published 2014-10-08 · Updated 2018-10-09 · CVE-2014-5376

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adaptive Computing Moab versions prior to 7.2.9 Adaptive Computing Moab version 8 before 8.0.0

Description The issue allows remote authenticated users to impersonate arbitrary users via the actor field in a message, due to the lack of validation that the requesting user matches the actor in the message when a pre-generated key is used.

Recommendations For Adaptive Computing Moab versions prior to 7.2.9, update to version 7.2.9 or later. For Adaptive Computing Moab version 8 before 8.0.0, update to version 8.0.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-5376

Affected Products

Adaptive Computing Moab

References · 6

• 🔥 http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5376 · Security Note
• http://adaptivecomputing.com/security-advisory · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96700 · Note
• http://securityfocus.com/bid/70171 · Note
• http://securityfocus.com/archive/1/533577/100/0/threaded · Note