PT-2018-4105 · Ibm · Ibm Tivoli Remote Control+1

Published 2018-04-27 · Updated 2018-06-04 · CVE-2013-5461

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Endpoint Manager for Remote Control versions 9.0.0 through 9.0.1 Tivoli Remote Control version 5.1.2

Description The issue allows remote attackers to more easily decrypt passwords by leveraging access to stored hashes of partial passwords.

Recommendations For IBM Endpoint Manager for Remote Control versions 9.0.0 through 9.0.1, update to a version that does not store multiple hashes of partial passwords to prevent easier decryption by attackers. For Tivoli Remote Control version 5.1.2, update to a version that does not store multiple hashes of partial passwords to prevent easier decryption by attackers.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-5461

Affected Products

Ibm Endpoint Manager For Remote Control

Ibm Tivoli Remote Control

References · 4

• https://ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-tivoli-remote-control-cve-2013-5461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5461 · Security Note
• https://ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-ibm-endpoint-manager-for-remote-control-cve-2013-5461 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88309 · Vendor Advisory