Vulnerability Name:
CVE-2012-4862 (CCN-79919)
Assigned:
2012-11-26
Published:
2012-11-26
Updated:
2017-08-29
Summary:
The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, which allows local users to obtain sensitive information via unspecified vectors.
CVSS v3 Severity:
4.0 Medium
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
)
Exploitability Metrics:
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
Low
Integrity (I):
None
Availibility (A):
None
CVSS v2 Severity:
2.1 Low
(CVSS v2 Vector:
AV:L/AC:L/Au:N/C:P/I:N/A:N
)
1.6 Low
(Temporal CVSS v2 Vector:
AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Local
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
None
Availibility (A):
None
1.9 Low
(CCN CVSS v2 Vector:
AV:L/AC:M/Au:N/C:P/I:N/A:N
)
1.4 Low
(CCN Temporal CVSS v2 Vector:
AV:L/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Local
Access Complexity (AC):
Medium
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
None
Availibility (A):
None
Vulnerability Type:
CWE-255
Vulnerability Consequences:
Obtain Information
References:
Source: MITRE
Type: CNA
CVE-2012-4862
Source: CCN
Type: SA51401
IBM Rational Developer for System z SSL Certificate Password Disclosure Security Issue
Source: SECUNIA
Type: UNKNOWN
51401
Source: CCN
Type: IBM Security Bulletin 1617886
Rational Developer for System z Host Connect emulator stores SSL certificate password in an insecure manner
Source: CONFIRM
Type: UNKNOWN
http://www.ibm.com/support/docview.wss?uid=swg21617886
Source: BID
Type: UNKNOWN
56725
Source: CCN
Type: BID-56725
IBM Rational Developer for System z SSL Certificate Local Information Disclosure Vulnerability
Source: SECTRACK
Type: UNKNOWN
1027818
Source: XF
Type: UNKNOWN
rdz-ssl-info-disclosure(79919)
Source: XF
Type: UNKNOWN
rdz-ssl-info-disclosure(79919)
Vulnerable Configuration:
Configuration 1
:
cpe:/a:ibm:rational_developer_for_system_z:7.1:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:7.6.2.1:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:7.6.2.2:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:7.6.2.3:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:7.6.2.4:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.1.0:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.2:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.3:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.3.1:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.3.2:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.3.3:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.5.0:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer:8.5.0.1:*:*:*:system_z:*:*:*
OR
cpe:/a:ibm:rational_developer:8.5.1:*:*:*:system_z:*:*:*
Configuration CCN 1
:
cpe:/a:ibm:rational_developer_for_system_z:7.1:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.0.1.0:*:*:*:*:*:*:*
OR
cpe:/a:ibm:rational_developer_for_system_z:8.5.0:*:*:*:*:*:*:*
Denotes that component is vulnerable
BACK
ibm
rational developer for system z 7.1
ibm
rational developer for system z 7.6.2.1
ibm
rational developer for system z 7.6.2.2
ibm
rational developer for system z 7.6.2.3
ibm
rational developer for system z 7.6.2.4
ibm
rational developer for system z 8.0.1.0
ibm
rational developer for system z 8.0.2
ibm
rational developer for system z 8.0.3
ibm
rational developer for system z 8.0.3.1
ibm
rational developer for system z 8.0.3.2
ibm
rational developer for system z 8.0.3.3
ibm
rational developer for system z 8.5.0
ibm
rational developer for system z 8.5.0.1
ibm
rational developer for system z 8.5.1
ibm
rational developer for system z 7.1
ibm
rational developer for system z 8.0.1.0
ibm
rational developer for system z 8.5.0