CVE-2002-0994

SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing the random byte challenge, which is used as the key for encrypted communications.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/5146	Exploit Vendor Advisory
http://www.iss.net/security_center/static/9476.php	Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0003.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:sun:sun_pci_ii_driver:2.3:*:*:*:*:*:*:*

Information

Published : 2002-10-03 21:00

Updated : 2008-09-05 13:29

NVD link : CVE-2002-0994

Mitre link : CVE-2002-0994

JSON object : View

CWE

NVD-CWE-Other

Products Affected

sun

sun_pci_ii_driver

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/5146", "name": "5146", "tags": ["Exploit", "Vendor Advisory"], "refsource": "BID"}, {"url": "http://www.iss.net/security_center/static/9476.php", "name": "sunpci-vnc-weak-authentication(9476)", "tags": ["Vendor Advisory"], "refsource": "XF"}, {"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0003.html", "name": "20020703 SunPCi II VNC weak authentication scheme vulnerability", "tags": [], "refsource": "VULNWATCH"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing the random byte challenge, which is used as the key for encrypted communications."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2002-0994", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2002-10-04T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sun:sun_pci_ii_driver:2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-05T20:29Z"}

7.5 /10