CVE-2012-2681

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2012-1281.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1278.html	Vendor Advisory
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558	Exploit
http://www.securityfocus.com/bid/55618
http://secunia.com/advisories/50660
https://exchange.xforce.ibmcloud.com/vulnerabilities/78771

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:::::::*
	cpe:2.3:a:trevor_mckay:cumin::::::::
	cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:::::::*
	cpe:2.3:o:redhat:enterprise_mrg:2.0:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:::::::*
	cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:::::::*

Information

Published : 2012-09-28 10:55

Updated : 2021-07-15 12:16

NVD link : CVE-2012-2681

Mitre link : CVE-2012-2681

JSON object : View

CWE

CWE-310

Cryptographic Issues

Advertisement

Products Affected

trevor_mckay

cumin

redhat

enterprise_mrg

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html", "name": "RHSA-2012:1281", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html", "name": "RHSA-2012:1278", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558", "name": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/55618", "name": "55618", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/50660", "name": "50660", "tags": [], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78771", "name": "cumin-redhat-weak-security(78771)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-2681", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-09-28T17:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.1.5192-4"}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-07-15T19:16Z"}