CVE-2012-3018

The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response.

CVSS v2.0 4.4 MEDIUM

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf	US Government Resource

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:iconics:genesis32::::::::
	cpe:2.3:a:iconics:genesis32:9.13:::::::*
	cpe:2.3:a:iconics:genesis32:9.21:::::::*
	cpe:2.3:a:iconics:genesis32:9.0:::::::*
	cpe:2.3:a:iconics:genesis32:9.2:::::::*
	cpe:2.3:a:iconics:genesis32:9.20:::::::*
	cpe:2.3:a:iconics:genesis32:9.1:::::::*
	cpe:2.3:a:iconics:genesis32:9.01:::::::*
	cpe:2.3:a:iconics:genesis32:8.05:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:iconics:bizviz:9.20:::::::*
	cpe:2.3:a:iconics:bizviz:8.05:::::::*
	cpe:2.3:a:iconics:bizviz:9.0:::::::*
	cpe:2.3:a:iconics:bizviz:9.1:::::::*
	cpe:2.3:a:iconics:bizviz:9.01:::::::*
	cpe:2.3:a:iconics:bizviz:9.13:::::::*
	cpe:2.3:a:iconics:bizviz::::::::
	cpe:2.3:a:iconics:bizviz:9.21:::::::*
	cpe:2.3:a:iconics:bizviz:9.2:::::::*

Information

Published : 2012-07-31 03:45

Updated : 2012-07-31 03:45

NVD link : CVE-2012-3018

Mitre link : CVE-2012-3018

JSON object : View

CWE

CWE-310

Cryptographic Issues

Advertisement

Products Affected

iconics

bizviz
genesis32

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf", "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf", "tags": ["US Government Resource"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-3018", "ASSIGNER": "ics-cert@hq.dhs.gov"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-07-31T10:45Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:iconics:genesis32:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.22"}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:9.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:genesis32:8.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:8.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.22"}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:iconics:bizviz:9.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2012-07-31T10:45Z"}