Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2012-4546 | First vendor Publication | 2013-04-02 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4546 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-16 | Configuration |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20737 | |||
| Oval ID: | oval:org.mitre.oval:def:20737 | ||
| Title: | RHSA-2013:0528: ipa security, bug fix and enhancement update (Low) | ||
| Description: | The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2013:0528-02 CESA-2013:0528 CVE-2012-4546 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | ipa |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24108 | |||
| Oval ID: | oval:org.mitre.oval:def:24108 | ||
| Title: | ELSA-2013:0528: ipa security, bug fix and enhancement update (Low) | ||
| Description: | The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013:0528-02 CVE-2012-4546 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | ipa |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27589 | |||
| Oval ID: | oval:org.mitre.oval:def:27589 | ||
| Title: | DEPRECATED: ELSA-2013-0528 -- ipa security, bug fix and enhancement update (low) | ||
| Description: | It was found that the current default configuration of IPA servers did not publish correct CRLs (Certificate Revocation Lists). The default configuration specifies that every replica is to generate its own CRL; however, this can result in inconsistencies in the CRL contents provided to clients from different Identity Management replicas. More specifically, if a certificate is revoked on one Identity Management replica, it will not show up on another Identity Management replica. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013-0528 CVE-2012-4546 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | ipa |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0528.nasl - Type : ACT_GATHER_INFO |
| 2013-03-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0528.nasl - Type : ACT_GATHER_INFO |
| 2013-03-05 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130221_ipa_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2013-02-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0528.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1445.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
| Source | Url |
|---|
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 22:57:42 |
|
| 2024-11-28 12:31:33 |
|
| 2021-05-04 12:21:38 |
|
| 2021-04-22 01:25:47 |
|
| 2020-05-23 00:34:41 |
|
| 2019-04-22 21:19:06 |
|
| 2014-02-17 11:13:23 |
|
| 2013-05-10 22:46:20 |
|
| 2013-04-03 17:18:20 |
|
| 2013-04-03 13:19:22 |
|
