Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2012-4566 | First vendor Publication | 2012-11-19 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4566 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18256 | |||
| Oval ID: | oval:org.mitre.oval:def:18256 | ||
| Title: | DSA-2573-1 radsecproxy - SSL certificate verification weakness | ||
| Description: | Ralf Paffrath reported that Radsecproxy, a RADIUS protocol proxy, mixed up pre- and post-handshake verification of clients. This vulnerability may wrongly accept clients without checking their certificate chain under certain configurations. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2573-1 CVE-2012-4523 CVE-2012-4566 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | radsecproxy |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-16 | Name : Debian Security Advisory DSA 2573-1 (radsecproxy) File : nvt/deb_2573_1.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-11-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2573.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 22:59:01 |
|
| 2024-11-28 12:31:35 |
|
| 2023-11-07 21:46:36 |
|
| 2021-06-11 01:10:20 |
|
| 2021-05-04 12:21:39 |
|
| 2021-04-22 01:25:47 |
|
| 2020-05-23 01:49:43 |
|
| 2020-05-23 00:34:42 |
|
| 2016-04-26 22:15:49 |
|
| 2014-02-17 11:13:26 |
|
| 2013-05-10 22:46:26 |
|
| 2012-11-20 21:20:47 |
|
| 2012-11-20 13:22:37 |
|
