Lucene search

[email protected]CVE-2010-4121

HistoryOct 03, 2022 - 4:21 p.m.

CVE-2010-4121

2022-10-0316:21:04

CWE-287

[email protected]

web.nvd.nist.gov

ibm

tivoli

provisioning manager

os deployment

7.1.1.3

tcp

odbc

gateway

sql

authentication

remote attack

database

vulnerability

cve-2010-4121

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.2%

JSON

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the "default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only.

Affected configurations

NVD

Node

ibmtivoli_provisioning_manager_os_deploymentMatch7.1.1.3

CPENameOperatorVersion
ibm:tivoli_provisioning_manager_os_deploymentibm tivoli provisioning manager os deploymenteq7.1.1.3

CPE	Name	Operator	Version
ibm:tivoli_provisioning_manager_os_deployment	ibm tivoli provisioning manager os deployment	eq	7.1.1.3

References

publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html

securitytracker.com/id?1024539

www.zerodayinitiative.com/advisories/ZDI-10-194

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.2%

JSON

Related for CVE-2010-4121

prion1 cvelist1 nvd1