CVE-2012-2328

2014-02-1018:15:09

CWE-310

[email protected]

web.nvd.nist.gov

cve-2012-2328

sblim

cim client

dos

xml

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.5%

JSON

internal/cimxml/sax/NodeFactory.java in Standards-Based Linux Instrumentation for Manageability (SBLIM) Common Information Model (CIM) Client (aka sblim-cim-client2) before 2.1.12 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML file.

Affected configurations

NVD

Node

standards_based_linux_instrumentation_projectstandards-based_linux_common_information_model_clientRange≤2.1.11

opensuseopensuseMatch11.4

opensuseopensuseMatch12.1

opensuseopensuseMatch12.2

CPENameOperatorVersion
standards_based_linux_instrumentation_project:standards-based_linux_common_information_model_clientstandards based linux instrumentation project standards-based linux common information model clientle2.1.11
opensuse:opensuseopensuseeq11.4
opensuse:opensuseopensuseeq12.1
opensuse:opensuseopensuseeq12.2

CPE	Name	Operator	Version
standards_based_linux_instrumentation_project:standards-based_linux_common_information_model_client	standards based linux instrumentation project standards-based linux common information model client	le	2.1.11
opensuse:opensuse	opensuse	eq	11.4
opensuse:opensuse	opensuse	eq	12.1
opensuse:opensuse	opensuse	eq	12.2