{"id": "CVE-2017-5186", "bulletinFamily": "NVD", "title": "CVE-2017-5186", "description": "Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2 (9.0.2.2) use the deprecated MD5 hashing algorithm in a communications certificate.", "published": "2017-04-27T14:59:00", "modified": "2019-10-03T00:03:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5186", "reporter": "cve@mitre.org", "references": ["https://www.novell.com/support/kb/doc.php?id=7010166", "https://www.novell.com/support/kb/doc.php?id=3426981", "https://bugzilla.novell.com/show_bug.cgi?id=988749", "https://www.novell.com/support/kb/doc.php?id=7016794", "https://bugzilla.novell.com/show_bug.cgi?id=1019041", "https://www.novell.com/support/kb/doc.php?id=7016795", "https://bugzilla.novell.com/show_bug.cgi?id=1019789"], "cvelist": ["CVE-2017-5186"], "type": "cve", "lastseen": "2020-12-09T20:13:33", "edition": 6, "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310140224"]}], "modified": "2020-12-09T20:13:33", "rev": 2}, "score": {"value": 3.0, "vector": "NONE", "modified": "2020-12-09T20:13:33", "rev": 2}, "vulnersScore": 3.0}, "cpe": ["cpe:/a:netiq:edirectory:9.0.1", "cpe:/a:netiq:edirectory:9.0.2", "cpe:/a:netiq:edirectory:9.0", "cpe:/a:netiq:imanager:3.0.1", "cpe:/a:novell:imanager:2.7", "cpe:/a:novell:edirectory:8.8", "cpe:/a:netiq:imanager:3.0.2", "cpe:/a:netiq:imanager:3.0"], "affectedSoftware": [{"cpeName": "novell:imanager", "name": "novell imanager", "operator": "le", "version": "2.7"}, {"cpeName": "netiq:edirectory", "name": "netiq edirectory", "operator": "eq", "version": "9.0.1"}, {"cpeName": "netiq:edirectory", "name": "netiq edirectory", "operator": "eq", "version": "9.0.2"}, {"cpeName": "netiq:imanager", "name": "netiq imanager", "operator": "eq", "version": "3.0"}, {"cpeName": "novell:edirectory", "name": "novell edirectory", "operator": "le", "version": "8.8"}, {"cpeName": "netiq:imanager", "name": "netiq imanager", "operator": "eq", "version": "3.0.1"}, {"cpeName": "netiq:imanager", "name": "netiq imanager", "operator": "eq", "version": "3.0.2"}, {"cpeName": "netiq:edirectory", "name": "netiq edirectory", "operator": "eq", "version": "9.0"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:novell:imanager:2.7:sp7_patch8:*:*:*:*:*:*", "cpe:2.3:a:netiq:imanager:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:netiq:edirectory:9.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:netiq:imanager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:netiq:imanager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:novell:edirectory:8.8:sp8_patch9:*:*:*:*:*:*", "cpe:2.3:a:netiq:edirectory:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:netiq:edirectory:9.0.2:*:*:*:*:*:*:*"], "cwe": ["CWE-327"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:novell:edirectory:8.8:sp8_patch9:*:*:*:*:*:*", "versionEndIncluding": "8.8", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:edirectory:9.0.2:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:imanager:2.7:sp7_patch8:*:*:*:*:*:*", "versionEndIncluding": "2.7", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:imanager:3.0.2:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:imanager:3.0:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:edirectory:9.0.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:imanager:3.0.1:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:netiq:edirectory:9.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}}

{"openvas": [{"lastseen": "2020-06-10T19:33:36", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-9167", "CVE-2016-9168", "CVE-2017-5186"], "description": "This host is installed with Novell / NetIQ eDirectory\n and is prone to multiple vulnerabilities.", "modified": "2020-06-08T00:00:00", "published": "2017-03-30T00:00:00", "id": "OPENVAS:1361412562310140224", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310140224", "type": "openvas", "title": "Novell eDirectory Multiple Vulnerabilities - Mar17", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Novell / NetIQ eDirectory Multiple Vulnerabilities - Mar17\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.140224\");\n script_version(\"2020-06-08T10:12:14+0000\");\n script_cve_id(\"CVE-2016-9167\", \"CVE-2016-9168\", \"CVE-2017-5186\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-06-08 10:12:14 +0000 (Mon, 08 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-03-30 12:28:05 +0200 (Thu, 30 Mar 2017)\");\n script_name(\"Novell eDirectory Multiple Vulnerabilities - Mar17\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Novell / NetIQ eDirectory\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"- Security scan shows potential Clickjacking vulnerability (Bug 998565) (CVE-2016-9168)\n\n - Includes a security fix to address potential access inconsistencies (Bug 993219) (CVE-2016-9167)\n\n - Uses a deprecated MD5 hashing algorithm in a communications certificate (CVE-2017-5186)\");\n\n script_tag(name:\"affected\", value:\"Novell / NetIQ eDirectory versions prior to 9.0.2 Hotfix 2.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Novell / NetIQ eDirectory 9.0.2 Hotfix 2 or later.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n script_xref(name:\"URL\", value:\"https://www.novell.com/support/kb/doc.php?id=7016794\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"novell_edirectory_detect.nasl\");\n script_mandatory_keys(\"eDirectory/installed\");\n script_require_ports(\"Services/ldap\", 389, 636);\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\ncpe_list = make_list( \"cpe:/a:novell:edirectory\", \"cpe:/a:netiq:edirectory\" );\n\nif( ! infos = get_app_port_from_list( cpe_list:cpe_list ) )\n exit( 0 );\n\ncpe = infos[\"cpe\"];\nport = infos[\"port\"];\n\nif( ! major = get_app_version( cpe:cpe, port:port ) )\n exit( 0 );\n\nif( major !~ \"^9\\.\" )\n exit( 99 );\n\nif( ! sp = get_kb_item( \"ldap/eDirectory/\" + port + \"/sp\" ) )\n sp = \"0\";\n\ninstvers = major;\n\nif( sp > 0 )\n instvers += ' SP' + sp;\n\nrevision = get_kb_item( \"ldap/eDirectory/\" + port + \"/build\" );\nrevision = str_replace( string:revision, find:\".\", replace:\"\" );\n\nif( version_is_less( version:major, test_version:\"9.0.2\" ) ||\n ( major == \"9.0.2\" && int( revision ) < 4000456 ) ) {\n report = report_fixed_ver(installed_version:instvers, fixed_version:\"9.0.2 Hotfix 2\");\n security_message(data:report, port:port);\n exit(0);\n}\n\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}]}