CVE-2013-4786

2013-07-0800:00:00

ubuntu.com

125

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.29

Percentile

96.9%

JSON

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange
Protocol (RAKP) authentication, which allows remote attackers to obtain
password hashes and conduct offline password guessing attacks by obtaining
the HMAC from a RAKP message 2 response from a BMC.

Notes

Author	Note
jdstrand	protocol problem. Not clear if fixes also need to be addressed in freeipmi and openipmi per Debian: “Contacted relevant maintainers: Since few to no devices do mutual authentication, tools shipped by Debian are generally not affected. At best, the tools can print a warning for vulnerable devices.”