Details of VAR-201407-0497

ID

VAR-201407-0497

CVE

CVE-2014-0860

TITLE

plural IBM Any in the product firmware IPMI Command execution vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-003205

DESCRIPTION

The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface. Multiple IBM Products are prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. The vulnerability stems from the fact that the program stores plaintext IPMI certificates. An attacker can exploit this vulnerability to execute arbitrary IPMI commands and establish a remote control session of the blade

Trust: 1.98

sources: NVD: CVE-2014-0860 // JVNDB: JVNDB-2014-003205 // BID: 68400 // VULHUB: VHN-68353

AFFECTED PRODUCTS

vendor:	ibm	model:	integrated management module	scope:	lte	version:	1.36	Trust: 1.0
vendor:	ibm	model:	advanced management module	scope:	lte	version:	3.65	Trust: 1.0
vendor:	ibm	model:	advanced management module	scope:	eq	version:	-	Trust: 1.0
vendor:	ibm	model:	integrated management module ii	scope:	lte	version:	3.65	Trust: 1.0
vendor:	ibm	model:	integrated management module ii	scope:	eq	version:	-	Trust: 1.0
vendor:	ibm	model:	integrated management module	scope:	eq	version:	-	Trust: 1.0
vendor:	ibm	model:	bladecenter management module	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	bladecenter management module	scope:	lt	version:	3.66e	Trust: 0.8
vendor:	ibm	model:	integrated management module	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	integrated management module ii	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	integrated management module ii	scope:	lt	version:	4.15	Trust: 0.8
vendor:	ibm	model:	integrated management module	scope:	lt	version:	1.43	Trust: 0.8
vendor:	ibm	model:	integrated management module	scope:	eq	version:	1.36	Trust: 0.6
vendor:	ibm	model:	integrated management module ii	scope:	eq	version:	3.65	Trust: 0.6
vendor:	ibm	model:	advanced management module	scope:	eq	version:	3.65	Trust: 0.6
vendor:	ibm	model:	integrated management module yuoog2c	scope:	eq	version:	1.42	Trust: 0.3
vendor:	ibm	model:	bladecenter -t	scope:	eq	version:	8730	Trust: 0.3
vendor:	ibm	model:	bladecenter -t	scope:	eq	version:	8720	Trust: 0.3
vendor:	ibm	model:	bladecenter -s	scope:	eq	version:	8886	Trust: 0.3
vendor:	ibm	model:	bladecenter -s	scope:	eq	version:	7779	Trust: 0.3
vendor:	ibm	model:	bladecenter -s	scope:	eq	version:	1948	Trust: 0.3
vendor:	ibm	model:	bladecenter -ht	scope:	eq	version:	8750	Trust: 0.3
vendor:	ibm	model:	bladecenter -ht	scope:	eq	version:	8740	Trust: 0.3
vendor:	ibm	model:	bladecenter -h	scope:	eq	version:	8852	Trust: 0.3
vendor:	ibm	model:	bladecenter -h	scope:	eq	version:	7989	Trust: 0.3
vendor:	ibm	model:	bladecenter -h	scope:	eq	version:	1886	Trust: 0.3
vendor:	ibm	model:	bladecenter -e	scope:	eq	version:	8677	Trust: 0.3
vendor:	ibm	model:	bladecenter -e	scope:	eq	version:	7967	Trust: 0.3
vendor:	ibm	model:	bladecenter -e	scope:	eq	version:	1881	Trust: 0.3
vendor:	ibm	model:	bladecenter t advanced management module 32r0835	scope:	eq	version:	0	Trust: 0.3
vendor:	ibm	model:	bladecenter hx5	scope:	eq	version:	7873	Trust: 0.3
vendor:	ibm	model:	bladecenter hx5	scope:	eq	version:	7872	Trust: 0.3
vendor:	ibm	model:	bladecenter hs23e	scope:	eq	version:	8039	Trust: 0.3
vendor:	ibm	model:	bladecenter hs23e	scope:	eq	version:	8038	Trust: 0.3
vendor:	ibm	model:	bladecenter hs23	scope:	eq	version:	7875	Trust: 0.3
vendor:	ibm	model:	bladecenter hs23	scope:	eq	version:	1929	Trust: 0.3
vendor:	ibm	model:	bladecenter hs22v	scope:	eq	version:	7871	Trust: 0.3
vendor:	ibm	model:	bladecenter hs22v	scope:	eq	version:	1949	Trust: 0.3
vendor:	ibm	model:	bladecenter hs22	scope:	eq	version:	7870	Trust: 0.3
vendor:	ibm	model:	bladecenter hs22	scope:	eq	version:	1936	Trust: 0.3
vendor:	ibm	model:	bladecenter hs22	scope:	eq	version:	1911	Trust: 0.3
vendor:	ibm	model:	bladecenter advanced management module bpet66d 3.66d	scope:	-	version:	-	Trust: 0.3
vendor:	ibm	model:	bladecenter advanced management module bpeo66d 3.66d	scope:	-	version:	-	Trust: 0.3
vendor:	ibm	model:	bladecenter advanced management module bbet66d 3.66d	scope:	-	version:	-	Trust: 0.3
vendor:	ibm	model:	bladecenter advanced management module 25r5778	scope:	eq	version:	0	Trust: 0.3
vendor:	ibm	model:	integrated management module yuoog6b	scope:	ne	version:	1.43	Trust: 0.3
vendor:	ibm	model:	integrated management module ii aoo58k	scope:	ne	version:	4.15	Trust: 0.3
vendor:	ibm	model:	advanced management module bpet66e 3.66e	scope:	ne	version:	-	Trust: 0.3
vendor:	ibm	model:	advanced management module bpeo66e 3.66e	scope:	ne	version:	-	Trust: 0.3
vendor:	ibm	model:	advanced management module bbet66e 3.66e	scope:	ne	version:	-	Trust: 0.3

sources: BID: 68400 // JVNDB: JVNDB-2014-003205 // CNNVD: CNNVD-201407-159 // NVD: CVE-2014-0860

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-0860
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-0860
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201407-159
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-68353
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-0860
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-68353
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-68353 // JVNDB: JVNDB-2014-003205 // CNNVD: CNNVD-201407-159 // NVD: CVE-2014-0860

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-68353 // JVNDB: JVNDB-2014-003205 // NVD: CVE-2014-0860

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201407-159

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201407-159

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-003205

PATCH

title:	MIGR-5095840	url:	http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840	Trust: 0.8
title:	ibm_fw_imm2_1aoo58k-4.15_bc-anyos_noarch	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51010	Trust: 0.6

sources: JVNDB: JVNDB-2014-003205 // CNNVD: CNNVD-201407-159

EXTERNAL IDS

db:	NVD	id:	CVE-2014-0860	Trust: 2.8
db:	XF	id:	90880	Trust: 1.4
db:	JVNDB	id:	JVNDB-2014-003205	Trust: 0.8
db:	CNNVD	id:	CNNVD-201407-159	Trust: 0.7
db:	BID	id:	68400	Trust: 0.4
db:	VULHUB	id:	VHN-68353	Trust: 0.1

sources: VULHUB: VHN-68353 // BID: 68400 // JVNDB: JVNDB-2014-003205 // CNNVD: CNNVD-201407-159 // NVD: CVE-2014-0860

REFERENCES

url:	http://www.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095840	Trust: 1.7
url:	http://xforce.iss.net/xforce/xfdb/90880	Trust: 1.4
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/90880	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0860	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0860	Trust: 0.8
url:	http://www.ibm.com/	Trust: 0.3
url:	http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095840	Trust: 0.3

sources: VULHUB: VHN-68353 // BID: 68400 // JVNDB: JVNDB-2014-003205 // CNNVD: CNNVD-201407-159 // NVD: CVE-2014-0860

CREDITS

IBM

Trust: 0.3

sources: BID: 68400

SOURCES

db:	VULHUB	id:	VHN-68353
db:	BID	id:	68400
db:	JVNDB	id:	JVNDB-2014-003205
db:	CNNVD	id:	CNNVD-201407-159
db:	NVD	id:	CVE-2014-0860

LAST UPDATE DATE

2024-11-23T23:02:44.699000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-68353	date:	2017-08-29T00:00:00
db:	BID	id:	68400	date:	2014-05-12T00:00:00
db:	JVNDB	id:	JVNDB-2014-003205	date:	2014-07-08T00:00:00
db:	CNNVD	id:	CNNVD-201407-159	date:	2014-07-08T00:00:00
db:	NVD	id:	CVE-2014-0860	date:	2024-11-21T02:02:55.597

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-68353	date:	2014-07-07T00:00:00
db:	BID	id:	68400	date:	2014-05-12T00:00:00
db:	JVNDB	id:	JVNDB-2014-003205	date:	2014-07-08T00:00:00
db:	CNNVD	id:	CNNVD-201407-159	date:	2014-07-08T00:00:00
db:	NVD	id:	CVE-2014-0860	date:	2014-07-07T11:01:28.680