Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-4566

Overview

Vulnerability Score 6.4 6.4
CVE Id CVE-2012-4566
Last Modified 20 Nov 2012 12:00:00
Published 19 Nov 2012 07:55:01
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2012-4566

Summary

The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523.

Vulnerable Systems

Application

  • Uninett Radsecproxy 1.0

  • Uninett Radsecproxy 1.1

  • Uninett Radsecproxy 1.2

  • Uninett Radsecproxy 1.3

  • Uninett Radsecproxy 1.3.1

  • Uninett Radsecproxy 1.4

  • Uninett Radsecproxy 1.4.1

  • Uninett Radsecproxy 1.4.2

  • Uninett Radsecproxy 1.4.3

  • Uninett Radsecproxy 1.5

  • Uninett Radsecproxy 1.6

  • Uninett Radsecproxy 1.6.1


References

MLIST - [radsecproxy] 20121025 Radsecproxy 1.6.1 is out

MLIST - [radsecproxy] 20120913 Radsecproxy is mixing up pre- and post-TLS-handshake client verification

MLIST - [oss-security] 20121031 Re: Re: CVE request: radsecproxy incorrect x.509 certificate validation

MLIST - [oss-security] 20121017 CVE request: radsecproxy incorrect x.509 certificate validation

DEBIAN - DSA-2573

SECUNIA - 51251

CONFIRM - http://git.nordu.net/?p=radsecproxy.git;a=commit;h=3682c935facf5ccd7fa600644bbb76957155c680


Last Updated: 27 May 2016 10:58:29