CVE-2010-4121

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the "default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html
http://securitytracker.com/id?1024539
http://www.zerodayinitiative.com/advisories/ZDI-10-194

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:tivoli_provisioning_manager_os_deployment:7.1.1.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-10-28 21:00

Updated : 2024-05-17 00:47

NVD link : CVE-2010-4121

Mitre link : CVE-2010-4121

CVE.ORG link : CVE-2010-4121

JSON object : View

Products Affected

ibm

tivoli_provisioning_manager_os_deployment

CWE

CWE-287

Improper Authentication

{"id": "CVE-2010-4121", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-10-28T21:00:14.950", "references": [{"url": "http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1024539", "source": "cve@mitre.org"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-194", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the \"default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only."}, {"lang": "es", "value": "**CUESTIONADA** El gateway TCP-to-ODBC en IBM Tivoli Provisioning Manager para OS Deployment v7.1.1.3 no requiere autenticaci\u00f3n para paticiones SQL, lo cual permite a los atacantes remotos modificar, crear, o leer registros de base de datos a trav\u00e9s de una sesi\u00f3n TCP en el puerto 2020. NOTA: El vendedor no esta de acuerdo con este hecho, bas\u00e1ndose en que \"la base de datos por defecto de Microsoft Access no est\u00e1 protegida con contrase\u00f1a porque se destina a ser utilizada para fines de evaluaci\u00f3n\"."}], "lastModified": "2024-05-17T00:47:47.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_provisioning_manager_os_deployment:7.1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CCA289A-34A6-45D0-A953-77F8AA51EF20"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}