CVE-2013-4786
84Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 79%
from disclosure to weapon0 days
Published on NVDJul 8
1st PoCJul 2
metasploitJun 20
VulnCheck+3508d
exploitation probability
79%top 1% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
3 products (22 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
Affected products
n/a · n/apublic PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38633githubgithub.com/fin3ss3g0d/CosmicRakp★ 42vulncheckvulncheck.com/xdb/b1aca2030bfdunverifiedvulncheckvulncheck.com/xdb/f4aa7ebdaa8cunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://fish2.com/ipmi/remote-pw-cracking.htmlhttp://marc.info/?l=bugtraq&m=139653661621384&w=2https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmihttps://nvidia.custhelp.com/app/answers/detail/a_id/5010https://security.netapp.com/advisory/ntap-20190919-0005/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html