CVE-2011-0935

{"id": "CVE-2011-0935", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-04-14T16:55:01.317", "references": [{"url": "http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html", "source": "ykramarz@cisco.com"}, {"url": "http://www.cisco.com/en/US/docs/ios/15_1s/release/notes/15_1s_caveats_15_1_1s.html", "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/47407", "source": "ykramarz@cisco.com"}, {"url": "http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.cisco.com/en/US/docs/ios/15_1s/release/notes/15_1s_caveats_15_1_1s.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/47407", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The PKI functionality in Cisco IOS 15.0 and 15.1 does not prevent permanent caching of certain public keys, which allows remote attackers to bypass authentication and have unspecified other impact by leveraging an IKE peer relationship in which a key was previously valid but later revoked, aka Bug ID CSCth82164, a different vulnerability than CVE-2010-4685."}, {"lang": "es", "value": "La funcionalidad de PKI en Cisco IOS v15.0 y v15.1 no impide el almacenamiento en cach\u00e9 permanente de ciertas claves p\u00fablicas, lo que permite evitar la autenticaci\u00f3n a atacantes remotos y tener otros impactos no especificados mediante el aprovechamiento de una relaci\u00f3n IKE en el que una clave que ha sido v\u00e1lida es posteriormente revocada. Vulnerabilidad tambi\u00e9n conocida como Bug ID CSCth82164. Se trata de una vulnerabilidad diferente a CVE-2010-4685.\r\n"}], "lastModified": "2024-11-21T01:25:11.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF87CC9A-1AF5-4DB4-ACE5-DB938D3B2F84"}, {"criteria": "cpe:2.3:o:cisco:ios:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB41294E-F3DF-4F1E-A4C8-E90B21A88836"}], "operator": "OR"}]}], "evaluatorImpact": "CVSS score derived from:\r\n\r\nhttp://www.cisco.com/en/US/docs/ios/15_1s/release/notes/15_1s_caveats_15_1_2s.html", "sourceIdentifier": "ykramarz@cisco.com"}