CVE-2012-3018

The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response.

CVSS v2.0 4.4 MEDIUM

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf	US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf	US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:iconics:genesis32::::::::
	cpe:2.3:a:iconics:genesis32:8.05:::::::*
	cpe:2.3:a:iconics:genesis32:9.0:::::::*
	cpe:2.3:a:iconics:genesis32:9.1:::::::*
	cpe:2.3:a:iconics:genesis32:9.01:::::::*
	cpe:2.3:a:iconics:genesis32:9.2:::::::*
	cpe:2.3:a:iconics:genesis32:9.13:::::::*
	cpe:2.3:a:iconics:genesis32:9.20:::::::*
	cpe:2.3:a:iconics:genesis32:9.21:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:iconics:bizviz::::::::
	cpe:2.3:a:iconics:bizviz:8.05:::::::*
	cpe:2.3:a:iconics:bizviz:9.0:::::::*
	cpe:2.3:a:iconics:bizviz:9.01:::::::*
	cpe:2.3:a:iconics:bizviz:9.1:::::::*
	cpe:2.3:a:iconics:bizviz:9.2:::::::*
	cpe:2.3:a:iconics:bizviz:9.13:::::::*
	cpe:2.3:a:iconics:bizviz:9.20:::::::*
	cpe:2.3:a:iconics:bizviz:9.21:::::::*

History

21 Nov 2024, 01:40

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf - US Government Resource~~	() http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf - US Government Resource

Information

Published : 2012-07-31 10:45

Updated : 2024-11-21 01:40

NVD link : CVE-2012-3018

Mitre link : CVE-2012-3018

CVE.ORG link : CVE-2012-3018

JSON object : View

Products Affected

iconics

bizviz
genesis32

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2012-3018", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-07-31T10:45:42.467", "references": [{"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response."}, {"lang": "es", "value": "La caracter\u00edstica lockout-recovery en el componente Security Configurator en ICONICS GENESIS32 v9.22 y anteriores y BizViz v9.22 y anteior usa un algoritmo de cifrado inadecuado para la generaci\u00f3n de c\u00f3digo de autenticaci\u00f3n, lo que permite a usuarios locales evitar las restricciones de acceso establecidas y obtener acceso administrativo prediciendo la respuesta a la solicitud."}], "lastModified": "2024-11-21T01:40:07.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iconics:genesis32:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5648CCCB-E3B4-4649-BF80-0CBBFF8D25ED", "versionEndIncluding": "9.22"}, {"criteria": "cpe:2.3:a:iconics:genesis32:8.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DFC8F6B-B298-49A3-BBD8-CDA74785AC0A"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E01069E-E059-446B-A0C5-89C37C902D3D"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02BE61E1-12E1-46B3-B725-9A73EAD272B0"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7784C58-C8CF-4631-8171-67D95595FF79"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F303667-A48E-40D2-9C38-C9C2813020AF"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86628D9D-4270-4571-A57A-17962BC2027D"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EFFA7EA-6775-44B8-88ED-D1B6E4AE259A"}, {"criteria": "cpe:2.3:a:iconics:genesis32:9.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CDD1388-8FBF-4B3E-854E-B68D3EB6569B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iconics:bizviz:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09717E94-3D2C-48E9-A267-4E75D2F343AD", "versionEndIncluding": "9.22"}, {"criteria": "cpe:2.3:a:iconics:bizviz:8.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BEF3187-A001-4604-A292-6192678B2AB4"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2854F716-ED09-46E8-AF9C-030EADDDB29F"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3214375-3D3A-47F9-BE1F-D92102A8C8F9"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0585FE5D-0FA5-4E13-AA5E-B5714564A14C"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E4B6521-EE6D-49FB-B771-830B34613007"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22060866-9121-480B-913A-41616CD94A27"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "278C55AD-294C-4D39-8E50-0726CA523A34"}, {"criteria": "cpe:2.3:a:iconics:bizviz:9.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B4F2D10-A4DD-4C7C-A5A8-BEDC23A413C2"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}