CVE-2013-6838

An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Jan/103
https://xpd.se/advisories/XPD-2013-001.txt
http://seclists.org/fulldisclosure/2014/Jan/103
https://xpd.se/advisories/XPD-2013-001.txt

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:enghouseinteractive:ivr_pro:9.0.3:*:*:*:*:*:*:*

cpe:2.3:o:openvz:vzkernel:-:*:*:*:*:*:*:*

History

21 Nov 2024, 01:59

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2014/Jan/103 -~~	() http://seclists.org/fulldisclosure/2014/Jan/103 -
References	~~() https://xpd.se/advisories/XPD-2013-001.txt -~~	() https://xpd.se/advisories/XPD-2013-001.txt -

Information

Published : 2014-01-28 00:55

Updated : 2024-11-21 01:59

NVD link : CVE-2013-6838

Mitre link : CVE-2013-6838

CVE.ORG link : CVE-2013-6838

JSON object : View

Products Affected

enghouseinteractive

ivr_pro

openvz

vzkernel

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2013-6838", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-01-28T00:55:03.847", "references": [{"url": "http://seclists.org/fulldisclosure/2014/Jan/103", "source": "cve@mitre.org"}, {"url": "https://xpd.se/advisories/XPD-2013-001.txt", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Jan/103", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://xpd.se/advisories/XPD-2013-001.txt", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "An unspecified Enghouse Interactive Professional Services \"addon product\" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key."}, {"lang": "es", "value": "Un complemento de producto Enghouse Interactive Professional Services sin especificar en Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), cuando se usa OpenVZ y la personalizaci\u00f3n de reserva, utiliza la misma llave SSH privada a trav\u00e9s de distintas instalaciones de consumidores, lo que permite a atacantes remotos obtener privilegios mediante el conocimiento de esta llave."}], "lastModified": "2024-11-21T01:59:48.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enghouseinteractive:ivr_pro:9.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B332A331-167E-458C-BD25-80EB97C6960D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openvz:vzkernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E0E00996-30AD-4928-81FB-B8088D4D2E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}