CVE-2012-2203
First published: Wed Aug 08 2012(Updated: )
IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to spoof SSL servers via vectors involving insertion of an arbitrary root Certification Authority (CA) certificate.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Global Security Kit | <=8.0.13 | |
| IBM Global Security Kit | =7.0.4.28 | |
| IBM Global Security Kit | =7.0.4.29 | |
| IBM Tivoli Directory Server | ||
| IBM Tivoli Directory Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/51279
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV31973
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV31975
- http://www-01.ibm.com/support/docview.wss?uid=swg21606145
- http://www.securityfocus.com/bid/54743
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77280
Frequently Asked Questions
What is the severity of CVE-2012-2203?
CVE-2012-2203 is classified as a medium severity vulnerability due to the potential for spoofing attacks.
How do I fix CVE-2012-2203?
To remediate CVE-2012-2203, update the IBM Global Security Kit to version 8.0.14.22 or higher.
Which products are affected by CVE-2012-2203?
CVE-2012-2203 affects IBM Global Security Kit versions before 8.0.14.22, as well as IBM Rational Directory Server and IBM Tivoli Directory Server.
Can CVE-2012-2203 be exploited remotely?
Yes, CVE-2012-2203 can be exploited by remote attackers to spoof SSL servers.
Is there a workaround for CVE-2012-2203 if I cannot upgrade?
There is no specific workaround for CVE-2012-2203; upgrading to the latest version is strongly recommended.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm global security kit
- version/ibm global security kit/8.0.13
- version/ibm global security kit/7.0.4.28
- version/ibm global security kit/7.0.4.29
- canonical/ibm tivoli directory server