CVE-2012-4605: Infoleak
The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4605?
CVE-2012-4605 has a high severity level due to the use of weak SSL ciphers that can expose sensitive information.
How do I fix CVE-2012-4605?
To fix CVE-2012-4605, configure the SMTP component to disable weak SSL ciphers in the registry settings.
Which versions of Websense Email Security are affected by CVE-2012-4605?
CVE-2012-4605 affects Websense Email Security versions 6.1 through 7.3.
What kind of attacks does CVE-2012-4605 make possible?
CVE-2012-4605 allows remote attackers to conduct man-in-the-middle attacks and obtain sensitive information.
Is user action required to mitigate the risks associated with CVE-2012-4605?
Yes, user action is required to reconfigure the SSL settings and strengthen cipher usage in the affected versions.