CVE-2013-4786: High severity Oracle Fujitsu M10 Firmware vulnerability
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4786?
CVE-2013-4786 has a medium severity rating, allowing potential attackers to exploit password hashes.
How do I fix CVE-2013-4786?
To fix CVE-2013-4786, update the affected firmware to a version that mitigates this vulnerability.
What systems are affected by CVE-2013-4786?
CVE-2013-4786 affects systems running Oracle Fujitsu M10 Firmware versions up to 2290 and the Intel Intelligent Platform Management Interface version 2.0.
What type of attack does CVE-2013-4786 facilitate?
CVE-2013-4786 facilitates offline password guessing attacks due to exposed password hashes.
Can CVE-2013-4786 be exploited remotely?
Yes, CVE-2013-4786 can be exploited remotely by attackers targeting vulnerable systems.