CVE-2013-5461
First published: Fri Apr 27 2018(Updated: )
IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which makes it easier for remote attackers to decrypt passwords by leveraging access to the hashes. IBM X-Force ID: 88309.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Endpoint Manager | =9.0.0 | |
| IBM Endpoint Manager | =9.0.1 | |
| IBM Tivoli Remote Control | =5.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88309
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-ibm-endpoint-manager-for-remote-control-cve-2013-5461/
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-tivoli-remote-control-cve-2013-5461/
Frequently Asked Questions
What is the severity of CVE-2013-5461?
CVE-2013-5461 has a high severity rating as it involves insecure storage of password hashes, making them susceptible to decryption by remote attackers.
How do I fix CVE-2013-5461?
To fix CVE-2013-5461, upgrade to the latest versions of IBM Endpoint Manager for Remote Control and Tivoli Remote Control that do not store partial password hashes.
What software versions are affected by CVE-2013-5461?
CVE-2013-5461 affects IBM Endpoint Manager for Remote Control versions 9.0.0 and 9.0.1, as well as Tivoli Remote Control version 5.1.2.
What are the risks associated with CVE-2013-5461?
The risks associated with CVE-2013-5461 include unauthorized access to sensitive information due to compromised password hashes.
Is there a way to mitigate CVE-2013-5461 without upgrading?
Mitigation options for CVE-2013-5461 may include implementing additional security measures such as strong access controls and monitoring, although upgrading is strongly recommended.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm endpoint manager
- version/ibm endpoint manager/9.0.0
- version/ibm endpoint manager/9.0.1
- canonical/ibm tivoli remote control
- version/ibm tivoli remote control/5.1.2