CVE-2013-4786 - Vulnerability Details - OpenCVE

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Intel	Intelligent Platform Management Interface
Oracle	Fujitsu M10 Firmware

Configuration 1 [-]

cpe:2.3:o:oracle:fujitsu_m10_firmware:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:intel:intelligent_platform_management_interface:2.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://fish2.com/ipmi/remote-pw-cracking.html
http://marc.info/?l=bugtraq&m=139653661621384&w=2
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi
https://nvd.nist.gov/vuln/detail/CVE-2013-4786
https://nvidia.custhelp.com/app/answers/detail/a_id/5010
https://security.netapp.com/advisory/ntap-20190919-0005/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764
https://www.cve.org/CVERecord?id=CVE-2013-4786

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2013-07-08T22:00:00

Updated: 2024-08-06T16:52:27.225Z

Reserved: 2013-07-08T00:00:00

Link: CVE-2013-4786

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2013-07-08T22:55:01.217

Modified: 2025-04-11T00:51:21.963

Link: CVE-2013-4786

Redhat

Severity : Moderate

Publid Date: 2013-07-08T00:00:00Z

Links: CVE-2013-4786 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-01-23T00:00:00", "descriptions": [{"lang": "en", "value": "The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-28T23:06:15", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi"}, {"tags": ["x_refsource_MISC"], "url": "http://fish2.com/ipmi/remote-pw-cracking.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"name": "HPSBHF02981", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=139653661621384&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20190919-0005/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-4786", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi", "refsource": "MISC", "url": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi"}, {"name": "http://fish2.com/ipmi/remote-pw-cracking.html", "refsource": "MISC", "url": "http://fish2.com/ipmi/remote-pw-cracking.html"}, {"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764", "refsource": "CONFIRM", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"name": "HPSBHF02981", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=139653661621384&w=2"}, {"name": "https://security.netapp.com/advisory/ntap-20190919-0005/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190919-0005/"}, {"name": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010", "refsource": "CONFIRM", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:52:27.225Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://fish2.com/ipmi/remote-pw-cracking.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"name": "HPSBHF02981", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=139653661621384&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20190919-0005/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-4786", "datePublished": "2013-07-08T22:00:00", "dateReserved": "2013-07-08T00:00:00", "dateUpdated": "2024-08-06T16:52:27.225Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:oracle:fujitsu_m10_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3861055-D7FB-4C07-BE61-6879D3638B07", "versionEndIncluding": "2290", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:intel:intelligent_platform_management_interface:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "1EC1939A-0635-433A-88AA-B9F7BA58CC5E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC."}, {"lang": "es", "value": "La especificaci\u00f3n IPMI 2.0 soporta autenticaci\u00f3n \"RMCP+ Authenticated Key-Exchange Protocol (RAKP)\", lo que permite a atacantes remotos obtener res\u00famenes de contrase\u00f1as y llevar a cabo ataques fuera de l\u00ednea de adivinaci\u00f3n de contrase\u00f1a consiguiendo el HMAC de un mensaje RAKP 2 respondido desde un BMC."}], "id": "CVE-2013-4786", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2013-07-08T22:55:01.217", "references": [{"source": "cve@mitre.org", "url": "http://fish2.com/ipmi/remote-pw-cracking.html"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=139653661621384&w=2"}, {"source": "cve@mitre.org", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"source": "cve@mitre.org", "url": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi"}, {"source": "cve@mitre.org", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20190919-0005/"}, {"source": "cve@mitre.org", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://fish2.com/ipmi/remote-pw-cracking.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=139653661621384&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5010"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20190919-0005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}