Vulnerability Details : CVE-2012-2203
IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to spoof SSL servers via vectors involving insertion of an arbitrary root Certification Authority (CA) certificate.
Products affected by CVE-2012-2203
- cpe:2.3:a:ibm:tivoli_directory_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:rational_directory_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-2203
0.92%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-2203
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2012-2203
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-2203
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV31975
IBM IV31975: SYSROUTE OF IV31975:GSKIT TRUST ANCHOR VULNERABILITY IN TIVOLI ACCESS MANAGER FOR E-BUSINESS (CVE-2012-2203)
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV31973
IBM IV31973: SYSROUTE OF IV31970:GSKIT TRUST ANCHOR VULNERABILITY IN TIVOLI ACCESS MANAGER FOR E-BUSINESS (CVE-2012-2203)
-
http://www.securityfocus.com/bid/54743
IBM Multiple Products Global Security Toolkit Security Vulnerabilities
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/77280
Multiple IBM products GSKit spoofing CVE-2012-2203 Vulnerability Report
-
http://www-01.ibm.com/support/docview.wss?uid=swg21606145
IBM Security Bulletin: Multiple vulnerabilities in Rational Directory Server (CVE-2012-2203, CVE-2012-2191)Vendor Advisory
Jump to