Vulnerability Details : CVE-2013-6747
IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.
Vulnerability category: Denial of service
Products affected by CVE-2013-6747
- cpe:2.3:a:ibm:tivoli_directory_server:-:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:security_directory_server:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-6747
2.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-6747
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST |
CWE ids for CVE-2013-6747
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-6747
-
http://www-01.ibm.com/support/docview.wss?uid=swg21669554
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.2Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676092
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.9Vendor Advisory
-
http://secunia.com/advisories/56699
Sign in
-
http://www.securitytracker.com/id/1029687
IBM Tivoli Directory Server GSKit Certificate Processing Flaw Lets Remote Users Deny Service - SecurityTracker
-
http://secunia.com/advisories/56698
Sign in
-
http://www-01.ibm.com/support/docview.wss?uid=swg21662902
IBM Security Bulletin: GSKit certificate chain vulnerability in IBM Security Directory Server and Tivoli Directory Server (CVE-2013-6747)Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676091
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.33Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/89863
IBM GSKit denial of service CVE-2013-6747 Vulnerability Report
-
http://osvdb.org/102556
Jump to