Vulnerability Details : CVE-2013-6747
IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2013-6747
Probability of exploitation activity in the next 30 days: 4.16%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 91 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-6747
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST |
CWE ids for CVE-2013-6747
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-6747
-
http://www-01.ibm.com/support/docview.wss?uid=swg21669554
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.2Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676092
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.9Vendor Advisory
-
http://www.securitytracker.com/id/1029687
IBM Tivoli Directory Server GSKit Certificate Processing Flaw Lets Remote Users Deny Service - SecurityTracker
-
http://www-01.ibm.com/support/docview.wss?uid=swg21662902
IBM Security Bulletin: GSKit certificate chain vulnerability in IBM Security Directory Server and Tivoli Directory Server (CVE-2013-6747)Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg21676091
IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.33Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/89863
IBM GSKit denial of service CVE-2013-6747 Vulnerability Report
Products affected by CVE-2013-6747
- cpe:2.3:a:ibm:tivoli_directory_server:-:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:8.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:security_directory_server:-:*:*:*:*:*:*:*