high7.5Public exploit code
CVE-2013-4786
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes an…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Intelligent Platform Management Interface - Information Disclosure2013-07-02 · remote · multiple · Verified
Impact
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oracle | Fujitsu M10 Firmware | through 2290 |
| Intel | Intelligent Platform Management Interface | Version 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://fish2.com/ipmi/remote-pw-cracking.html
- http://marc.info/?l=bugtraq&m=139653661621384&w=2
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi
- https://nvidia.custhelp.com/app/answers/detail/a_id/5010
- https://security.netapp.com/advisory/ntap-20190919-0005/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764