CVE-2013-3619

Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.

CVSS v3.0 8.1 HIGH
CVSS v2.0 4.3 MEDIUM

8.1^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/89044	Third Party Advisory VDB Entry
http://support.citrix.com/article/CTX216642	Third Party Advisory
https://support.citrix.com/article/CTX216642	Third Party Advisory
https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities	Third Party Advisory
https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:supermicro:smt_x9_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:supermicro:sh7758:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:supermicro:smt_x8_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:supermicro:sh7757:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:citrix:netscaler_sdx_firmware:10:*:*:*:*:*:*:*

cpe:2.3:h:citrix:netscaler_sdx:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:citrix:netscaler_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:citrix:netscaler:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:citrix:netscaler_sd-wan_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:citrix:netscaler_sd-wan:-:*:*:*:*:*:*:*

Information

Published : 2020-01-02 18:15

Updated : 2020-01-15 14:08

NVD link : CVE-2013-3619

Mitre link : CVE-2013-3619

JSON object : View

Products Affected

supermicro

sh7757
sh7758
smt_x8_firmware
smt_x9_firmware

citrix

netscaler_sdx_firmware
netscaler
netscaler_sd-wan
netscaler_sdx
netscaler_sd-wan_firmware
netscaler_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89044", "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89044", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "http://support.citrix.com/article/CTX216642", "name": "http://support.citrix.com/article/CTX216642", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://support.citrix.com/article/CTX216642", "name": "https://support.citrix.com/article/CTX216642", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities", "name": "https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf", "name": "https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-798"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-3619", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2020-01-02T18:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:supermicro:smt_x9_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.15"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:supermicro:sh7758:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:supermicro:smt_x8_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.12"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:supermicro:sh7757:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:citrix:netscaler_sdx_firmware:10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:citrix:netscaler_sdx:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:citrix:netscaler_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:citrix:netscaler:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:citrix:netscaler_sd-wan_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:citrix:netscaler_sd-wan:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-01-15T14:08Z"}