Vulnerability CVE-2013-6838

Vulnerability CVE-2013-6838

Published: 2014-01-27 Modified: 2014-01-28

Description:

An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Enghouse Interactive IVR Pro VIP2000 remote root authentication	Fredrik Sderblom	17.01.2014

Type:

CWE-310

(Cryptographic Issues)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
10/10	10/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Enghouseinteractive -> Ivr pro

References:

https://xpd.se/advisories/XPD-2013-001.txt

http://seclists.org/fulldisclosure/2014/Jan/103

Copyright 2024, cxsecurity.com