CVE-2010-0599 - Vulnerability Details - OpenCVE

Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Mediator Framework Network Building Mediator Nbm-2400 Network Building Mediator Nbm-4800 Richards-zeta Mediator 2500

Configuration 1 [-]

AND

OR	cpe:2.3:a:cisco:mediator_framework:1.5.1:::::::*
	cpe:2.3:a:cisco:mediator_framework:2.2:::::::*
	cpe:2.3:a:cisco:mediator_framework:3.0.8:::::::*

OR	cpe:2.3:h:cisco:network_building_mediator_nbm-2400::::::::
	cpe:2.3:h:cisco:network_building_mediator_nbm-4800::::::::
	cpe:2.3:h:cisco:richards-zeta_mediator_2500::::::::

No data.

References

Link	Providers
http://secunia.com/advisories/39904
http://securitytracker.com/id?1024027
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml
http://www.kb.cert.org/vuls/id/757804
http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2010-05-27T19:00:00

Updated: 2024-08-07T00:52:19.836Z

Reserved: 2010-02-10T00:00:00

Link: CVE-2010-0599

Vulnrichment

No data.

NVD

Status : Modified

Published: 2010-05-27T19:30:01.563

Modified: 2024-11-21T01:12:32.943

Link: CVE-2010-0599

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-05-26T00:00:00", "descriptions": [{"lang": "en", "value": "Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2010-06-09T09:00:00", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "1024027", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1024027"}, {"name": "20100526 Multiple Vulnerabilities in Cisco Network Building Mediator", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml"}, {"tags": ["x_refsource_MISC"], "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf"}, {"name": "VU#757804", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/757804"}, {"name": "39904", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/39904"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2010-0599", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1024027", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1024027"}, {"name": "20100526 Multiple Vulnerabilities in Cisco Network Building Mediator", "refsource": "CISCO", "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml"}, {"name": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf", "refsource": "MISC", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf"}, {"name": "VU#757804", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/757804"}, {"name": "39904", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/39904"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:52:19.836Z"}, "title": "CVE Program Container", "references": [{"name": "1024027", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1024027"}, {"name": "20100526 Multiple Vulnerabilities in Cisco Network Building Mediator", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf"}, {"name": "VU#757804", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/757804"}, {"name": "39904", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/39904"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2010-0599", "datePublished": "2010-05-27T19:00:00", "dateReserved": "2010-02-10T00:00:00", "dateUpdated": "2024-08-07T00:52:19.836Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:mediator_framework:1.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "A2ED25A9-5C95-42B2-A130-D2408424A12C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:mediator_framework:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "43882C04-733C-4E82-80BA-E448727964CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:mediator_framework:3.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "AA5908EA-AE44-4D6A-A075-25F29018EC67", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:network_building_mediator_nbm-2400:*:*:*:*:*:*:*:*", "matchCriteriaId": "B424A35F-EF83-4E78-BFD4-4FF31BF5959C", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:network_building_mediator_nbm-4800:*:*:*:*:*:*:*:*", "matchCriteriaId": "653E88C2-72DC-4842-A7C1-0C671A09A4B0", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:richards-zeta_mediator_2500:*:*:*:*:*:*:*:*", "matchCriteriaId": "E41E17D4-5C33-4F8A-A1E2-8D7FE47D8492", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505."}, {"lang": "es", "value": "Cisco Mediator Framework v1.5.1 anterior a v1.5.1.build.14-eng, v2.2 anterior a v2.2.1.dev.1, y v3.0 anterior a v3.0.9.release.1 en Cisco Network Building Mediator NBM-2400 y NBM-4800 y en Richards-Zeta Mediator v2500 no cifra sesiones XML RPC para los operadores de las estaciones de trabajo, lo que permite a atacantes remotos descubrir credenciales de administrador espiando el tr\u00e1fico de red, tambi\u00e9n conocido como Bug ID CSCtb83505.\r\n\r\n"}], "id": "CVE-2010-0599", "lastModified": "2024-11-21T01:12:32.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-05-27T19:30:01.563", "references": [{"source": "ykramarz@cisco.com", "url": "http://secunia.com/advisories/39904"}, {"source": "ykramarz@cisco.com", "url": "http://securitytracker.com/id?1024027"}, {"source": "ykramarz@cisco.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml"}, {"source": "ykramarz@cisco.com", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/757804"}, {"source": "ykramarz@cisco.com", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/39904"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1024027"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/757804"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}