« Volver al listado

CVE-2012-0406

Estado: ModificadaAlta (7.8)—

The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

EMC — Data Protection Advisor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-0406",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-04-20T04:02:52.247",
  "references": [
    {
      "url": "http://aluigi.altervista.org/adv/dpa_1-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18688/",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/522408/30/0/threaded",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1026956",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://aluigi.altervista.org/adv/dpa_1-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18688/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/522408/30/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1026956",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password."
    },
    {
      "lang": "es",
      "value": "La función de DPA_Utilities.cProcessAuthenticationData de EMC Data Protection Advisor (DPA) v5.5 a v5.8 SP1 permite a atacantes remotos causar una denegación de servicio (desreferencia de puntero NULL y caída del demonio) a través de un comando AUTHENTICATECONNECTION que (1) carece de un campo de contraseña o (2) tiene una contraseña vacía."
    }
  ],
  "lastModified": "2026-06-16T23:37:13.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "680208E2-56D1-4867-9B28-A867F0252FB1"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.5:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0945F3BB-790E-4F38-B311-C056F8F1F774"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E71E518A-F416-4850-9F2B-7E93CD975381"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.6:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "925F0652-1C6D-497B-ADF0-4248C0B2533F"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30116207-86BD-4384-87C3-7919340DB5D3"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.7:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28572343-8AAB-4249-9FA6-001757B83061"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73341E0C-5EB7-45C9-9068-A77054704A2A"
            },
            {
              "criteria": "cpe:2.3:a:emc:data_protection_advisor:5.8:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D72AB885-317E-4DF4-8FEF-689DCE3BCA92"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}