CVE-2012-4587 Information disclosure in n/a
Remote attackers can discover user passwords by spoofing the EMM server via DNS SRV records when one-time provisioning is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-4587?
CVE-2012-4587 is a low-severity vulnerability in n/a, published on 22 Aug 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a password entered on an iOS device.
Weakness: CWE-264
Which versions are affected by CVE-2012-4587?
It affects 2 products.
Products include Mcafee Enterprise Mobility Manager, Mcafee Enterprise Mobility Manager Agent.
How do I fix CVE-2012-4587?
No fix has been published for CVE-2012-4587 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-4587 being exploited?
There is no known exploitation of CVE-2012-4587 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6whm-cwc2-p7rg.