CVE-2013-4035 Security feature bypass in n/a

High 7.3 Published 1 May 2018 Updated 6 Aug 2024

Remote attackers can bypass SSL encryption requirements by forcing unencrypted sessions in IBM Sterling Connect:Direct for OpenVMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2013-4035?

CVE-2013-4035 is a high-severity vulnerability in n/a, published on 1 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leveraging failure to reject client requests for an unencrypted session when used as the server in a TCP/IP session and configured for SSL encryption with the client. IBM X-Force ID: 86138.

Weakness: CWE-310

Which versions are affected by CVE-2013-4035?

It affects 1 product.

Products include Ibm Sterling Connect.

How do I fix CVE-2013-4035?

No fix has been published for CVE-2013-4035 yet. Limit exposure of the affected software until one is available.

Is CVE-2013-4035 being exploited?

There is no known exploitation of CVE-2013-4035 in the wild and no public exploit code.

Sources

Also known as GHSA-v7x6-hr5c-3859.