Medium severity · published Jun 8, 2018
CVE-2011-4190
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Suse Linux Enterprise Desktop · Suse
11 · source: NVD
SL
Suse Linux Enterprise Server · Suse
11; 11; 11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4190
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=722440
www.suse.com
https://www.suse.com/security/cve/CVE-2011-4190/
More from Suse Linux Enterprise Desktop
5.5
CVE-2014-0196
Linux Kernel Race Condition Vulnerability
9.8
CVE-2014-1514
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the…
9.8
CVE-2014-1511
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified…
9.8
CVE-2014-1510
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute…
9.8
CVE-2014-1493
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow…