Details of VAR-201205-0225

ID

VAR-201205-0225

CVE

CVE-2012-0338

TITLE

Cisco IOS In any IP From address SSH Vulnerability that establishes a connection

Trust: 0.8

sources: JVNDB: JVNDB-2012-002204

DESCRIPTION

Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish SSH connections from arbitrary source IP addresses via a standard SSH client, aka Bug ID CSCsv86113. IOS is prone to a remote security vulnerability. Cisco IOS is an operating system developed by Cisco in the United States for its network equipment

Trust: 1.98

sources: NVD: CVE-2012-0338 // JVNDB: JVNDB-2012-002204 // BID: 78280 // VULHUB: VHN-53619

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	15.0	Trust: 2.7
vendor:	cisco	model:	ios	scope:	eq	version:	12.4	Trust: 2.7
vendor:	cisco	model:	ios	scope:	eq	version:	12.3	Trust: 2.7
vendor:	cisco	model:	ios	scope:	eq	version:	12.2	Trust: 2.7

sources: BID: 78280 // JVNDB: JVNDB-2012-002204 // CNNVD: CNNVD-201205-050 // NVD: CVE-2012-0338

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-0338
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-0338
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201205-050
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-53619
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-0338
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-53619
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-53619 // JVNDB: JVNDB-2012-002204 // CNNVD: CNNVD-201205-050 // NVD: CVE-2012-0338

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-53619 // JVNDB: JVNDB-2012-002204 // NVD: CVE-2012-0338

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201205-050

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201205-050

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-002204

PATCH

title:

Caveats in Release 12.2(33)SXH Rebuilds

url:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXH_rebuilds.html

Trust: 0.8

sources: JVNDB: JVNDB-2012-002204

EXTERNAL IDS

db:	NVD	id:	CVE-2012-0338	Trust: 2.8
db:	SECTRACK	id:	1027005	Trust: 1.4
db:	JVNDB	id:	JVNDB-2012-002204	Trust: 0.8
db:	CNNVD	id:	CNNVD-201205-050	Trust: 0.7
db:	BID	id:	78280	Trust: 0.4
db:	VULHUB	id:	VHN-53619	Trust: 0.1

sources: VULHUB: VHN-53619 // BID: 78280 // JVNDB: JVNDB-2012-002204 // CNNVD: CNNVD-201205-050 // NVD: CVE-2012-0338

REFERENCES

url:	http://www.cisco.com/en/us/docs/switches/lan/catalyst6500/ios/12.2sx/release/notes/caveats_sxh_rebuilds.html	Trust: 2.0
url:	https://supportforums.cisco.com/thread/2030226	Trust: 2.0
url:	http://www.securitytracker.com/id?1027005	Trust: 1.4
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0338	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0338	Trust: 0.8

sources: VULHUB: VHN-53619 // BID: 78280 // JVNDB: JVNDB-2012-002204 // CNNVD: CNNVD-201205-050 // NVD: CVE-2012-0338

CREDITS

Unknown

Trust: 0.3

sources: BID: 78280

SOURCES

db:	VULHUB	id:	VHN-53619
db:	BID	id:	78280
db:	JVNDB	id:	JVNDB-2012-002204
db:	CNNVD	id:	CNNVD-201205-050
db:	NVD	id:	CVE-2012-0338

LAST UPDATE DATE

2025-04-11T22:49:39.610000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-53619	date:	2012-10-30T00:00:00
db:	BID	id:	78280	date:	2012-05-02T00:00:00
db:	JVNDB	id:	JVNDB-2012-002204	date:	2012-05-08T00:00:00
db:	CNNVD	id:	CNNVD-201205-050	date:	2012-05-03T00:00:00
db:	NVD	id:	CVE-2012-0338	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-53619	date:	2012-05-02T00:00:00
db:	BID	id:	78280	date:	2012-05-02T00:00:00
db:	JVNDB	id:	JVNDB-2012-002204	date:	2012-05-08T00:00:00
db:	CNNVD	id:	CNNVD-201205-050	date:	2012-05-03T00:00:00
db:	NVD	id:	CVE-2012-0338	date:	2012-05-02T10:09:22.130