Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
BID:61610
Info
Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
| Bugtraq ID: | 61610 |
| Class: | Design Error |
| CVE: |
CVE-2012-3039 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 05 2013 12:00AM |
| Updated: | Aug 05 2013 12:00AM |
| Credit: | Nadia Heninger, San Diego, Zakir Durumeric, Eric Wustrow, and J. Alex Halderman |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
Multiple MOXA OnCell Gateways are prone to an insufficient-entropy vulnerability when generating keys for SSH and SSL connections.
Remote attackers can exploit this issue to perform man-in-the-middle attacks and gain unauthorized access to the affected devices, read information and send commands to the device. This aids in other attacks.
Multiple MOXA OnCell Gateways are prone to an insufficient-entropy vulnerability when generating keys for SSH and SSL connections.
Remote attackers can exploit this issue to perform man-in-the-middle attacks and gain unauthorized access to the affected devices, read information and send commands to the device. This aids in other attacks.
Exploit / POC
Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
Attackers can use readily available tools to exploit this issue.
Attackers can use readily available tools to exploit this issue.
Solution / Fix
Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple MOXA OnCell Gateways CVE-2012-3039 Insufficient Entropy Vulnerability
References:
References:
- Industrial Gateways Homepage (Moxa)
- MOXA WEAK ENTROPY IN DSA KEYS VULNERABILITY (ICS-CERT)