Elitecore Cyberoam Unified Threat Management Default Configuration cryptographic issue ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as critical, was found in Elitecore Cyberoam Unified Threat Management. This impacts an unknown function of the component Default Configuration. The manipulation results in cryptographic issue. This vulnerability is cataloged as CVE-2012-3372. There is no exploit available. The existence of this vulnerability is still disputed at present.

Detailsinfo

A vulnerability was found in Elitecore Cyberoam Unified Threat Management (affected version not known). It has been classified as critical. Affected is some unknown functionality of the component Default Configuration. The manipulation with an unknown input leads to a cryptographic issue vulnerability. CWE is classifying the issue as CWE-310. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key."

The weakness was shared 07/09/2012 (Website). The advisory is shared for download at media.torproject.org. This vulnerability is traded as CVE-2012-3372 since 06/14/2012. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The real existence of this vulnerability is still doubted at the moment. The vulnerability scanner Nessus provides a plugin with the ID 61447 (SSL Certificate Signed with the Publicly Known Cyberoam Key), which helps to determine the existence of the flaw in a target environment. It is assigned to the family General and running in the context r.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (61447) and SecurityFocus (BID 54291†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Elitecore

Name

• Cyberoam Unified Threat Management

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion