CVE-2012-4587
low
CVSS v3
—
CVSS v2
3.5
VIR risk
3.5
Description
McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a password entered on an iOS device.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://kc.mcafee.com/corporate/index?page=content&id=SB10021
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mcafee | enterprise_mobility_manager | {"endIncluding":"4.7"} | |
| mcafee | enterprise_mobility_manager_agent | {"endIncluding":"10.0"} | |
References
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.