CVE-2011-1560 solid.exe in IBM solidDB before 4.5.181, 6.0.x before 6.0.1067, 6.1.x and 6.3.x before 6.3.47, and 6.5.x before 6.5.0.3 uses a password-hash length specified by the client, which allows remote attacke...
HighCVSS 9.3
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
solid.exe in IBM solidDB before 4.5.181, 6.0.x before 6.0.1067, 6.1.x and 6.3.x before 6.3.47, and 6.5.x before 6.5.0.3 uses a password-hash length specified by the client, which allows remote attackers to bypass authentication via a short length value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm soliddb | <= 4.5.180 | No fix listed |
| ibm soliddb | = 4.5.167 | No fix listed |
| ibm soliddb | = 4.5.168 | No fix listed |
| ibm soliddb | = 4.5.169 | No fix listed |
| ibm soliddb | = 4.5.173 | No fix listed |
| ibm soliddb | = 4.5.175 | No fix listed |
| ibm soliddb | = 4.5.176 | No fix listed |
| ibm soliddb | = 4.5.178 | No fix listed |
| ibm soliddb | = 4.5.179 | No fix listed |
| ibm soliddb | = 6.0.1060 | No fix listed |
| ibm soliddb | = 6.0.1061 | No fix listed |
| ibm soliddb | = 6.0.1064 | No fix listed |
| ibm soliddb | = 6.0.1065 | No fix listed |
| ibm soliddb | = 6.0.1066 | No fix listed |
| ibm soliddb | = 6.1 | No fix listed |
| ibm soliddb | = 6.1.18 | No fix listed |
| ibm soliddb | = 6.1.20 | No fix listed |
| ibm soliddb | = 6.3.33 | No fix listed |
| ibm soliddb | = 6.3.37 | No fix listed |
| ibm soliddb | = 6.3.38 | No fix listed |
| ibm soliddb | = 6.5.0.0 | No fix listed |
| ibm soliddb | = 6.5.0.1 | No fix listed |
| ibm soliddb | = 6.5.0.2 | No fix listed |
| ibm soliddb | = 6.30.0039 | No fix listed |
| ibm soliddb | = 6.30.0040 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm soliddb | = 6.30.0044 | No fix listed |
References
- 71494 vdb-entry
- 44030 third-party-advisory
- www.ibm.com vendor-advisory
- ADV-2011-0854 vdb-entry
- www.zerodayinitiative.com
- soliddb-auth-bypass(66455) vdb-entry