CVE-2014-4749

Published: Aug 20, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.

Affected (6)

Products: Ibm: Powervc

Ibm

1 product

Powervc

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ibm Powervc	Version 1.2.0.0
Ibm Powervc	Version 1.2.0.0
Ibm Powervc	Version 1.2.0.1
Ibm Powervc	Version 1.2.0.1
Ibm Powervc	Version 1.2.0.2
Ibm Powervc	Version 1.2.0.2

Related CWEs

CWE-264

References (4)

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/94351

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/94351

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.