Man-in-the-Middle (MitM) attack in Equinox - CVE-2021-41033
Published: September 21, 2023
Vulnerability identifier: #VU80939
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41033
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform Man-in-the-Middle (MitM) attack.
The vulnerability exists if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation. A remote unauthenticated attacker can perform Man-in-the-Middle (MitM) attack.
Affected software
Equinox
Security Directory Integrator
IBM Security Verify Directory
IBM Security Directory Suite
IBM Tivoli Network Manager (ITNM)
Security Directory Integrator
IBM Security Verify Directory
IBM Security Directory Suite
IBM Tivoli Network Manager (ITNM)
How to mitigate CVE-2021-41033
Install updates from vendor's website.
Equinox - update to 4.21
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Security Directory Suite - update to 8.0.1.21
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Security Directory Suite - update to 8.0.1.21