1. Home
  2. CVE Database
  3. CVE-2011-4190
MEDIUM · 5.9

CVE-2011-4190

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in tha...

Vulnerability Description

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).

CVSS Score

5.9

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
SuseSuse Linux Enterprise Desktop11
SuseSuse Linux Enterprise Server11

Related Weaknesses (CWE)

CWE-306CWE-310

References

FAQ

What is CVE-2011-4190?

CVE-2011-4190 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in tha...

How severe is CVE-2011-4190?

CVE-2011-4190 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2011-4190?

Check the references section above for vendor advisories and patch information. Affected products include: Suse Suse Linux Enterprise Desktop, Suse Suse Linux Enterprise Server.