CVE-2012-4078: Improper Authentication

The Baseboard Management Controller BMC in Cisco Unified Computing System UCS does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656...

CVE-2012-4089: Improper Input Validation

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

CVE-2012-4087: Improper Input Validation

A cluster setup script for fabric interconnect devices in Cisco Unified Computing System UCS allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20793...

CVE-2012-4094: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Smart Call Home feature in the fabric interconnect in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service by reading and forging control messages associated with Smart Call Home reports, aka Bug ID CSCtl00198...

CVE-2012-4085: Improper Input Validation

The Intelligent Platform Management Interface IPMI implementation in the Blade Management Controller in Cisco Unified Computing System UCS allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761...

CVE-2012-4073

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

CVE-2012-4093

The Manager component in Cisco Unified Computing System UCS allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186...

CVE-2012-4093: Improper Input Validation

The Manager component in Cisco Unified Computing System UCS allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186...

CVE-2012-4081: Improper Restriction of Operations within the Bounds of a Memory Buffer

MCServer in the Cisco Management Controller in Cisco Unified Computing System UCS allows local users to cause a denial of service application crash via invalid MCTools parameters, aka Bug ID CSCtg20734...

CVE-2012-4073: Undefined Security Weakness

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

CVE-2012-4074: Undefined Security Weakness

The Board Management Controller BMC in the Serial over LAN SoL subsystem in Cisco Unified Computing System UCS relies on a hardcoded private key, which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key, aka Bug ID...

CVE-2012-4082: Improper Input Validation

MCTools in the Cisco Management Controller in Cisco Unified Computing System UCS allows local users to gain privileges by entering crafted command-line parameters on a Fabric Interconnect device, aka Bug ID CSCtg20749...

CVE-2012-4083: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System UCS allow remote authenticated users to cause a denial of service memory corruption and session termination via long string values for unspecified parameters, aka Bug ID CSCtg20751...

CVE-2012-4072: Improper Input Validation

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

Cisco Unified Computing System Fabric Interconnect String Overflow Vulnerability

A vulnerability in the administrative web interface of the Cisco Unified Computing System could allow an authenticated, remote attacker to create a denial of service DoS condition. The vulnerability is due to improper parameter input validation. An attacker could exploit this vulnerability by...

Cisco Unified Computing System Cisco Management Controller Command Injection Vulnerability

A vulnerability in the Cisco Management Controller of the Cisco Unified Computing System could allow an authenticated, local attacker to execute commands on the underlying operation system with elevated privileges. The vulnerability is due to improper parameter input validation. An attacker could...

Cisco Unified Computing System Software KVM Encryption Vulnerability

A vulnerability in Cisco Unified Computing System software KVM could allow an unauthenticated, remote attacker to intercept a KVM connection to spoof a host or decrypt keyboard and mouse events on an encrypted channel. The vulnerability is due to a hard coded SSL certificate. An attacker could...

Cisco Unified Computing System Software KVM Client Certificate Validation Vulnerability

A vulnerability in Cisco Unified Computing System software KVM client could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to improper certificate validation by the KVM client. An attacker could exploit this vulnerability by intercepting ...

Cisco Unified Computing System Serial over LAN Static Private Key Vulnerability

A vulnerability in the Cisco Unified Computing System Serial over LAN SoL implementation could allow an unauthenticated, remote attacker to perform a man-in-the-middle MITM attack. The vulnerability occurs because the Board Management Controller BMC uses a hard-coded private key. An attacker coul...

Cisco Unified Computing System Smart Call Home Input Validation Vulnerability

A vulnerability in Cisco Unified Computing System UCS Manager could allow an authenticated, local attacker to trigger a denial of service DoS condition. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by configuring an invalid contact address fo...