CVE-2013-3609

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

CVE-2013-3607

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allow remote attackers to execute...

Stack overflow

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allow remote attackers to execute...

Design/Logic Flaw

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allows remote authenticated users to execute arbitrary commands via shell...

Authorization

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

CVE-2013-3607

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allow remote attackers to execute...

CVE-2013-3608

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allows remote authenticated users to execute arbitrary commands via shell...

CVE-2013-3609

The CVE-2013-3609 issue affects Supermicro IPMI web interfaces (various H8/ X9/X8/X7 series) where client-side JavaScript is used for authorization checks. This reliance on client-side validation may allow remote authenticated users to bypass access restrictions and escalate privileges via crafte...

CVE-2013-3609

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

CVE-2013-3608

The CVE-2013-3608 entry concerns the IPMI web interface in Supermicro devices (e.g., H8DC*/H8DG*/H8SCM-F/H8SGL-F/H8SM*, X7SP*/X8DT*/X8SI*/X9DAX-/X9DB /X9DR*/X9QR*/X9SBAA-F/X9SC*/X9SPU-F/X9SR*) where remote authenticated users can execute arbitrary commands via shell metacharacters in the config_d...

CVE-2013-3607

The CVE-2013-3607 issue affects Supermicro IPMI, specifically the web interface used by the Baseboard Management Controller (BMC). Multiple stack-based buffer overflows have been identified in the web login.cgi, affecting models such as H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, ...

Supermicro IPMI based on ATEN firmware contain multiple vulnerabilities

Overview Supermicro Intelligent Platform Management Interface IPMI implementations based on ATEN firmware contain multiple vulnerabilities in their web management interface. Description CWE-121: Stack-based Buffer Overflow - CVE-2013-3607The Supermicro IPMI web interface contains multiple buffer...

CVE-2013-4782

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

Authentication flaw

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-4782

CVE-2013-4782 affects Supermicro BMC/IPMI: authentication bypass via IPMI 2.0 cipher suite 0 (cipher zero) allows remote execution of arbitrary IPMI commands. Affected component is the BMC’s IPMI implementation; the root cause is cipher-zero authentication bypass. Impact stated across sources inc...

CVE-2013-4782

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

Portable UPnP SDK unique_service_name() Remote Code Execution

This Metasploit module exploits a buffer overflow in the uniqueservicename function of libupnp's SSDP processor. The libupnp library is used across thousands of devices and is referred to as the Intel SDK for UPnP Devices or the Portable SDK for UPnP Devices. Due to size limitations on many...

Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Portable UPnP SDK uniqueservicename...

Portable UPnP SDK unique_service_name() Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Portable UPnP SDK uniqueservicename...

Supermicro IPMI Password Disclosure

== Product == Tested hardware: Supermicro X8SI6-F mainboard - IPMI firmware: 2.50 Supermicro X9SCL-F mainboard - IPMI firmware: 1.01 Likely affects other Supermicro boards of those generations that use the same type of firmware. == Problem == Modern servers often include a feature called IPMI to...