CVE-2013-3609: Improper Input Validation

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

PT-2013-4512

Name of the Vulnerable Software and Affected Versions Supermicro H8DC versions affected versions not specified Supermicro H8DG versions affected versions not specified Supermicro H8SCM-F versions affected versions not specified Supermicro H8SM versions affected versions not specified Supermicro...

PT-2013-4513

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions affected versions not specified Description The issue affects the web interface in the Intelligent Platform Management Interface IPMI implementation, allowing remote authenticated users to execute...

PT-2013-4514

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions affected versions not specified Description The issue concerns the web interface in the Intelligent Platform Management Interface IPMI implementation, where authorization checks rely on JavaScript code o...

Supermicro IPMI based on ATEN firmware contain multiple vulnerabilities

Overview Supermicro Intelligent Platform Management Interface IPMI implementations based on ATEN firmware contain multiple vulnerabilities in their web management interface. Description CWE-121: Stack-based Buffer Overflow - CVE-2013-3607The Supermicro IPMI web interface contains multiple buffer...

CVE-2013-4782

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

Authentication flaw

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-4782

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-4782

CVE-2013-4782 affects Supermicro BMC/IPMI: authentication bypass via IPMI 2.0 cipher suite 0 (cipher zero) allows remote execution of arbitrary IPMI commands. Affected component is the BMC’s IPMI implementation; the root cause is cipher-zero authentication bypass. Impact stated across sources inc...

CVE-2013-4782: Improper Authentication

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

PT-2013-5189

Name of the Vulnerable Software and Affected Versions Supermicro BMC affected versions not specified Description The issue allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 and an arbitrary password. Recommendations At the moment, there i...

Portable UPnP SDK unique_service_name() Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Portable UPnP SDK uniqueservicename...

Portable UPnP SDK unique_service_name() Remote Code Execution

This Metasploit module exploits a buffer overflow in the uniqueservicename function of libupnp's SSDP processor. The libupnp library is used across thousands of devices and is referred to as the Intel SDK for UPnP Devices or the Portable SDK for UPnP Devices. Due to size limitations on many...

Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Portable UPnP SDK uniqueservicename...

Supermicro IPMI Password Disclosure

== Product == Tested hardware: Supermicro X8SI6-F mainboard - IPMI firmware: 2.50 Supermicro X9SCL-F mainboard - IPMI firmware: 1.01 Likely affects other Supermicro boards of those generations that use the same type of firmware. == Problem == Modern servers often include a feature called IPMI to...

Supermicro IPMI Default Accounts

The IPMI functionality of some Supermicro mainboards comes with two admin accounts by default, which are labeled in the webinterface: "ADMIN" "Anonymous" The official documentation only tells you to change the password of the "ADMIN" account: == Note: The manufacturer default username and passwor...