Cisco Unified Computing System Fabric System Manager Man-in-the-Middle Vulnerability

A vulnerability in the management interface of the Cisco Unified Computing System could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to improper identity validation of vCenter management consoles. An attacker could exploit this...

PT-2013-1523

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the remote debug shell on the PALO adapter card, which allows local users to gain privileges. This is achieved by using malformed show-macstats...

CVE-2012-4088

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

CVE-2012-4092

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4079

The XML API service in the Fabric Interconnect component in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service API service outage via a malformed XML document in a packet, aka Bug ID CSCtg48206...

Hardcoded credentials

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

Code injection

The XML API service in the Fabric Interconnect component in Cisco Unified Computing System UCS allows remote attackers to cause a denial of service API service outage via a malformed XML document in a packet, aka Bug ID CSCtg48206...

Code injection

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4079

CVE-2012-4079 affects Cisco UCS Fabric Interconnect: the XML API service can be brought down by a remote, unauthenticated attacker sending a malformed XML packet. Root cause is improper input validation in the XML API service. Impact is a DoS (API service outage). Cisco’s advisory notes that soft...

CVE-2012-4088

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

CVE-2012-4092

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4092

CVE-2012-4092 affects Cisco UCS Central Software’s management interface, where improper validation of vCenter console identities enables MITM-style interception—read/modify inter-device data streams. Root cause: identity spoofing between vCenter consoles and UCS Manager. Impact is partial confide...

CVE-2012-4092: Improper Input Validation

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4088: Undefined Security Weakness

The FTP server in Cisco Unified Computing System UCS has a hardcoded password for an unspecified user account, which makes it easier for remote attackers to read or modify files by leveraging knowledge of this password, aka Bug ID CSCtg20769...

PT-2013-1632

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS Central Software component affected versions not specified Description The issue is related to the management interface in the Central Software component, which fails to properly validate the identity of...

CVE-2012-4086

CVE-2012-4086 affects Cisco Unified Computing System (UCS) fabric interconnect devices. The issue resides in the initial setup script, where unfiltered input during configuration can be exploited by an unauthenticated, remote attacker to execute arbitrary commands on the underlying OS with the da...

CVE-2012-4086: Improper Neutralization of Special Elements used in a Command

A setup script for fabric interconnect devices in Cisco Unified Computing System UCS allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20790...

CVE-2012-4085

The Intelligent Platform Management Interface IPMI implementation in the Blade Management Controller in Cisco Unified Computing System UCS allows remote attackers to enumerate valid usernames by observing IPMI interface responses, aka Bug ID CSCtg20761...

CVE-2012-4089

MCTOOLS in the fabric interconnect in Cisco Unified Computing System UCS allows local users to execute arbitrary Baseboard Management Controller BMC commands by leveraging 1 local, 2 shell-level, or 3 debug-level privileges at the operating-system layer, aka Bug ID CSCtg76239...

CVE-2012-4078

The Baseboard Management Controller BMC in Cisco Unified Computing System UCS does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified authentication step via SSH port forwarding, aka Bug ID CSCtg17656...