Hardcoded credentials

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

CVE-2012-4073

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

CVE-2012-4083

Multiple buffer overflows in the administrative web interface in Cisco Unified Computing System UCS allow remote authenticated users to cause a denial of service memory corruption and session termination via long string values for unspecified parameters, aka Bug ID CSCtg20751...

CVE-2012-4072

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

CVE-2012-4072

The CVE-2012-4072 issue affects Cisco Unified Computing System (UCS) KVM. The root cause is a hardcoded X.509 certificate in the KVM subsystem, enabling a remote attacker to perform MITM on KVM connections, spoof SSL servers, and read keyboard/mouse events by using knowledge of the private key. E...

CVE-2012-4074

The CVE-2012-4074 issue affects Cisco Unified Computing System Serial over LAN (SoL) with the Board Management Controller (BMC) using a hard-coded private key. This enables unauthenticated MITM attacks on SoL connections, allowing an attacker to view or modify SoL communications. Root cause: hard...

CVE-2012-4093

CVE-2012-4093 affects Cisco Unified Computing System (UCS) Manager. The issue is due to improper input validation in the Smart Call Home contact address, allowing an authenticated, local attacker to trigger a denial of service. Exploitation requires local access and valid credentials; the impact ...

CVE-2012-4073

The CVE-2012-4073 issue affects the Cisco Unified Computing System (UCS) KVM client, where the KVM subsystem fails to verify X.509 certificates from SSL servers. Root cause: improper certificate validation in the KVM client, enabling a man-in-the-middle attacker to intercept a KVM connection and ...

CVE-2012-4083

Cisco UCS Fabric Interconnect web admin interface vulnerability (CVE-2012-4083) allows an authenticated remote attacker to cause a DoS via long parameter values due to improper input validation. Affects the administrative web interface; memory corruption and session termination are reported impac...

CVE-2012-4074

The Board Management Controller BMC in the Serial over LAN SoL subsystem in Cisco Unified Computing System UCS relies on a hardcoded private key, which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key, aka Bug ID...

PT-2013-1621

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to cause a denial of service, resulting in an application crash, by utilizing invalid MCTools parameters. Recommendations At the moment...

PT-2013-1623

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns multiple buffer overflows in the administrative web interface, allowing remote authenticated users to cause a denial of service through memory...

CVE-2012-4093: Improper Input Validation

The Manager component in Cisco Unified Computing System UCS allows local users to cause a denial of service via an invalid Smart Call Home contact address, aka Bug ID CSCtl00186...

PT-2013-1633

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to cause a denial of service via an invalid Smart Call Home contact address. Recommendations At the moment, there is no information abo...

PT-2013-1615

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the Board Management Controller BMC in the Serial over LAN SoL subsystem, which relies on a hardcoded private key. This allows man-in-the-middle...

CVE-2012-4072: Improper Input Validation

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

CVE-2012-4074: Undefined Security Weakness

The Board Management Controller BMC in the Serial over LAN SoL subsystem in Cisco Unified Computing System UCS relies on a hardcoded private key, which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key, aka Bug ID...

CVE-2012-4073: Undefined Security Weakness

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

PT-2013-1622

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description A issue in MCTools within the Cisco Management Controller allows local users to gain privileges by entering crafted command-line parameters on a Fabric Interconnect...

PT-2013-1613

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the KVM subsystem in Cisco Unified Computing System UCS, which relies on a hardcoded X.509 certificate. This allows man-in-the-middle attackers t...