PT-2014-3794

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS Central Software versions 1.1 and earlier Description The issue allows local users to gain privileges via a CLI copy command in a local-mgmt context. Recommendations For Cisco Unified Computing System UCS...

Cisco Unified Computing System 'copy'命令本地特权提升漏洞

Bugtraq ID:65638 CVE ID:CVE-2014-0730 Cisco Unified Computing System通过将统一计算、网络、存储访问和虚拟化整合到一个系统中,简化IT管理并提高灵活性。 Cisco Unified Computing System local-mgmt上下文存在安全漏洞，允许本地通过验证的攻击者提升权限。漏洞是由于不正确校验copy命令的输入，允许攻击者提交特殊命令来获得对shell的访问。 0 Cisco Unified Computing System Central Software 厂商补丁： Cisco -----...

Cisco Unified Computing System Director默认验证凭据安全绕过漏洞

Bugtraq ID:65666 CVE ID:CVE-2014-0709 Cisco Unified Computing System通过将统一计算、网络、存储访问和虚拟化整合到一个系统中,简化IT管理并提高灵活性。 Cisco Unified Computing System Director存在安全漏洞，允许远程攻击者利用漏洞完全控制设备。漏洞是由于安装过程中创建了默认的root用户账户，允许攻击者利用该账户远程访问服务器CLI，控制设备。 0 Cisco UCS Director 4.0.0.3 厂商补丁： Cisco ----- Cisco UCS Director...

Cisco Unified Computing System Central Software Privilege Escalation Vulnerability

A vulnerability in the local-mgmt context in Cisco Unified Computing System Central Software could allow an authenticated, local attacker to gain shell-level access to the affected device. The vulnerability is due to improper input validation in the copy command. An attacker could exploit this...

Cisco UCS Director Default Credentials Vulnerability

A vulnerability in Cisco Unified Computing System UCS Director could allow an unauthenticated, remote attacker to take complete control of the affected device. The vulnerability is due to a default root user account created during installation. An attacker could exploit this vulnerability by...

Cisco Unified Computing System Smart Call Home Input Validation Vulnerability (CSCtl00186)

A vulnerability in Cisco Unified Computing System UCS Manager could allow an authenticated, local attacker to trigger a denial of service DoS condition. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by configuring an invalid contact address fo...

Cisco Unified Computing System Cisco Management Controller Denial of Service Vulnerability (CSCtg20734)

A vulnerability in the Cisco Management Controller of the Cisco Unified Computing System could allow an authenticated, local attacker to trigger a denial of service DoS condition. The vulnerability is due to improper parameter input validation. An attacker could exploit this vulnerability by...

Cisco Unified Computing System Serial over LAN Static Private Key Vulnerability (CSCte90338)

A vulnerability in the Cisco Unified Computing System Serial over LAN SoL implementation could allow an unauthenticated, remote attacker to perform a man-in-the-middle MITM attack. The vulnerability occurs because the Board Management Controller BMC uses a hard-coded private key. An attacker coul...

PT-2013-5631

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to cause a denial of service via crafted command parameters that trigger hardware-component write operations. Recommendations At the...

CVE-2013-5550: Improper Input Validation

The fabric-interconnect component in Cisco Unified Computing System UCS allows local users to cause a denial of service via crafted command parameters that trigger hardware-component write operations, aka Bug ID CSCtq86549...

Cisco Unified Computing System Fabric Interconnect Man-In-The-Middle Vulnerability

A vulnerability in the Fabric Interconnect KVM module of Cisco Unified Computing System could allow an unauthenticated, remote attacker to execute a man-in-the-middle attack. The vulnerability is due to the virtual KVM sending video data unencrypted. An attacker could exploit this vulnerability b...

Cisco Unified Computing System Fabric Interconnect Denial of Service Vulnerability

A vulnerability in the fabric interconnect of Cisco Unified Computing System could allow an authenticated, local attacker to cause a denial of service DoS condition. The vulnerability is due to improper filtering of user-supplied parameters. An attacker could exploit this vulnerability by executi...

Code injection

The fabric-interconnect component in Cisco Unified Computing System UCS does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug...

PT-2013-1653

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the fabric-interconnect component in Cisco Unified Computing System UCS, which fails to encrypt KVM virtual-media data. This allows...

CVE-2012-4115: Undefined Security Weakness

The fabric-interconnect component in Cisco Unified Computing System UCS does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream, aka Bug...

CVE-2012-4117

The fabric-interconnect component in Cisco Unified Computing System UCS does not properly verify X.509 certificates, which allows man-in-the-middle attackers to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate, aka Bug ID CSCtr73033...

CVE-2012-4112

The Baseboard Management Controller BMC in Cisco Unified Computing System UCS allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface, aka Bug ID CSCtr43330...

CVE-2012-4112

CVE-2012-4112 affects the Cisco UCS Baseboard Management Controller (BMC). A vulnerability in the BMC’s command-line interface (CLI) allows a locally authenticated attacker to inject arbitrary commands with elevated privileges due to improper filtering of user-supplied parameters. Exploitation re...

PT-2013-1652

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue concerns the fabric-interconnect KVM module in Cisco Unified Computing System UCS, which fails to encrypt video data. This allows man-in-the-middle...

PT-2013-1651

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System UCS affected versions not specified Description The issue allows local users to gain privileges and read arbitrary files via crafted command parameters within the command-line interface. Recommendations At the...