Executive Summary
Summary | |
---|---|
Title | Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160413-ucs | First vendor Publication | 2016-04-13 |
Vendor | Cisco | Last vendor Modification | 2016-04-13 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web framework of Cisco Unified Computing System (UCS) Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on a targeted system. The vulnerability is due to improper input validation by the affected software. An attacker could exploit this vulnerability by sending a malicious HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-ucs BEGIN PGP SIGNATURE Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXDnP/AAoJEK89gD3EAJB5ebAP/0ebMx3m4efcj7BGwzX9S6uH WH5kJ63/MdIl1GOHme8YkVXtkMMgfGTmSEbZp61OlgqDfUiOBd9aJjnX/vYWPvBo arI0NC2Bn15/q3fMvFm+Kuhbu/a7pB964f37Cn5xmTTT09gaBIM8YSUf+rE8yejb nqwxerngGyftSrj4U0v8ePZlOAQZptpROYxpJVjsx2PcLhV12jVrCPJnyHjAQkCZ Z174n6H8LLbNAb5DQBqxzUEK6tmUrHG4w7AxtadnWHGi6webotvO33W+enAz1/hZ w5FjoiE9Q4kQMCR6CoyltsQFgBesT+e5D/ujrtCvhULAUXhGkLqCCAITxknsUcbT bh34Er10+XHTC34DlNt2iWZTZwuSuvfNcpDphuFmVffHaG3PGTwOnY29y1sxw1qa w/YO4OzXfTEQB9vFlp4x5pFTriAqkg4aqmVJ8s6Xek8HTv3TUFRLlCUd/KqExaaA 19jgZkeJaznipkSeIf2Ez3YT54B0bIS5hBy2qvvjUbGLXpb7FuMX4MU+rg5Iz/Pd XzA++8NJS19Bfy65qFRNeDfWInSXMlQY2eN5yGRIg9wyO53FVuCFbeNVNSZJyS2d ISDIqCz2mxLZsAlhubat5TltLkimFUCtQ98IUWKjtUvTeUEPks4W2aLyU7NSlYI5 si1jM2s3eKYkXAN+9fSL =B6H0 END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-78 | Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
Snort® IPS/IDS
Date | Description |
---|---|
2016-04-14 | Cisco UCS Central Web Framework remote file include attempt RuleID : 38543 - Revision : 1 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-08-25 | Name : An infrastructure management application running on the remote host is affect... File : cisco-sa-20160413-ucs.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-08-26 13:26:07 |
|
2016-04-18 17:27:08 |
|
2016-04-13 21:25:14 |
|