PT-2015-1325 · Cisco · Cisco Ucs Central

Publicado 2015-06-17 · Atualizado 2016-12-07 · CVE-2015-4183

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco UCS Central Software version 1.2(1a)

Description The issue allows local users to gain privileges for OS command execution via a crafted CLI parameter. This is due to the system's failure to neutralize special elements used in the OS command. Exploitation of the issue may allow an attacker to obtain privileges for executing OS commands by modifying a CLI parameter.

Recommendations For Cisco UCS Central Software version 1.2(1a), consider restricting access to the CLI to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using crafted CLI parameters that could lead to privilege escalation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2015-10396

CVE-2015-4183

Produtos afetados

Cisco Ucs Central

Referências · 5

• http://securitytracker.com/id/1032584 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4183 · Nota de Segurança
• http://securityfocus.com/bid/75205 · Nota
• https://bdu.fstec.ru/vul/2015-10396 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39324 · Aviso do Fabricante