PT-2015-1325 · Cisco · Cisco Ucs Central

Published 2015-06-17 · Updated 2016-12-07 · CVE-2015-4183

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco UCS Central Software version 1.2(1a)

Description The issue allows local users to gain privileges for OS command execution via a crafted CLI parameter. This is due to the system's failure to neutralize special elements used in the OS command. Exploitation of the issue may allow an attacker to obtain privileges for executing OS commands by modifying a CLI parameter.

Recommendations For Cisco UCS Central Software version 1.2(1a), consider restricting access to the CLI to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using crafted CLI parameters that could lead to privilege escalation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2015-10396

CVE-2015-4183

Affected Products

Cisco Ucs Central

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4183 · Security Note
• https://bdu.fstec.ru/vul/2015-10396 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39324 · Vendor Advisory
• http://securitytracker.com/id/1032584 · Note
• http://securityfocus.com/bid/75205 · Note