bugtraq - Cisco Security Advisory:Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201604131236.6.ucs@psirt.cisco.com>
Date: Wed, 13 Apr 2016 12:36:40 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory:Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cisco Security Advisory: Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability

Advisory ID: cisco-sa-20160413-ucs

Revision 1.0

Published: 2016 April 13 16:00  GMT
+---------------------------------------------------------------------

Summary
=======

A vulnerability in the web framework of Cisco Unified Computing System (UCS) Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on a targeted system.

The vulnerability is due to improper input validation by the affected software. An attacker could exploit this vulnerability by sending a malicious HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-ucs
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJXDnP/AAoJEK89gD3EAJB5ebAP/0ebMx3m4efcj7BGwzX9S6uH
WH5kJ63/MdIl1GOHme8YkVXtkMMgfGTmSEbZp61OlgqDfUiOBd9aJjnX/vYWPvBo
arI0NC2Bn15/q3fMvFm+Kuhbu/a7pB964f37Cn5xmTTT09gaBIM8YSUf+rE8yejb
nqwxerngGyftSrj4U0v8ePZlOAQZptpROYxpJVjsx2PcLhV12jVrCPJnyHjAQkCZ
Z174n6H8LLbNAb5DQBqxzUEK6tmUrHG4w7AxtadnWHGi6webotvO33W+enAz1/hZ
w5FjoiE9Q4kQMCR6CoyltsQFgBesT+e5D/ujrtCvhULAUXhGkLqCCAITxknsUcbT
bh34Er10+XHTC34DlNt2iWZTZwuSuvfNcpDphuFmVffHaG3PGTwOnY29y1sxw1qa
w/YO4OzXfTEQB9vFlp4x5pFTriAqkg4aqmVJ8s6Xek8HTv3TUFRLlCUd/KqExaaA
19jgZkeJaznipkSeIf2Ez3YT54B0bIS5hBy2qvvjUbGLXpb7FuMX4MU+rg5Iz/Pd
XzA++8NJS19Bfy65qFRNeDfWInSXMlQY2eN5yGRIg9wyO53FVuCFbeNVNSZJyS2d
ISDIqCz2mxLZsAlhubat5TltLkimFUCtQ98IUWKjtUvTeUEPks4W2aLyU7NSlYI5
si1jM2s3eKYkXAN+9fSL
=B6H0
-----END PGP SIGNATURE-----