Cisco Unified Computing System Performance Manager 1.0 Base Execute Code Vulnerability
14 Sep. 2016
Summary
Cisco Unified Computing System Performance Manager is prone to a local code-execution vulnerability.This allows a local attacker to exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts may result in a denial-of-service condition.
Vulnerable Systems:
* Cisco Unified Computing System Performance Manager 1.0 Base
* Cisco Unified Computing System Performance Manager 1.1.0
* Cisco Unified Computing System Performance Manager 1.1.1
* Cisco Unified Computing System Performance Manager 2.0.0
A vulnerability in the web framework of Cisco Unified Computing System (UCS) Performance Manager could allow an authenticated, remote attacker to execute arbitrary commands.
The vulnerability is due to insufficient input validation performed on parameters that are passed via an HTTP GET request. An attacker could exploit this vulnerability by sending crafted HTTP GET requests to an affected system. An exploit could allow the attacker to execute arbitrary commands with the privileges of the root user.
Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.
