Vulnslist

find the latest Cisco vulnerabilities

Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability

Cisco-SA-20150225-CVE-2015-0633 · Medium · Published · Updated

A vulnerability in the Cisco Integrated Management Controller (IMC) of Cisco Unified Computing System (UCS) C-Series Servers could allow an unauthenticated, adjacent attacker to access specific controls on the Cisco IMC on an affected device. The vulnerability is due to insufficient input validation for DHCP response packets. An attacker could exploit this vulnerability by sending crafted DHCP packets to the device. Cisco has confirmed the vulnerability in a security notice; however, software updates are not available. To exploit this vulnerability, an attacker must be on the same broadcast or collision domain as the targeted device to send crafted DHCP packets to the device. This access requirement decreases the likelihood of a successful exploit.

Cisco advisory ·CSAF JSON

Workarounds

Administrators are advised to contact the vendor regarding future updates and releases.

Administrators are advised to allow only trusted users to have network access.

Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access affected systems.

Administrators are advised to monitor affected systems.

CVEsCVE-2015-0633
Cisco Bug IDsCSCuf52876
CVSS ScoreBase 4.3
Base 4.3 AV:A/AC:M/Au:N/C:N/I:P/A:P/E:U/RL:U/RC:C
Product Names From Source
Cisco Unified Computing System (Standalone)

CSAF Product Statuses

Product Status Source CVE Rows
Cisco Unified Computing System (Standalone) known_affected cisco_csaf CVE-2015-0633 1

Related Products

Product CVE Evidence
Cisco Unified Computing System (Standalone) CVE-2015-0633 Cisco OpenVuln