Details of VAR-201310-0013

ID

VAR-201310-0013

CVE

CVE-2012-4136

TITLE

Cisco Unified Computing System Vulnerability in vulnerable fabric interconnect component

Trust: 0.8

sources: JVNDB: JVNDB-2013-004475

DESCRIPTION

The high-availability service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) does not properly bind the cluster service to the management interface, which allows remote attackers to obtain sensitive information or cause a denial of service (peer-syncing outage) via a TELNET connection, aka Bug ID CSCtz72910. Vendors report this vulnerability Bug ID CSCtz72910 Published as.By a third party, TELNET Over the connection, important information is obtained or denial of service ( Stop peer synchronization ) May be in a state. Cisco Unified Computing System is prone to a remote security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. This issue is tracked by Cisco Bug ID CSCtz72910. The system integrates network, computing and virtualization resources into one platform by extensively adopting virtualization technology

Trust: 1.98

sources: NVD: CVE-2012-4136 // JVNDB: JVNDB-2013-004475 // BID: 62655 // VULHUB: VHN-57417

AFFECTED PRODUCTS

vendor:	cisco	model:	unified computing system 1.4	scope:	-	version:	-	Trust: 2.4
vendor:	cisco	model:	unified computing system	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	unified computing system	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	unified computing system software	scope:	lte	version:	2.1	Trust: 0.8

sources: BID: 62655 // JVNDB: JVNDB-2013-004475 // CNNVD: CNNVD-201309-525 // NVD: CVE-2012-4136

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-4136
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-4136
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201309-525
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-57417
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-4136
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-57417
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-57417 // JVNDB: JVNDB-2013-004475 // CNNVD: CNNVD-201309-525 // NVD: CVE-2012-4136

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-57417 // JVNDB: JVNDB-2013-004475 // NVD: CVE-2012-4136

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201309-525

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201309-525

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-004475

PATCH

title:	Cisco Unified Computing System Fabric Interconnect Remote Access Vulnerability	url:	http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVS-2012-4136	Trust: 0.8
title:	30997	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=30997	Trust: 0.8

sources: JVNDB: JVNDB-2013-004475

EXTERNAL IDS

db:	NVD	id:	CVE-2012-4136	Trust: 2.8
db:	SECUNIA	id:	54171	Trust: 1.1
db:	BID	id:	62655	Trust: 1.0
db:	JVNDB	id:	JVNDB-2013-004475	Trust: 0.8
db:	CNNVD	id:	CNNVD-201309-525	Trust: 0.7
db:	CISCO	id:	20130925 CISCO UNIFIED COMPUTING SYSTEM FABRIC INTERCONNECT REMOTE ACCESS VULNERABILITY	Trust: 0.6
db:	VULHUB	id:	VHN-57417	Trust: 0.1

sources: VULHUB: VHN-57417 // BID: 62655 // JVNDB: JVNDB-2013-004475 // CNNVD: CNNVD-201309-525 // NVD: CVE-2012-4136

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cvs-2012-4136	Trust: 1.7
url:	http://secunia.com/advisories/54171	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4136	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4136	Trust: 0.8
url:	http://www.securityfocus.com/bid/62655	Trust: 0.6
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-57417 // BID: 62655 // JVNDB: JVNDB-2013-004475 // CNNVD: CNNVD-201309-525 // NVD: CVE-2012-4136

CREDITS

Cisco

Trust: 0.9

sources: BID: 62655 // CNNVD: CNNVD-201309-525

SOURCES

db:	VULHUB	id:	VHN-57417
db:	BID	id:	62655
db:	JVNDB	id:	JVNDB-2013-004475
db:	CNNVD	id:	CNNVD-201309-525
db:	NVD	id:	CVE-2012-4136

LAST UPDATE DATE

2024-08-14T13:58:11.237000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-57417	date:	2016-09-22T00:00:00
db:	BID	id:	62655	date:	2013-09-28T00:14:00
db:	JVNDB	id:	JVNDB-2013-004475	date:	2013-10-07T00:00:00
db:	CNNVD	id:	CNNVD-201309-525	date:	2013-10-09T00:00:00
db:	NVD	id:	CVE-2012-4136	date:	2016-09-22T17:35:12.603

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-57417	date:	2013-10-03T00:00:00
db:	BID	id:	62655	date:	2013-09-25T00:00:00
db:	JVNDB	id:	JVNDB-2013-004475	date:	2013-10-07T00:00:00
db:	CNNVD	id:	CNNVD-201309-525	date:	2013-09-30T00:00:00
db:	NVD	id:	CVE-2012-4136	date:	2013-10-03T11:03:38.680