First published: Sun Sep 18 2016(Updated: )
UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco Unified Computing System software | =2.2\(1b\) | |
Cisco Unified Computing System software | =2.2\(1c\) | |
Cisco Unified Computing System software | =2.2\(1d\) | |
Cisco Unified Computing System software | =2.2\(1e\) | |
Cisco Unified Computing System software | =2.2\(1f\) | |
Cisco Unified Computing System software | =2.2\(1g\) | |
Cisco Unified Computing System software | =2.2\(1h\) | |
Cisco Unified Computing System software | =2.2\(2c\) | |
Cisco Unified Computing System software | =2.2\(2c\)a | |
Cisco Unified Computing System software | =2.2\(2d\) | |
Cisco Unified Computing System software | =2.2\(2e\) | |
Cisco Unified Computing System software | =2.2\(3a\) | |
Cisco Unified Computing System software | =2.2\(3b\) | |
Cisco Unified Computing System software | =2.2\(3c\) | |
Cisco Unified Computing System software | =2.2\(3d\) | |
Cisco Unified Computing System software | =2.2\(3e\) | |
Cisco Unified Computing System software | =2.2\(3f\) | |
Cisco Unified Computing System software | =2.2\(3g\) | |
Cisco Unified Computing System software | =2.2\(4b\) | |
Cisco Unified Computing System software | =2.2\(4c\) | |
Cisco Unified Computing System software | =2.2\(5a\) | |
Cisco Unified Computing System software | =2.2\(5b\)a | |
Cisco Unified Computing System software | =2.2_base | |
Cisco Unified Computing System software | =3.0\(1c\) | |
Cisco Unified Computing System software | =3.0\(1d\) | |
Cisco Unified Computing System software | =3.0\(1e\) | |
Cisco Unified Computing System software | =3.0\(2c\) | |
Cisco Unified Computing System software | =3.0\(2d\) |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-6402 has a severity rating of critical due to the potential for local users to gain root access.
To fix CVE-2016-6402, upgrade to a version of Cisco UCS Manager or UCS 6200 Fabric Interconnects that is later than 3.0(2d).
CVE-2016-6402 affects local users of Cisco Unified Computing System software versions up to 3.0(2d).
CVE-2016-6402 allows local attackers to obtain OS root access through crafted command-line interface input.
CVE-2016-6402 was disclosed on September 14, 2016.