CVE-2016-6402: High severity cisco unified computing system software vulnerability
Published Sep 18, 2016
·Updated
UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263.
Affected Software
28 affected components
Cisco Unified Computing System=2.2\(1b\)
Cisco Unified Computing System=2.2\(1c\)
Cisco Unified Computing System=2.2\(1d\)
Cisco Unified Computing System=2.2\(1e\)
Cisco Unified Computing System=2.2\(1f\)
Cisco Unified Computing System=2.2\(1g\)
Cisco Unified Computing System=2.2\(1h\)
Cisco Unified Computing System=2.2\(2c\)
Cisco Unified Computing System=2.2\(2c\)a
Cisco Unified Computing System=2.2\(2d\)
Cisco Unified Computing System=2.2\(2e\)
Cisco Unified Computing System=2.2\(3a\)
Cisco Unified Computing System=2.2\(3b\)
Cisco Unified Computing System=2.2\(3c\)
Cisco Unified Computing System=2.2\(3d\)
Cisco Unified Computing System=2.2\(3e\)
Cisco Unified Computing System=2.2\(3f\)
Cisco Unified Computing System=2.2\(3g\)
Cisco Unified Computing System=2.2\(4b\)
Cisco Unified Computing System=2.2\(4c\)
Cisco Unified Computing System=2.2\(5a\)
Cisco Unified Computing System=2.2\(5b\)a
Cisco Unified Computing System=2.2_base
Cisco Unified Computing System=3.0\(1c\)
Cisco Unified Computing System=3.0\(1d\)
Cisco Unified Computing System=3.0\(1e\)
Cisco Unified Computing System=3.0\(2c\)
Cisco Unified Computing System=3.0\(2d\)
Event History
Sep 18, 2016
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-6402?
CVE-2016-6402 has a severity rating of critical due to the potential for local users to gain root access.
2
How do I fix CVE-2016-6402?
To fix CVE-2016-6402, upgrade to a version of Cisco UCS Manager or UCS 6200 Fabric Interconnects that is later than 3.0(2d).
3
Who is affected by CVE-2016-6402?
CVE-2016-6402 affects local users of Cisco Unified Computing System software versions up to 3.0(2d).
4
What does CVE-2016-6402 allow attackers to do?
CVE-2016-6402 allows local attackers to obtain OS root access through crafted command-line interface input.
5
When was CVE-2016-6402 disclosed?
CVE-2016-6402 was disclosed on September 14, 2016.