Cisco Unified Computing System Private Key Disclosure Vulnerability

Bugtraq ID:	62455
Class:	Design Error
CVE:	CVE-2012-4074
Remote:	Yes
Local:	No
Published:	Sep 17 2013 12:00AM
Updated:	Sep 21 2013 12:11AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified Computing System Private Key Disclosure Vulnerability

Cisco Unified Computing System is prone to an information-disclosure vulnerability in the implementation of Serial over LAN (SoL).

Attackers can exploit this issue to obtain the private key and use it to decrypt traffic between end user and affected system.

Successfully exploiting this issue allows attackers to view or modify Serial over LAN (SoL) communications by performing man-in-the-middle attacks.

This issue is tracked by Cisco Bug ID CSCte90338.

Cisco Unified Computing System Private Key Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Cisco Unified Computing System Private Key Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Computing System Private Key Disclosure Vulnerability

References:

• Cisco Homepage (Cisco)