Cisco Unified Computing System SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	63209
Class:	Design Error
CVE:	CVE-2012-4117
Remote:	Yes
Local:	No
Published:	Oct 17 2013 12:00AM
Updated:	Oct 21 2013 12:38AM
Credit:	Cisco
Vulnerable:	Cisco Unified Computing System (UCS) 2.0(1m) Cisco Unified Computing System (UCS) 2.0 Cisco Unified Computing System (UCS) 1.4(3s) Cisco Unified Computing System (UCS) 1.4(3q) Cisco Unified Computing System (UCS) 1.4(3m) Cisco Unified Computing System (UCS) 1.4(3l) Cisco Unified Computing System (UCS) 1.4(3i) Cisco Unified Computing System (UCS) 1.4(1m) Cisco Unified Computing System (UCS) 1.4(1j) Cisco Unified Computing System (UCS) 1.4(1i)
Not Vulnerable:

Cisco Unified Computing System SSL Certificate Validation Security Bypass Vulnerability

Cisco Unified Computing System is prone to a security-bypass vulnerability.

An attacker can exploit this issue to perform man-in-the-middle attacks and perform certain unauthorized actions, which will aid in further attacks.

This issue is being tracked by Cisco Bug ID CSCtr73033.

Cisco Unified Computing System SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available tools to exploit this issue.

Cisco Unified Computing System SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Computing System SSL Certificate Validation Security Bypass Vulnerability

References: