Supermicro IPMI 'close_window.cgi' Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	63775
Class:	Boundary Condition Error
CVE:	CVE-2013-3623
Remote:	Yes
Local:	No
Published:	Nov 06 2013 12:00AM
Updated:	Sep 09 2016 05:00PM
Credit:	HD Moore of Rapid7
Vulnerable:	Super Micro Computer Supermicro IPMI SMT_X9_226 Citrix NetScaler T1 0 Citrix NetScaler Service Delivery Appliance 0 Citrix NetScaler Gateway 0 Citrix NetScaler Application Delivery Controller (ADC) 0 Citrix Command Center Appliance 0 Citrix CloudBridge 0
Not Vulnerable:	Super Micro Computer Supermicro IPMI SMT_X9_315

Supermicro IPMI 'close_window.cgi' Multiple Buffer Overflow Vulnerabilities

Supermicro IPMI is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Attackers may be able to execute arbitrary code in the context of the affected firmware. Failed exploit attempts will likely result in denial-of-service conditions.

Supermicro IPMI running firmware version SMT_X9_226 is vulnerable.

Supermicro IPMI 'close_window.cgi' Multiple Buffer Overflow Vulnerabilities

The following exploit is available:

• /data/vulnerabilities/exploits/63775.rb

Supermicro IPMI 'close_window.cgi' Multiple Buffer Overflow Vulnerabilities

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.