critical10.0Public exploit code
CVE-2013-3623
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Supermicro Onboard IPMI - 'close_window.cgi' Remote Buffer Overflow (Metasploit)2013-11-18 · remote · hardware · Verified
Impact
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Supermicro | Intelligent Platform Management Firmware | through 2.26 Version 2.24 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.exploit-db.com/exploits/29666
- http://www.securityfocus.com/bid/63775
- http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
- http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
- https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities
- https://support.citrix.com/article/CTX216642
- http://www.exploit-db.com/exploits/29666
- http://www.securityfocus.com/bid/63775
- http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
- http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
- https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities
- https://support.citrix.com/article/CTX216642