Buffer overflow in Supermicro H8dcl-6f

CVE-2013-3607

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.

Vulnerability class: Buffer Overflow

EPSS: 0.097 (95.0th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cret@cert.org (vdb-entry, x_refsource_BID)
cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
cret@cert.org (x_refsource_CONFIRM)
cret@cert.org (Exploit, x_refsource_MISC)
cret@cert.org (x_refsource_MISC)
cret@cert.org (x_refsource_CONFIRM)