|
|
|
|
| |
Credit:
The original article can be found at: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14f.shtml
|
| |
Vulnerable Systems:
* Cisco TelePresence Manager software prior to 1.7.0
Immune Systems:
* Cisco TelePresence Manager software 1.7.0
This security advisory outlines the details of the following vulnerabilities:
* Simple Object Access Protocol (SOAP) Authentication Bypass
* Java Remote Method Invocation (RMI) Command Injection
* Cisco Discovery Protocol Remote Code Execution
SOAP Authentication Bypass
An authentication bypass vulnerability exists that could allow a remote, unauthenticated attacker to invoke arbitrary methods that are available via the SOAP interface on the Cisco TelePresence Manager. The attacker would need the ability to submit a malformed SOAP request that is designed to trigger the vulnerability to the affected device on TCP port 8080 or 8443.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit this vulnerability.
Java RMI Command Injection
A command injection vulnerability exists in the Java RMI interface that is exposed on the Cisco TelePresence Manager. The vulnerability could allow an unauthenticated, remote attacker to perform a number of actions on the device with elevated privileges. The attacker would need to be able to submit a crafted request to the affected device on TCP port 1100 or 32000.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit these vulnerabilities.
Cisco Discovery Protocol Remote Code Execution
A remote code execution vulnerability exists in Cisco TelePresence Manager devices. This vulnerability could allow an unauthenticated, adjacent attacker to trigger a buffer overflow condition. The attacker would need the ability to submit a malicious Cisco Discovery Protocol packet to the affected system to exploit this vulnerability.
Because Cisco Discovery Protocol operates at Layer 2, an attacker must have a way to submit an Ethernet frame directly to an affected device. This submission may be possible in situations in which the affected system is part of a bridged network or connected to a nonpartitioned device, such as a network hub.
Patch Availability:
When considering software upgrades, also consult
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade solution.
CVE Information:
CVE-2011-0379
CVE-2011-0380
CVE-2011-0381
Disclosure Timeline:
Revision 1.0 2011-February-23 Initial public release
|
|
|
|
|
