|
|
|
|
| |
Credit:
The original article can be found at: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml
|
| |
Vulnerable Systems:
* Cisco TelePresence System Software prior to 1.7.1
Immune Systems:
* Cisco TelePresence System Software 1.7.1
This security advisory outlines details of the following vulnerabilities:
* Unauthenticated Java Servlet Access
* Unauthenticated Arbitrary File Upload
* Cisco Discovery Protocol Remote Code Execution
* Unauthorized Servlet Access
* Java RMI Denial of Service
* Real-Time Transport Control Protocol Denial of Service
* XML-Remote Procedure Call (RPC) Denial of Service
Unauthenticated Java Servlet Access
A number of sensitive Java Servlets delivered via a Java Servlet framework in the Cisco Telepresence Multipoint Switch could allow a remote, unauthenticated attacker to perform actions that should be restricted to administrative users only. The attacker would need the ability to submit a crafted request to an affected device on TCP port 80, 443, or 8080.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit these vulnerabilities.
Unauthenticated Arbitrary File Upload
An arbitrary file upload vulnerability exists in the administrative web interface of the Cisco TelePresence Multipoint Switch. An unauthenticated, remote attacker could submit a crafted request to an affected device that would allow for the placement of attacker-controlled content in arbitrary locations on the device. The attacker would need the ability to submit a crafted request to an affected device on TCP port 80 or 443.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit this vulnerability.
Cisco Discovery Protocol Remote Code Execution
A remote code execution vulnerability exists in Cisco TelePresence Multipoint Switch devices. An unauthenticated, adjacent attacker could exploit the vulnerability by submitting a malicious Cisco Discovery Protocol packet to the affected system. When parsed, the malicious packet may trigger a buffer overflow.
Because Cisco Discovery Protocol works at the data link layer (Layer 2), an attacker must have a way to submit an Ethernet frame directly to an affected device. This may be possible in situations where the affected system is part of a bridged network or connected to a nonpartitioned device such as a network hub.
Unauthorized Servlet Access
An unauthorized servlet access issue exists in the administrative web interface of Cisco TelePresence Multipoint Switch devices. This issue could allow a remote, authenticated attacker with unprivileged access to cause a denial of service condition on an affected device. The attacker would need the ability to submit a crafted request to an affected device on TCP port 80 or 443.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit this vulnerability.
Java RMI Denial of Service
A denial of service vulnerability exists in Cisco TelePresence Multipoint Switch devices due to a failure to properly restrict access to the RMI interface of the Java Servlet framework. An unauthenticated, remote attacker could trigger an out-of-memory condition on the servlet host by issuing a series of crafted requests. The attacker would need the ability to communicate to an affected device on TCP port 8999.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit this vulnerability.
Real-Time Transport Control Protocol Denial of Service
A Real-Time Transport Control Protocol (RTCP) denial of service vulnerability exists within Cisco TelePresence Multipoint Switch devices. An unauthenticated, remote attacker could send a malicious RTCP packet to a listening RTCP control port to crash the call control process. The attacker would need to have the ability to communicate to an affected device on a UDP port that was randomly selected and negotiated during call setup.
Because the vulnerability is within a UDP-based service, the attacker would not be required to perform a handshake prior to making the crafted request. This could allow the attacker to spoof the source address of an attack.
XML-RPC Denial of Service
An XML-RPC denial of service vulnerability exists in Cisco TelePresence Multipoint Switch devices. A remote, unauthenticated attacker could send a malicious request to an affected device to trigger a crash of the call geometry process. The attacker would need the ability to communicate to an affected device on TCP port 9000.
An attacker must perform a three-way TCP handshake and establish a valid session to exploit this vulnerability.
Patch Availability:
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade solution.
CVE Information:
CVE-2011-0383
CVE-2011-0384
CVE-2011-0385
CVE-2011-0379
CVE-2011-0387
CVE-2011-0388
CVE-2011-0389
CVE-2011-0390
Disclosure Timeline:
Revision 1.0 2011-February-23 Initial public release.
|
|
|
|
|
