Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
BID:44922
Info
Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
| Bugtraq ID: | 44922 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-3037 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2010 12:00AM |
| Updated: | Dec 06 2010 07:55PM |
| Credit: | Florent Daigniere |
| Vulnerable: |
Cisco Unified Videoconferencing 5230 System 0 Cisco Unified Videoconferencing 5115 System 0 Cisco Unified Videoconferencing 5110 System 0 Cisco Unified Videoconferencing 3545 System 0 Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gate 0 Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gatew 0 Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU) 0 Cisco Unified Videoconferencing 0 |
| Not Vulnerable: |
Cisco Unified Videoconferencing 5230 System 7.1.2.15 Cisco Unified Videoconferencing 5115 System 7.1.2.15 Cisco Unified Videoconferencing 5110 System 7.1.2.12 Cisco Unified Videoconferencing 3545 System 5.7.2 Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gate 5.7.2 Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gatew 5.7.2 Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU) 5.7.2 |
Discussion
Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
Cisco Unified Videoconferencing is prone to multiple remote command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
An administrator who is authenticated to the web interface of a Cisco UVC product can exploit these issues to execute arbitrary commands with root-level privileges on the Linux operating system.
These issues are being tracked by Cisco bug ID CSCti54059.
NOTE: These issues were previously discussed in BID 44908 (Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness) but have been given their own record for better documentation.
Cisco Unified Videoconferencing is prone to multiple remote command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
An administrator who is authenticated to the web interface of a Cisco UVC product can exploit these issues to execute arbitrary commands with root-level privileges on the Linux operating system.
These issues are being tracked by Cisco bug ID CSCti54059.
NOTE: These issues were previously discussed in BID 44908 (Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness) but have been given their own record for better documentation.
Exploit / POC
Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Solution / Fix
Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
References:
References:
- Cisco Unified Videoconferencing Homepage (Cisco)
- Cisco Security Response: Multiple Vulnerabilities in Cisco Unified Videoconferen (Cisco)
- Cisco Unified Videoconferencing multiple vulnerabilities - CVE-2010-3037 CVE-20 (Florent Daigniere
- Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Videoconferen (Cisco)
- Multiple Vulnerabilities in Cisco Unified Videoconferencing Products (Cisco)