Multiple Cisco TelePresence Products Arbitrary File Upload Vulnerability

Bugtraq ID:	46516
Class:	Input Validation Error
CVE:	CVE-2011-0385
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 23 2011 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Telepresence Recording Server 1.6.1 Cisco Telepresence Recording Server 1.6 Cisco CTMS 1.6 Cisco CTMS 1.5 Cisco CTMS 1.1 Cisco CTMS 1.0
Not Vulnerable:	Cisco Telepresence Recording Server 1.6.2 Cisco CTMS 1.7

Multiple Cisco TelePresence Products Arbitrary File Upload Vulnerability

Multiple Cisco TelePresence products are prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary files on the webserver. Successful exploits may allow attackers to execute arbitrary code.

This issue is tracked by Cisco bug IDs CSCth85786 and CSCth61065.

Multiple Cisco TelePresence Products Arbitrary File Upload Vulnerability

Attackers can exploit this issue using a browser or readily available tools.

Multiple Cisco TelePresence Products Arbitrary File Upload Vulnerability

Solution:
Vendor updates are available. Please see the referenced advisories for more information.

Multiple Cisco TelePresence Products Arbitrary File Upload Vulnerability

References:

• Vendor Homepage (Softon Technologies)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Endpoint (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager (Cisco)