Cisco TelePresence Multipoint Switch and Recording Server Security Bypass Vulnerability

Bugtraq ID:	46519
Class:	Design Error
CVE:	CVE-2011-0383
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 23 2011 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Telepresence Recording Server 1.6.1 Cisco Telepresence Recording Server 1.6 Cisco TelePresence Multipoint Switch 1.6.0 Cisco TelePresence Multipoint Switch 1.5.0 Cisco TelePresence Multipoint Switch 1.1.0 Cisco TelePresence Multipoint Switch 1.0.0
Not Vulnerable:	Cisco Telepresence Recording Server 1.6.2 Cisco Telepresence Recording Server 1.7.1 Cisco TelePresence Multipoint Switch 1.7.1 Cisco TelePresence Multipoint Switch 1.7.0

Cisco TelePresence Multipoint Switch and Recording Server Security Bypass Vulnerability

Cisco TelePresence Multipoint Switch and Recording Server are prone to a security-bypass vulnerability
that affects the Java Servlet framework.

An attacker can exploit this issue to gain unauthenticated access to the affected device. Successful exploits will result in the complete compromise of the affected device.

Cisco TelePresence Multipoint Switch and Recording Server Security Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco TelePresence Multipoint Switch and Recording Server Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cisco TelePresence Multipoint Switch and Recording Server Security Bypass Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoi (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recordin (Cisco)