Cisco TelePresence Multipoint Switch and Recording Server Denial of Service Vulnerability

Bugtraq ID:	46523
Class:	Design Error
CVE:	CVE-2011-0388
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 23 2011 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Telepresence Recording Server 1.6.1 Cisco Telepresence Recording Server 1.6 Cisco TelePresence Multipoint Switch 1.6.0 Cisco TelePresence Multipoint Switch 1.5.0 Cisco TelePresence Multipoint Switch 1.1.0 Cisco TelePresence Multipoint Switch 1.0.0
Not Vulnerable:	Cisco Telepresence Recording Server 1.6.2 Cisco Telepresence Recording Server 1.7.1 Cisco TelePresence Multipoint Switch 1.7.1 Cisco TelePresence Multipoint Switch 1.7.0

Cisco TelePresence Multipoint Switch and Recording Server Denial of Service Vulnerability

Cisco TelePresence Multipoint Switch and Recording Server are prone to a denial-of-service vulnerability because they fail to restrict access to the RMI interface of the Java Servlet framework.

An attacker can exploit this issue to cause an out-of-memory condition, denying further service to legitimate users.

This issue is tracked by Cisco bug IDs CSCtg35825 and CSCtg35830.

Cisco TelePresence Multipoint Switch and Recording Server Denial of Service Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco TelePresence Multipoint Switch and Recording Server Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cisco TelePresence Multipoint Switch and Recording Server Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoi (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recordin (Cisco)