LifeSize Room Security Bypass and Command Injection Vulnerabilities

Bugtraq ID:	49330
Class:	Unknown
CVE:	CVE-2011-2762 CVE-2011-2763
Remote:	Yes
Local:	No
Published:	Aug 26 2011 12:00AM
Updated:	Aug 26 2011 12:00AM
Credit:	Spencer McIntyre
Vulnerable:	LifeSize Communications LifeSize Room 4.7.18 LifeSize Communications LifeSize Room 3.5.3
Not Vulnerable:

LifeSize Room Security Bypass and Command Injection Vulnerabilities

LifeSize Room is prone to a security-bypass vulnerability and a command-injection vulnerability.

Exploiting these issues could allow an attacker to bypass authentication or execute arbitrary commands in the context of the application.

LifeSize Room versions 3.5.3 and 4.7.18 are affected; other versions may also be vulnerable.

LifeSize Room Security Bypass and Command Injection Vulnerabilities

Attackers can use readily available tools to exploit the issues.

The following exploit is available:

• /data/vulnerabilities/exploits/49330.rb

LifeSize Room Security Bypass and Command Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are error or if you are aware of any more recent information, please mail us at: [email protected].

LifeSize Room Security Bypass and Command Injection Vulnerabilities

References:

• LifeSize Room Homepage (LifeSize Communications)