Cisco TelePresence Video Communication Server 'User-Agent' HTTP Header HTML Injection Vulnerability

Bugtraq ID:	50084
Class:	Input Validation Error
CVE:	CVE-2011-3294
Remote:	Yes
Local:	No
Published:	Oct 12 2011 12:00AM
Updated:	Oct 21 2011 03:35PM
Credit:	Billy Hoffman of Zoompf, Inc.
Vulnerable:	Cisco TelePresence Video Communication Server (VCS) 0
Not Vulnerable:	Cisco TelePresence Video Communication Server (VCS) X7.0

Cisco TelePresence Video Communication Server 'User-Agent' HTTP Header HTML Injection Vulnerability

Cisco TelePresence Video Communication Server is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Cisco TelePresence Video Communication Server X7.0 are affected.

Cisco TelePresence Video Communication Server 'User-Agent' HTTP Header HTML Injection Vulnerability

Attackers can exploit this issue using a browser or readily available tools.

Cisco TelePresence Video Communication Server 'User-Agent' HTTP Header HTML Injection Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Cisco TelePresence Video Communication Server 'User-Agent' HTTP Header HTML Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Unified Communications Manager (CUCM) is a software-based call-processing (CIsco)