Polycom ViewStation Unicode Directory Traversal Vulnerability

Bugtraq ID:	5632
Class:	Input Validation Error
CVE:	CVE-2002-0627
Remote:	Yes
Local:	No
Published:	Sep 04 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovery of this issue is credited to Jeff Horne of the ISS X-Force.
Vulnerable:	Polycom ViewStation V.35 7.2 Polycom ViewStation V.35 6.5.1 Polycom ViewStation SP/SP384 7.2 Polycom ViewStation SP/SP384 6.5.1 Polycom ViewStation MP 7.2 Polycom ViewStation MP 6.5.1 Polycom ViewStation H.323 7.2 Polycom ViewStation H.323 6.5.1 Polycom ViewStation FX/VS 4000 4.1.5 Polycom ViewStation DCP 7.2 Polycom ViewStation DCP 6.5.1 Polycom ViewStation 512 7.2 Polycom ViewStation 512 6.5.1 Polycom ViewStation 128 7.2 Polycom ViewStation 128 6.5.1
Not Vulnerable:	Polycom ViewStation FX/VS 4000 4.2

Polycom ViewStation Unicode Directory Traversal Vulnerability

ViewStation is vulnerable to Unicode directory traversal attacks. This could allow attackers to retrieve unauthorized information about the device, including the administrator password.

Polycom ViewStation Unicode Directory Traversal Vulnerability

This issue may be exploited with a web browser.

Polycom ViewStation Unicode Directory Traversal Vulnerability

Solution:
This issue has been addressed in ViewStation FX/VS4000 4.2. Fixes for other products are scheduled for later release. Those affected by this issue should contact the vendor about obtaining fixes.

Polycom ViewStation Unicode Directory Traversal Vulnerability

References:

• Multiple Remote Vulnerabilities in Polycom Videoconferencing Products (Internet Security Systems )
  
• Polycom Worldwide Resource Center (Polycom)