PT-2010-1356 · Tandberg · Tandberg Video Communication Server

Publicado 2010-04-13 · Atualizado 2018-10-10 · CVE-2009-4509

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TANDBERG Video Communication Server (VCS) versions prior to X4.3

Description The issue concerns the administrative web console of the TANDBERG Video Communication Server (VCS). It uses predictable session cookies in certain PHP files, making it easier for remote attackers to bypass authentication and potentially execute arbitrary code. This can be achieved by loading a custom software update via a crafted "Cookie: tandberg login=" HTTP header.

Recommendations For versions prior to X4.3, update to version X4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative web console to minimize the risk of exploitation. Avoid using the tandberg login cookie in the affected HTTP header until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-4509

Produtos afetados

Tandberg Video Communication Server

Referências · 5

• http://vsecurity.com/resources/advisory/20100409-1 · Aviso do Fabricante
• http://secunia.com/advisories/39275 · Aviso do Fabricante
• http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X4%29.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4509 · Nota de Segurança
• http://securityfocus.com/archive/1/510672/100/0/threaded · Nota