PT-2011-2305 · Cisco+1 · Cisco Telepresence Multipoint Switch+2

Publicado 2011-02-25 · Atualizado 2017-08-17 · CVE-2011-0383

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Recording Server versions 1.6.x before 1.6.2 Cisco TelePresence Multipoint Switch (CTMS) versions 1.0.x, 1.1.x, 1.5.x, and 1.6.x

Description The Java Servlet framework does not require administrative authentication for certain actions, allowing remote attackers to execute arbitrary code via a crafted request.

Recommendations For Cisco TelePresence Recording Server versions 1.6.x before 1.6.2, update to version 1.6.2 or later. For Cisco TelePresence Multipoint Switch (CTMS) versions 1.0.x, 1.1.x, 1.5.x, and 1.6.x, consider restricting access to the Java Servlet framework until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-0383

Produtos afetados

Cisco Telepresence Multipoint Switch

Cisco Telepresence Recording Server

Java Servlet

Referências · 7

• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml · Aviso do Fabricante
• http://securityfocus.com/bid/46519 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml · Aviso do Fabricante
• http://securitytracker.com/id?1025114 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65602 · Nota
• http://securitytracker.com/id?1025113 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0383 · Nota de Segurança