PT-2015-1976 · Cisco · Cisco Telepresence Video Communication Server

Publicado 2015-08-26 · Atualizado 2017-01-04 · CVE-2015-6261

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.2

Description The issue is related to a lack of protection for service data in the Cisco TelePresence Video Communication Server software. It allows a remote, authenticated attacker to bypass existing access restrictions and read configuration files by using the Mobile and Remote Access (MRA) role during the setup of a TFTP connection.

Recommendations For version X8.5.2, consider restricting access to the MRA role to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the MRA role for TFTP sessions.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-11322

CVE-2015-6261

Produtos afetados

Cisco Telepresence Video Communication Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-6261 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40620 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-11322 · Nota de Segurança
• http://securitytracker.com/id/1033379 · Nota