PT-2011-2305 · Cisco+1 · Cisco Telepresence Multipoint Switch+2

Published 2011-02-25 · Updated 2017-08-17 · CVE-2011-0383

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Recording Server versions 1.6.x before 1.6.2 Cisco TelePresence Multipoint Switch (CTMS) versions 1.0.x, 1.1.x, 1.5.x, and 1.6.x

Description The Java Servlet framework does not require administrative authentication for certain actions, allowing remote attackers to execute arbitrary code via a crafted request.

Recommendations For Cisco TelePresence Recording Server versions 1.6.x before 1.6.2, update to version 1.6.2 or later. For Cisco TelePresence Multipoint Switch (CTMS) versions 1.0.x, 1.1.x, 1.5.x, and 1.6.x, consider restricting access to the Java Servlet framework until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-0383

Affected Products

Cisco Telepresence Multipoint Switch

Cisco Telepresence Recording Server

Java Servlet

References · 7

• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0383 · Security Note
• http://securityfocus.com/bid/46519 · Note
• http://securitytracker.com/id?1025114 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65602 · Note
• http://securitytracker.com/id?1025113 · Note