PT-2011-2310 · Cisco · Cisco Telepresence Multipoint Switch+1

Published 2011-02-25 · Updated 2011-04-09 · CVE-2011-0388

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Recording Server devices version 1.6.x Cisco TelePresence Multipoint Switch (CTMS) devices versions 1.0.x through 1.6.x

Description The issue is related to improper restriction of remote access to the Java servlet RMI interface. This allows remote attackers to cause a denial of service, resulting in memory consumption and web outage, via multiple crafted requests.

Recommendations For Cisco TelePresence Recording Server devices version 1.6.x: Restrict access to the Java servlet RMI interface to minimize the risk of exploitation. For Cisco TelePresence Multipoint Switch (CTMS) devices versions 1.0.x through 1.6.x: Restrict access to the Java servlet RMI interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-0388

Affected Products

Cisco Telepresence Multipoint Switch

Cisco Telepresence Recording Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-0388 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e11d.shtml · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b6e14e.shtml · Vendor Advisory
• http://securitytracker.com/id?1025114 · Note
• http://securityfocus.com/bid/46523 · Note
• http://securitytracker.com/id?1025113 · Note