PT-2013-2936 · Cisco · Cisco Unified Meetingplace Application Server

Published 2013-04-11 · Updated 2013-04-15 · CVE-2013-1168

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.5MR2 Patch 9, and 8.5 before 8.5MR3 Patch 1 can be simplified to Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0 Cisco Unified MeetingPlace Application Server versions 8.5 through 8.5MR2 However, the correct simplification is Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0 Cisco Unified MeetingPlace Application Server versions 8.5 through 8.5MR2

Description The web server in Cisco Unified MeetingPlace Application Server does not invalidate a session upon a logout action, making it easier for remote attackers to hijack sessions by leveraging knowledge of a session cookie.

Recommendations For Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1, update to version 7.1MR1 Patch 2 or later. For Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0, update to version 8.0MR1 Patch 1 or later. For Cisco Unified MeetingPlace Application Server versions 8.5 through 8.5MR2, update to version 8.5MR3 Patch 1 or later.

Fix

Related Identifiers

CVE-2013-1168

Affected Products

Cisco Unified Meetingplace Application Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-1168 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-mp · Vendor Advisory