PT-2015-7149 · Cisco · Cisco Telepresence Server

Published 2015-09-20 · Updated 2016-12-29 · CVE-2015-6284

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Server software versions prior to 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices

Description The issue is related to a buffer overflow in the Conference Control Protocol API implementation. This allows remote attackers to cause a denial of service, resulting in a device crash, by sending a crafted URL.

Recommendations For versions prior to 4.1(2.33), update to version 4.1(2.33) or later to resolve the issue. As a temporary workaround, consider restricting access to the Conference Control Protocol API implementation to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-6284

Affected Products

Cisco Telepresence Server

References · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-tps · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6284 · Security Note
• http://securitytracker.com/id/1033580 · Note