PT-2017-7610 · Ibm · Ibm Sametime Enterprise Meeting Server

Published 2017-08-29 · Updated 2017-09-07 · CVE-2016-0354

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Sametime Enterprise Meeting Server versions 8.5.2 through 9.0

Description The issue allows an authenticated user to upload a malicious file to a meeting room, which could then be downloaded by other users. This malicious file could be executed with the privileges of the user who downloads it.

Recommendations For versions 8.5.2 through 9.0, consider restricting file upload capabilities to trusted users or disabling file sharing in meeting rooms until a fix is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2016-0354

Affected Products

Ibm Sametime Enterprise Meeting Server

References · 6

• http://ibm.com/support/docview.wss?uid=swg22006439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0354 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0354 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/111893 · Vendor Advisory
• http://securitytracker.com/id/1039231 · Note
• http://securityfocus.com/bid/100599 · Note