Cisco TelePresence Manager and Multipoint Switch Bugs Lets Remote Users Deny Service and Remote Users on the Adjacent Network Execute Arbitrary Code
SecurityTracker Alert ID: 1027241|
SecurityTracker URL: http://securitytracker.com/id/1027241
(Links to External Site)
Updated: Jul 12 2012|
Original Entry Date: Jul 11 2012
Denial of service via network, Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): prior to 1.9.0|
Two vulnerabilities were reported in Cisco TelePresence Manager and Cisco TelePresence Multipoint Switch. A remote user on the local network can execute arbitrary code on the target system. A remote user can cause denial of service conditions.|
A remote user on the adjacent network can send specially crafted Cisco Discovery Protocol packets to execute arbitrary code on the target system with elevated privileges [CVE-2012-2486].
Cisco has assigned Cisco bug ID CSCtz40965 (for Cisco TelePresence Multipoint Switch) and CSCtz40947 (for Cisco TelePresence Manager) to this vulnerability.
A remote user can send a sequence of specially crafted IP packets and TCP connection requests or terminations at a high rate to prevent the target device from responding to new connection requests [CVE-2012-3073]. Some services and processes may crash.
Cisco has assigned Cisco bug IDs CSCty11219, CSCty11323, and CSCty11338 (for Cisco TelePresence Multipoint Switch) and CSCti21851, CSCtj19100, CSCtj19086, and CSCtj19078 (for Cisco TelePresence Manager) to this vulnerability.
A remote user on the local network can execute arbitrary code on the target system.|
A remote user can cause denial of service conditions.
The vendor has issued a fix (1.9.0).|
The vendor's advisories are available at:
Vendor URL: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms (Links to External Site)
Source Message Contents
Date: Wed, 11 Jul 2012 12:09:51 -0400|
Subject: Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch
-----BEGIN PGP SIGNED MESSAGE-----
Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch
Advisory ID: cisco-sa-20120711-ctms
For Public Release 2012 July 11 16:00 UTC (GMT)
Cisco TelePresence Multipoint Switch contains the following vulnerabilities:
Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability
Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability
Exploitation of the Cisco TelePresence Malformed IP Packets Denial of
Service Vulnerability may allow an unauthenticated, remote attacker to
create a denial of service (DoS) condition, causing the product to
become unresponsive to new connection requests and potentially leading
to termination services and processes.
Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote
Code Execution Vulnerability may allow an unauthenticated, adjacent
attacker to execute arbitrary code with elevated privileges.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities. This advisory is available at the following link:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
-----END PGP SIGNATURE-----
cust-security-announce mailing list
To unsubscribe, send the command "unsubscribe" in the subject of your message to email@example.com