Cisco TelePresence Manager and Multipoint Switch Bugs Lets Remote Users Deny Service and Remote Users on the Adjacent Network Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1027241 |
|
SecurityTracker URL: http://securitytracker.com/id/1027241
|
|
CVE Reference:
CVE-2012-2486, CVE-2012-3073
(Links to External Site)
|
Updated: Jul 12 2012
|
Original Entry Date: Jul 11 2012
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 1.9.0
|
Description:
Two vulnerabilities were reported in Cisco TelePresence Manager and Cisco TelePresence Multipoint Switch. A remote user on the local network can execute arbitrary code on the target system. A remote user can cause denial of service conditions.
A remote user on the adjacent network can send specially crafted Cisco Discovery Protocol packets to execute arbitrary code on the target system with elevated privileges [CVE-2012-2486].
Cisco has assigned Cisco bug ID CSCtz40965 (for Cisco TelePresence Multipoint Switch) and CSCtz40947 (for Cisco TelePresence Manager) to this vulnerability.
A remote user can send a sequence of specially crafted IP packets and TCP connection requests or terminations at a high rate to prevent the target device from responding to new connection requests [CVE-2012-3073]. Some services and processes may crash.
Cisco has assigned Cisco bug IDs CSCty11219, CSCty11323, and CSCty11338 (for Cisco TelePresence Multipoint Switch) and CSCti21851, CSCtj19100, CSCtj19086, and CSCtj19078 (for Cisco TelePresence Manager) to this vulnerability.
|
Impact:
A remote user on the local network can execute arbitrary code on the target system.
A remote user can cause denial of service conditions.
|
Solution:
The vendor has issued a fix (1.9.0).
The vendor's advisories are available at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman
|
Vendor URL: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms (Links to External Site)
|
Cause:
Not specified
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 11 Jul 2012 12:09:51 -0400
Subject: Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch
Advisory ID: cisco-sa-20120711-ctms
Revision 1.0
For Public Release 2012 July 11 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco TelePresence Multipoint Switch contains the following vulnerabilities:
Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability
Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability
Exploitation of the Cisco TelePresence Malformed IP Packets Denial of
Service Vulnerability may allow an unauthenticated, remote attacker to
create a denial of service (DoS) condition, causing the product to
become unresponsive to new connection requests and potentially leading
to termination services and processes.
Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote
Code Execution Vulnerability may allow an unauthenticated, adjacent
attacker to execute arbitrary code with elevated privileges.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
iF4EAREIAAYFAk/9iyEACgkQUddfH3/BbTpDwwD/VC6pQ6nRkbNlMDpXiIbeaSJl
z9/qBj2QDDkkmZtuFy0A/13tmEoR9wDU9UGWG5XdrzY1mD70brmwbo/DobaWxmcE
=2nC1
-----END PGP SIGNATURE-----
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com
|
|
