Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.1027
Cisco TelePresence Video Communication Server Cross-Site
Scripting Vulnerability
13 October 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco TelePresence Video Communication Server
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2011-3294
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Response: Cisco TelePresence Video Communication
Server Cross-Site Scripting Vulnerability
Revision 1.0
For Public Release 2011 October 12 1600 UTC (GMT)
+-----------------------------------------------------------------
Cisco Response
==============
A vulnerability exists in Cisco TelePresence Video Communication
Server (VCS) due to improper validation of user-controlled input to
the web-based administrative interface. User-controlled input
supplied to the login page via the HTTP User-Agent header is not
properly sanitized for illegal or malicious content prior to being
returned to the user in dynamically generated web content. A remote
attacker could exploit this vulnerability to perform reflected
cross-site scripting attacks.
Billy Hoffman from Zoompf, Inc., discovered this vulnerability and
Ben Feinstein from Dell SecureWorks reported it to Cisco. Cisco
greatly appreciates the opportunity to work with researchers on
security vulnerabilities and welcome the opportunity to review and
assist in product reports.
Additional Information
======================
Cisco TelePresence Video Communication Server Software versions
earlier than X7.0 are affected. This vulnerability has been corrected
in Cisco TelePresence Video Communication Server Software version
X7.0.
This vulnerability is documented in Cisco bug ID CSCts80342
and has been assigned CVE ID CVE-2011-3294.
Additional mitigations that can be deployed on Cisco devices in the
network are available in the Cisco Applied Mitigation Bulletin:
Understanding Cross-Site Scripting (XSS) Threat Vectors:
http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Revision History
================
+----------------------------------------+
| Revision | 2011-September-12 | Initial |
| 1.0 | | draft |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFOlbMGQXnnBKKRMNARCFD1AP9KbpH46PWln/yVSq3eGzRI206Ny2mAE9SQ
hFo+8cy6IgD+MrSFSPNNB+ePsqrAICxWML7Uhf4bRPV0WTpceKzSG2c=
=fgWv
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTpYwxO4yVqjM2NGpAQJK+g//SUGjq9UUhmHnA5ICEh9I6omnKcuQS2Pv
5kKIn03CVwyw3YNW+t56SvLo+k4sr+0R5tymmxqEUKRnsmX2IkRfpEVWsvAI6yJO
aSoCEpOt5GAlp83t7YOGJjtGL7+yW8hCZpys+PaBOS3QD7QoqyZ0IwS3fLGrklDQ
adsHn4pDev6IbED3VVDPA77Sbj85dpg6pkwfj5jLAl97Imaetq6TufGDdJDhwora
T63Hxbqd6iXjKjoZDKgRcV6YyynlKAjEe9+5ijp/MOzmwKlOidsuakd9j94mYRsR
XLZrVNQlAk2LoWAuuOK4gxg/U7fJ1cHrdmfgGgvjEnQGkaPDEJZu1ZS6CpL1I3WM
ggs5pD/xrcOuzPvx6zopMIjYx9v2Ty8yJho2p10uTYvxGCUVoKoOuh2Pz5sm+dN0
fAGXL5JKfoQKdoOed5VpFa6zx8jHbhE0NLXI2H5Pd2nxU05b4IwI49fq3b2Tt4e4
6bK1ZkbMSudmq2jjBX1kBnfNNQyJQSCVU/dZXxQnnw4HTVUaWH+wkc5fLznFh7dg
O23Y38hMqEL0i2VFUfW2Bl2Rb9QQEljlmj6rpxeq0A4YH/1rHkavtLPJzoE6I2QE
Au5WhPNfqosF3r+hyxax/N9Qhfjyy/S6uzbzjGrjjbR+L+njowEh7ike3o4379/+
qlAKRkVKj8M=
=Tspe
-----END PGP SIGNATURE-----