SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Cisco WebEx Meetings Server Vendors:   Cisco, WebEx
Cisco WebEx Meetings Server Input Validation Flaw Lets Remote Authenticated Users Execute Arbitrary Commands
SecurityTracker Alert ID:  1031692
SecurityTracker URL:  http://securitytracker.com/id/1031692
CVE Reference:   CVE-2015-0589   (Links to External Site)
Date:  Feb 4 2015
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.0, 1.1, 1.5
Description:   A vulnerability was reported in Cisco WebEx Meetings Server. A remote authenticated user can execute arbitrary commands on the target system.

A remote authenticated user can send specially crafted data to the administrative web interface to execute arbitrary commands on the target system. The commands will run with root privileges.

The vendor has assigned bug ID CSCuj40460 to this vulnerability.

Versions 2.0 and 2.5 are not affected.

Impact:   A remote authenticated user can execute arbitrary commands on the target system with root privileges.
Solution:   The vendor has issued a fix.

The vendor's advisory is available at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx

Vendor URL:  tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  Cisco Security Advisory: Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability

Advisory ID: cisco-sa-20150204-wbx

Revision 1.0
For Public Release 2015 February 4 16:00  UTC (GMT)

- ---------------------------------------------------------------------------------------

Summary
=======

A vulnerability in the administrative web interface of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the affected system.

The vulnerability is due to improper user input validation. An attacker could exploit this vulnerability by crafting input into the affected fields of the web interface.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVNIdpopI1I6i1Mx3AQK3jg//VoUsfkTzWyRDXjeEMWLJczcH/GCN+c7c
C4yqhNM0qZfe9klBfpaTBgXUQ1m4zgEtqnJrceESCIiLkNj5G3u6DKq0gwlXpc+t
59qV6D+kCxyS8gGv9sdjDrZmk7ZzlKxpPoVeSgw7qFqPg95YnoQsGv06s5ddJy5b
fAqqGrnnkEZA6feFmg/bC79qKpE3vPck8vB+Zkgcr5VkhnwhWBwBFGj6TQzvs5ao
GQkh4aGZYwA1y1Ub9ZCiPULhiJqAs/3/+JoEzuJ+Vap4D7jRGqQXIcO1dxwiWMp8
IaLThYMERWkIUHB9EEijkuERsPEL2VNRlVlqorRpWOAqIDmR9xVjRWaUzxxLMN0K
Aqe966KM9cjEL1l+XOCbxSxVGuduAOXqrU6izrjHfCO2mk3i3wopg4F0ubBndl2x
ljZ/wgfQsBD6Ec4HE9LSpZUZRI7W5jghbiI2xkc8/yW2RfKQMvRuGpLZhDq1kU4X
hKMzNz2jS7kzC+u1VZQQiSPJH+15iRuCmoAlFQl4+gc2o0dGRq02AFI2ifSAjVvn
UlbO42dkcN1MIHpCnb3l/CLQz54rTCvbwizgEbgX0+adyZekdhKepn4yLwgGOiJC
hC5cvxruTphTfmdA1DYBWGAQOkc5U5LQ389T1imSEoI5Wbj+cO1O5Nc5fluY3Wj0
hSX1YVQ1B4Q=
=+3An
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC