bugtraq - Cisco Security Advisory: Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed,  4 Feb 2015 11:01:59 -0500
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory Cisco WebEx Meetings Server Command Injection Vulnerability

Advisory ID: cisco-sa-20150204-wbx

Revision 1.0
For Public Release 2015 February 4 16:00  UTC (GMT)

- ---------------------------------------------------------------------------------------

Summary
=======

A vulnerability in the administrative web interface of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the affected system.

The vulnerability is due to improper user input validation. An attacker could exploit this vulnerability by crafting input into the affected fields of the web interface.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVNIdpopI1I6i1Mx3AQK3jg//VoUsfkTzWyRDXjeEMWLJczcH/GCN+c7c
C4yqhNM0qZfe9klBfpaTBgXUQ1m4zgEtqnJrceESCIiLkNj5G3u6DKq0gwlXpc+t
59qV6D+kCxyS8gGv9sdjDrZmk7ZzlKxpPoVeSgw7qFqPg95YnoQsGv06s5ddJy5b
fAqqGrnnkEZA6feFmg/bC79qKpE3vPck8vB+Zkgcr5VkhnwhWBwBFGj6TQzvs5ao
GQkh4aGZYwA1y1Ub9ZCiPULhiJqAs/3/+JoEzuJ+Vap4D7jRGqQXIcO1dxwiWMp8
IaLThYMERWkIUHB9EEijkuERsPEL2VNRlVlqorRpWOAqIDmR9xVjRWaUzxxLMN0K
Aqe966KM9cjEL1l+XOCbxSxVGuduAOXqrU6izrjHfCO2mk3i3wopg4F0ubBndl2x
ljZ/wgfQsBD6Ec4HE9LSpZUZRI7W5jghbiI2xkc8/yW2RfKQMvRuGpLZhDq1kU4X
hKMzNz2jS7kzC+u1VZQQiSPJH+15iRuCmoAlFQl4+gc2o0dGRq02AFI2ifSAjVvn
UlbO42dkcN1MIHpCnb3l/CLQz54rTCvbwizgEbgX0+adyZekdhKepn4yLwgGOiJC
hC5cvxruTphTfmdA1DYBWGAQOkc5U5LQ389T1imSEoI5Wbj+cO1O5Nc5fluY3Wj0
hSX1YVQ1B4Q=
=+3An
-----END PGP SIGNATURE-----