http://www.theregister.co.uk/2012/07/16/cisco_telepresenceflaws/ By Iain Thomson in San Francisco The Register 16th July 2012 Cisco slipped out four security advisories on Friday warning of serious vulnerabilities in its high-end videoconferencing system – or TelePresence, as it prefers to call it. The flaws affect versions of Cisco TelePresence Manager, Recording Server, Immersive Endpoint System, and Multipoint Switch, and would variously allow an attacker to crash calls using malformed IP packets in a DDoS attack, perform a code injection attack via the web interface, and/or remote code execution and privilege escalation via the Cisco Discovery Protocol. Cisco Product Security Incident Response Team said that there was no evidence that any of these vulnerabilities were being used in the wild as yet. They were uncovered after laboratory testing of the software and during normal software security audits. Videoconferencing is one of those "always the bridesmaid, never the bride" technologies, and your Reg reporter remembers getting press releases in 1994 talking about how ISDN would make that long-ago time the year that videoconferencing would take off. We're still waiting, but Cisco has had more success than most with its TelePresence systems, albeit only on the corporate stage. [...] -- Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online. Come to a free class and see how good and fun the program really is. http://www.expandingsecurity.com/PainPillReceived on Tue Jul 17 2012 - 03:23:25 PDT
This archive was generated by hypermail 2.2.0 : Tue Jul 17 2012 - 03:46:54 PDT