Cisco warns of major vulnerabilities in TelePresence kit

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2012/07/16/cisco_telepresenceflaws/

By Iain Thomson in San Francisco
The Register
16th July 2012

Cisco slipped out four security advisories on Friday warning of serious 
vulnerabilities in its high-end videoconferencing system – or 
TelePresence, as it prefers to call it.

The flaws affect versions of Cisco TelePresence Manager, Recording 
Server, Immersive Endpoint System, and Multipoint Switch, and would 
variously allow an attacker to crash calls using malformed IP packets in 
a DDoS attack, perform a code injection attack via the web interface, 
and/or remote code execution and privilege escalation via the Cisco 
Discovery Protocol.

Cisco Product Security Incident Response Team said that there was no 
evidence that any of these vulnerabilities were being used in the wild 
as yet. They were uncovered after laboratory testing of the software and 
during normal software security audits.

Videoconferencing is one of those "always the bridesmaid, never the 
bride" technologies, and your Reg reporter remembers getting press 
releases in 1994 talking about how ISDN would make that long-ago time 
the year that videoconferencing would take off. We're still waiting, but 
Cisco has had more success than most with its TelePresence systems, 
albeit only on the corporate stage.

[...]


--
Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online.
Come to a free class and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill