Cisco Security Advisory-
Cisco TelePresence Recording Server Software Release 1.7.2.0 includes a root administrator account that is enabled by default. Successful exploitation of the vulnerability could allow a remote attacker to use these default credentials to modify the system configuration and settings.
A workaround exists to mitigate this vulnerability.
Cisco has released software updates that address this vulnerability.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110729-tp.
-
Vulnerable Products
Cisco TelePresence Recording Server Software Release 1.7.2 is affected by this vulnerability.
Note: Cisco TelePresence Recording Server Software Releases 1.7.0 and 1.7.1 are not affected by this vulnerability.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this vulnerability.
-
The Cisco TelePresence solution allows an immersive, in-person communication and collaboration over the network with colleagues, prospects, and partners, even when they are located in opposite hemispheres.
Cisco TelePresence Recording Server Software Release 1.7.2.0 includes a root administrator account that is enabled by default. Successful exploitation of this vulnerability could allow a remote attacker to use these default credentials to modify the system configuration and settings. An attacker could use this account to modify the system configuration and settings by means of an SSH session.
This vulnerability is documented in Cisco Bug ID CSCtr76182 ( registered customers only) , and has been assigned the CVE identifier CVE-2011-2555.
-
A workaround exists to mitigate and fix this vulnerability. The workaround requires manual intervention on the affected system. Please contact the Cisco Technical Assistance Center (TAC) for instructions on how to implement this workaround. Customers are advised to migrate to Cisco TelePresence Recording Server software version 1.7.2.1.
Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20110729-tp.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
This vulnerability has been corrected in Cisco TelePresence Recording Server Software Release 1.7.2.1.
Note: Cisco TelePresence Recording Server Software Release 1.7.2.1 is a rebuild and no other changes were made on this release. Cisco TelePresence Recording Server Software Releases 1.7.0 and 1.7.1 are not affected by this vulnerability.
-
Potential exploitation was reported directly to Cisco by a single customer. The PSIRT is not aware of any widespread exploitation or public announcements of this vulnerability.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessRevision 1.0
2011-July-29
Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.