Tandberg Video Communications Server Cross-Site Scripting (XSS) Vulnerability

Dell SecureWorks Security Advisory SWRX-2011-003

Advisory Information

• Advisory ID: SWRX-2011-003
• Date published: Wednesday, October 12, 2011
• CVE: CVE-2011-3294
• CVSS v2 Base Score: 4.3
• Date of last update: Wednesday, October 12, 2011
• Vendors contacted: Cisco Systems, Inc.
• Release mode: Coordinated
• Discovered by: Billy Hoffman, Zoompf, Inc.

Summary

A vulnerability exists in Tandberg Video Communications Server (VCS) due to improper validation of user-controlled input to the web-based administrative interface. User-controlled input supplied to the login page via the HTTP User-Agent header is not properly sanitized for illegal or malicious content prior to being returned to the user in dynamically generated web content. A remote attacker could exploit this vulnerability to perform reflected cross-site scripting (XSS) attacks.

Download the PDF
 
PGP Signature (PC Users: You may need to right click your mouse and select "Save As")
 
SecureWorks CTU Public Key