Dell SecureWorks Security Advisory SWRX-2011-003

Advisory Information

  • Advisory ID: SWRX-2011-003
  • Date published: Wednesday, October 12, 2011
  • CVE: CVE-2011-3294
  • CVSS v2 Base Score: 4.3
  • Date of last update: Wednesday, October 12, 2011
  • Vendors contacted: Cisco Systems, Inc.
  • Release mode: Coordinated
  • Discovered by: Billy Hoffman, Zoompf, Inc.

Summary

A vulnerability exists in Tandberg Video Communications Server (VCS) due to improper validation of user-controlled input to the web-based administrative interface. User-controlled input supplied to the login page via the HTTP User-Agent header is not properly sanitized for illegal or malicious content prior to being returned to the user in dynamically generated web content. A remote attacker could exploit this vulnerability to perform reflected cross-site scripting (XSS) attacks.

Download the PDF

PGP Signature (PC Users: You may need to right click your mouse and select "Save As")

SecureWorks CTU Public Key