—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco TelePresence IX5000 Series Directory Traversal Vulnerability

Advisory ID: cisco-sa-20170517-telepresence-ix5000

Revision: 1.0

For Public Release: 2017 May 17 16:00 GMT

Last Updated: 2017 May 17 16:00 GMT

CVE ID(s): CVE-2017-6652

CVSS Score v(3): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

+———————————————————————

Summary
=======
A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device.

The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory traversal techniques to read files within the Cisco TelePresence IX5000 Series filesystem.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000 [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000”]

—–BEGIN PGP SIGNATURE—–

iQKBBAEBAgBrBQJZHHQqZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHln1Q//SljLBO/PA85x1yt2
R+s88p9fwSzcLV01Z9GOrTo12a3RafY+2sxr+unnHFJe865I7DIOfqcu3O0RnyHJ
EaLZx43d6fWchewLyv8YEVqk588Gw+gtOcwlsqMHWzyQneCL553Oh91pe/LLG3yx
So+iyZJJWKEY0k9eAz4yC7R3+y4vjV/+Y/0rTF0LrvTc6/N6P3S8ZiB9msJZoR3o
n5T98CWu/2ok1WW1mUUpxl5ylI2fM/p0iYb81ZDX3ra7Hq0Ktmv1fXuPs+i16jT3
0kR+BQBBqT54LOUuyWeoiLFlzR1ZAnhvVMlBWD+zmGOVL0rrrI7khK8utHUiyyDh
6UQzoEwD5+pTXKGgN23I8BZSwE77jpYxZSVR8dBn0CbBEhr0f0wl1ra4N2dnzYyc
1p6C8Fz++6mFX08zioB1l/fx1WP6wX3fB3q/57Gdq9zl8Dp4j3VHojTP+skA2fkq
IdJzfoWMuJWFlfIRebtGy7hr8hbOTgVlPChlTO/hiRpP8ZNOVw/N6mizOEIXFvnN
AIpgj93sDZ+nowcZxw+ursln9MRgF973jR1imEeJKFNKrsaxrlXH6ROxdIpMy4tb
xeypC7tJRGRn/bIrQUWbxLQtMkhHUvwsi8XX3yxL5a6tl4TzzAUyYiKI8vepfreI
YGbQENyHwMtrn+/k1p227RkPqwk=
=Cl6Y
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com