Cisco Unified MeetingPlace Web Conferencing Input Validation Hole Permits Cross-

Advisory:  Cisco Security Advisory
Version(s): 5.3 and prior versions, 5.4, 6.0
Description:  A vulnerability was reported in Cisco Unified MeetingPlace Web Conferencing. A remote user can conduct cross-site scripting attacks. 网管朋友网www_bitscn_net

The login screen does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Cisco Unified MeetingPlace software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

网管朋友网www_bitscn_net

The FirstName or LastName parameters are affected.

Cisco has assigned Cisco bug ID CSCsk17122 to this vulnerability. 网管网www.bitscn.com

Joren McReynolds reported this vulnerability.
Impact:  A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Cisco Unified MeetingPlace software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:  The vendor has issued fixed versions (5.4.156.2E, 6.0.244.1A). No fix is available for version 5.3 or prior versions.

中国网管联盟bitsCN.com

The Cisco advisory is available at: 中国网管联盟bitsCN.com

http://www.cisco.com/warp/public/707/cisco-sr-20071107-mp.shtml
Vendor URL:  www.cisco.com/warp/public/707/cisco-sr-20071107-mp.shtml (Links to External Site)
Cause:  Input validation error

网管u家www.bitscn.net

Message History:   None.

网管有家bitscn.net

  网管网www.bitscn.com