----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
TANDBERG Video Communication Server Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39275

VERIFY ADVISORY:
http://secunia.com/advisories/39275/

DESCRIPTION:
Some vulnerabilities have been reported in TANDBERG Video
Communication Server, which can be exploited by malicious users to
disclose sensitive information, and by malicious people to conduct
hijacking attacks and potentially compromise a vulnerable appliance.

1) The same pair of known SSH host keys is used for all
installations. This can be exploited to potentially hijack an already
established SSH session via Man-in-the-Middle (MitM) attacks.

2) Input passed to the "page" parameter in helppage.php and
/user/helppage.php is not properly sanitised before being used to
read files. This can be exploited to read arbitrary files from local
resources via directory traversal attacks.

3) The cookie used for identifying a user to the web interface is
insecurely generated from predictable values. This can be exploited
to gain administrative access to the web interface and potentially
execute arbitrary code by applying a custom software update.

SOLUTION:
Update the firmware to version x5.1.1. Vulnerability #3 was
reportedly first fixed in version x4.3.0.

PROVIDED AND/OR DISCOVERED BY:
1, 2) Jon Hart, Virtual Security Research
3) Jon Hart and Timothy D. Morgan, Virtual Security Research

ORIGINAL ADVISORY:
Virtual Security Research:
http://www.vsecurity.com/resources/advisory/20100409-1/
http://www.vsecurity.com/resources/advisory/20100409-2/
http://www.vsecurity.com/resources/advisory/20100409-3/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------