CVE-2011-2584

Vulnerability

Cisco Show and Share versions 5(2), 5.2(1), and 5.2(2) prior to 5.2(2.1) contain a vulnerability that allows remote attackers to access the Encoders and Pull Configurations, Push Configurations, Video Encoding Formats, and Transcoding administration pages. The exact vectors are unspecified, but the issue is identified by Bug ID CSCto73758 [1].

Exploitation

An attacker with network access to the Cisco Show and Share server can exploit this vulnerability without authentication. By sending crafted requests to the affected administration pages, the attacker can gain unauthorized access to configuration interfaces [1].

Impact

Successful exploitation enables the attacker to cause a denial of service by disrupting live events, or to obtain potentially sensitive information from the accessed administration pages. The attacker gains unauthenticated access to administrative functionality, compromising the confidentiality and availability of the system [1].

Mitigation

Cisco has addressed this vulnerability in version 5.2(2.1). Customers are advised to upgrade to 5.2(2.1) or later. Note that version 5.2(3) may have compatibility issues with certain MCS Server Appliances, so the recommended fixed release is 5.2(2.1). No workarounds are documented [1].