CVE-2011-2585

Vulnerability

Cisco Show and Share versions 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) contain a vulnerability that allows remote authenticated users to upload and execute arbitrary code. The issue is identified as Bug ID CSCto69857 and is described in Cisco Security Advisory cisco-sa-20111019-sns [1]. The vulnerability exists in the video upload functionality, which does not properly validate uploaded files, enabling arbitrary code execution.

Exploitation

An attacker must have valid credentials for the Cisco Show and Share application and must possess video upload privileges. With these privileges, the attacker can upload a crafted file containing malicious code, which is then executed on the server. No user interaction beyond the attacker's own actions is required, and the attacker can perform this remotely over the network [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the underlying server. This can lead to complete compromise of the application and the host system, including unauthorized access to data, modification of content, and potential denial of service. The privilege level achieved is that of the application process, which typically runs with high privileges [1].

Mitigation

Cisco has released fixed version 5.2(2.1) to address this vulnerability. Users are advised to upgrade to this version or later. The advisory also notes that version 5.2(3) does not support certain MCS Server Appliances, so administrators should use 5.2(2.1) or later as recommended. No workarounds are provided in the reference [1].