====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN150
_____________________________________________________________________

DATE                : 18/05/2017

HARDWARE PLATFORM(S): Cisco TelePresence IX5000 Series devices.

OPERATING SYSTEM(S):  Systems running Cisco TelePresence IX5000 Series
                              software version 8.2.0.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000
____________________________________________________________________

Cisco Security Advisory: Cisco TelePresence IX5000 Series Directory
Traversal Vulnerability

Advisory ID: cisco-sa-20170517-telepresence-ix5000

Revision: 1.0

For Public Release: 2017 May 17 16:00 GMT

Last Updated: 2017 May 17 16:00 GMT

CVE ID(s): CVE-2017-6652

CVSS Score v(3): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the web framework of the Cisco TelePresence IX5000
Series could allow an unauthenticated, remote attacker to access
arbitrary files on an affected device.

The vulnerability is due to insufficient input validation. An attacker
could exploit this vulnerability by using directory traversal
techniques to read files within the Cisco TelePresence IX5000 Series
filesystem.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================