RealTime IT News

'Critical' Flaw in Cisco Collab Server

A "highly critical" vulnerability in Cisco's flagship Collaboration Server could put users at risk of malicious code execution, the company said in an advisory.

Cisco, which dominates the market for switching and routing equipment used to link networks, said the vulnerability was found in versions of its Cisco Collaboration Server (CCS) that ship with the ServletExec subcomponent.

"Unauthorized users can upload any file and gain administrative privileges," Cisco warned in the advisory posted online.

The vulnerability affects CCS (prior to 5.0) using a ServletExec version prior to 3.0E. Independent research firm Secunia has tagged the flaw with a "highly critical" rating because it can be exploited to gain system access from remote locations.

Users of Cisco Collaboration Server 4.x can apply a fix using an automated script (available here). Detailed workarounds and patching instructions have been posted online.

The Cisco Collaboration Server is used mostly in e-commerce settings to provide electronic CRM services. It enables "click-for-help" buttons on Web sites to let businesses interact with customers by voice (PSTN or VoIP) or via text chat.

The CCS can also be used to handle online collaboration features like two-way Web-page sharing, Follow-Me browsing, form sharing and real-time application sharing.