Webinar Wire

Security Fix Announced For Cisco Web Conferencing

Posted by Ken Molay November 7 2007 6:09 PM EDT

Cisco released a security patch today for its Unified Meeting Place web conferencing software. The problem was reported on security site Secunia.com as an opportunity for a "malicious user" (love that phrase!) to embed nasty HTML into the first name and last name parameters that are passed as part of a long login URL. This is known as cross-site scripting (XSS).

Cisco has a nice information page set up as public information and response to the threat. They recommend applying a hotfix (patch) to the software, but the fix is not available on the page. I assume it can be referenced from the internal bug report accessible by registered users of the product.