Secunia

Some vulnerabilities have been reported in Cisco Unified MeetingPlace, which can be exploited by malicious users to gain escalated privileges and by malicious people to conduct SQL injection attacks, create user and administrator accounts, or gain knowledge of sensitive information.

1) Unspecified input is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in versions prior to 6.0.639.2 and 7.0(2.3) hotfix 5F.

2) An unspecified error when processing requests sent to the internal interface of the web server can be exploited to bypass restrictions and create MeetingPlace or administrator accounts.

The vulnerability is reported in versions prior to 6.0.639.3 and 7.0(2.3) hotfix 5F.

3) An error in the MeetingTime authentication mechanism can be exploited to gain knowledge of usernames and passwords.

The vulnerability is reported in versions prior to MeeetingPlace 6 MR5.

4) An unspecified error in the MeetingTime authentication mechanism can be exploited by normal users to escalated their privileges to those of administrator accounts.

The vulnerability is reported in versions prior to MeeetingPlace 6 MR5.

Solution
Update to the latest version.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits National Australia Bank's Security Assurance team and Credit Suisse.

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20100127-mp.shtml

Deep Links
Links available in Customer Area