This host is installed with IBM Sametime Classic Meeting Server and is prone to multiple vulnerabilities.

Successful exploitation will allow local attacker to gain access to the meeting password hash from the HTML source and allow remote attackers to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Impact Level: Application

Upgrade or apply patches as given in below link, http://www-01.ibm.com/support/docview.wss?uid=swg21679454

Multiple flaws are due to, - improper validation of user supplied input. - presence of password hash in HTML source.

IBM Sametime Classic Meeting Server 8.x through 8.5.2.1

Send a crafted HTTP GET request and check whether it is able to read string or not.

• http://packetstormsecurity.com/files/127830
• http://packetstormsecurity.com/files/127831
• http://www-01.ibm.com/support/docview.wss?uid=swg21679221
• http://www-01.ibm.com/support/docview.wss?uid=swg21679454
• http://www.osvdb.com/109443
• http://www.osvdb.com/109444

---

Updated on 2015-03-25