CVE-2017-6551 Pexip Infinity Multiple Vulnerabilities

Pexip Infinity is a video communications software that can be deployed on infrastructure of organizations in public, private or hybrid cloud environments.

Pexip Infinity is vulnerable to input validation failure vulnerabilities in multiple components which would allow remote attackers to cause a denial of service or execute arbitrary code as an unprivileged user on Pexip Infinity Nodes.

Affected Versions:
Pexip Infinity Prior to Versions 14.2

QID detection Logic (Unauthenticated):
The QID works by sending a HTTP GET static/help/content/admin/whats_new.htm request to the target and flags if it finds a vulnerable version in the response.

QID detection Logic (Authenticated):
The QID checks for vulnerable Pexip version in 'version.json' file in Pexip directory.

Successful exploitation of the vulnerability allows remote attackers to cause a denial of service or execute arbitrary code as an unprivileged user.

Customers are advised to install the latest version of Pexip Infinity from the Pexip Downloads page.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Pexip Security Bulletin 2017-04-10

Pexip Infinity