From PC World: Cisco Systems has released security updates to fix serious vulnerabilities in a range of products including its Intrusion Prevention System, Unified Computing System Director, Unified SIP Phone 3905 and Firewall Services Module products.
The vulnerability addressed in Cisco Unified Computing System (UCS) Director stems from a default account with root privileges that gets created during installation.
“An attacker could exploit this vulnerability by accessing the server command-line interface (CLI) remotely using the default account credentials,” which would provide the attacker with full administrative rights to the system, Cisco said in an advisory. The vulnerability was addressed in Cisco UCS Director Release Hotfix 4.0.0.3.
Another unauthorized remote access vulnerability was fixed in Cisco Unified SIP Phone 3905 and was caused by an undocumented test interface listening on port 7870 TCP. Attackers could use this interface to gain root-level access to the affected device. The flaw was patched in Cisco Unified SIP Phone 3905 Firmware Release 9.4(1).
Three denial-of-service vulnerabilities were patched in different components of Cisco’s IPS software, namely the IPS Analysis Engine, the IPS Control-Plane MainApp and the IPS Jumbo Frame.
These vulnerabilities can be exploited by sending fragmented, malformed or high-rate packets to the affected components, depending on which one is targeted. The IPS Control-Plane MainApp process in particular handles several critical tasks like alert notification, event store management and sensor authentication that would no longer execute as a result of the denial-of-service condition.
“The Cisco IPS web server will also be unavailable while the MainApp process is unresponsive, and other processes such as the Analysis Engine process may not work properly,” Cisco said in an advisory.
The IPS Control-Plane MainApp vulnerability affects Cisco ASA 5505 Advanced Inspection and Prevention Security Services Card (AIP SSC), Cisco ASA 5500 Series Advanced Inspection and Prevention Security Services Module (AIP SSM) and Cisco ASA 5500-X Series IPS Security Services Processor (IPS SSP) software and hardware modules.
The IPS Jumbo Frame vulnerability only affects Cisco IPS 4500 Series Sensors and the IPS Analysis Engine flaw affects Cisco ASA 5500-X Series IPS Security Services Processor (IPS SSP) software and hardware modules, Cisco ASA 5500 Series Advanced Inspection and Prevention Security Services Module (AIP SSM) and Cisco IPS 4200, 4300 and 4500 Series Sensors, but only if IPS software is configured with the produce-verbose-alert option.
Cisco released several updates for different branches of the affected IPS software. Users of 6.x and 7.0 versions are advised to upgrade to version 7.1 or later. The patched 7.1 version is 7.1(8p2)E4 and the patched 7.2 version is 7.2(2)E4. Version 7.3 is not affected. Workaround and mitigation instructions for two of the vulnerabilities are included in the Cisco advisory.
The company also patched a vulnerability in its Firewall Services Module (FWSM) that could be exploited to restart an affected system. The vulnerability affects FWSM software for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers. Users of 3.1 and 4.0 versions of the software should migrate to 3.2.x and 4.1, respectively. The patched version for the 3.2 branch is 3.2(28) and for the 4.1 branch is 4.1(15).
View: Article @ Source Site
