Cisco Patches Series of Bugs

Thursday, October 24, 2013 @ 05:10 PM gHale


It seems cyber security awareness month is living up to its name as all the big IT players are releasing security updates; Cisco Systems is the latest.

Cisco released security updates Wednesday to address denial-of-service (DoS) and arbitrary command execution vulnerabilities.

RELATED STORIES
VMware Patches Security Holes
VMware Fixes DoS Vulnerability
Big Security Patch from Oracle
Cisco Security Advisories

The company released new versions of Cisco IOS XR Software to fix an issue with handling fragmented packets that can end up exploited to trigger a DoS condition on various Cisco CRS Route Processor cards. Click here for the affected cards and the patched software versions available for them.

The company also released security updates for Cisco Identity Services Engine (ISE), which is a security policy management platform for wired, wireless, and VPN connections.

The updates fix a vulnerability that could suffer a hit by authenticated remote attackers to execute arbitrary commands on the underlying operating system and a separate vulnerability that could allow hackers to bypass authentication and download the product’s configuration or other sensitive information, including administrative credentials.

Cisco also released updates that fix a known Apache Struts vulnerability in several of its products, including ISE. Apache Struts is an open-source framework for developing Java-based Web applications.

The vulnerability, identified as CVE-2013-2251, is in Struts’ DefaultActionMapper component and ended up patched by Apache in Struts version 2.3.15.1 which released in July.

The new Cisco updates integrate that patch into the Struts version used by Cisco Business Edition 3000, Cisco Identity Services Engine, Cisco Media Experience Engine (MXE) 3500 Series and Cisco Unified SIP Proxy.

“The impact of this vulnerability on Cisco products varies depending on the affected product,” Cisco said in an advisory. “Successful exploitation on Cisco ISE, Cisco Unified SIP Proxy, and Cisco Business Edition 3000 could result in an arbitrary command executed on the affected system.”

No authentication ends up required to execute the attack on Cisco ISE and Cisco Unified SIP Proxy, but the flaw’s successful exploitation on Cisco Business Edition 3000 requires the attacker to have valid credentials or trick a user with valid credentials into executing a malicious URL, the company said.

“Successful exploitation on the Cisco MXE 3500 Series could allow the attacker to redirect the user to a different and possibly malicious website, however arbitrary command execution is not possible on this product,” Cisco said.



Leave a Reply

You must be logged in to post a comment.