Security Fixes for Cisco

Friday, February 21, 2014 @ 03:02 PM gHale


Cisco Systems fixed vulnerabilities in a range of products including its Intrusion Prevention System, Unified Computing System Director, Unified SIP Phone 3905 and Firewall Services Module products.

The vulnerability addressed in Cisco Unified Computing System (UCS) Director stems from a default account with root privileges created during installation.

RELATED STORIES
Hole in Cisco Small Biz Routers
Working a Smartphone Against Itself
Bugs in Cisco TelePresence Systems
Remote Spying via Network Video Recorders

“An attacker could exploit this vulnerability by accessing the server command-line interface (CLI) remotely using the default account credentials,” which would provide the attacker with full administrative rights to the system, Cisco said in an advisory. The company fixed the vulnerability in Cisco UCS Director Release Hotfix 4.0.0.3.

The company fixed another unauthorized remote access vulnerability in Cisco Unified SIP Phone 3905 caused by an undocumented test interface listening on port 7870 TCP. Attackers could use this interface to gain root-level access to the affected device. They patched the flaw in Cisco Unified SIP Phone 3905 Firmware Release 9.4(1).

Three denial-of-service vulnerabilities ended up patched in different components of Cisco’s IPS software, namely the IPS Analysis Engine, the IPS Control-Plane MainApp and the IPS Jumbo Frame.

Attackers can exploit these vulnerabilities by sending fragmented, malformed or high-rate packets to the affected components, depending on which one ends up targeted. The IPS Control-Plane MainApp process in particular handles several critical tasks like alert notification, event store management and sensor authentication that would no longer execute as a result of the denial-of-service condition.

The IPS Control-Plane MainApp vulnerability affects Cisco ASA 5505 Advanced Inspection and Prevention Security Services Card (AIP SSC), Cisco ASA 5500 Series Advanced Inspection and Prevention Security Services Module (AIP SSM) and Cisco ASA 5500-X Series IPS Security Services Processor (IPS SSP) software and hardware modules.

The IPS Jumbo Frame vulnerability only affects Cisco IPS 4500 Series Sensors and the IPS Analysis Engine flaw affects Cisco ASA 5500-X Series IPS Security Services Processor (IPS SSP) software and hardware modules, Cisco ASA 5500 Series Advanced Inspection and Prevention Security Services Module (AIP SSM) and Cisco IPS 4200, 4300 and 4500 Series Sensors, but only if the user configures the IPS software with the produce-verbose-alert option.

Cisco released several updates for different branches of the affected IPS software. Users of 6.x and 7.0 versions should upgrade to version 7.1 or later. The patched 7.1 version is 7.1(8p2)E4 and the patched 7.2 version is 7.2(2)E4. Version 7.3 does not suffer from the issue. Workaround and mitigation instructions for two of the vulnerabilities are in the Cisco advisory.

The company also patched a vulnerability in its Firewall Services Module (FWSM) that could end up exploited to restart an affected system. The vulnerability affects FWSM software for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers. Users of 3.1 and 4.0 versions of the software should migrate to 3.2.x and 4.1, respectively. The patched version for the 3.2 branch is 3.2(28) and for the 4.1 branch is 4.1(15).



Leave a Reply

You must be logged in to post a comment.