Tag Archives: cisco

WebEx Meeting Manager Vulnerable ActiveX

Posted on by
Reply

An activex control installed by Cisco WebEx Meeting Manager is vulnerable to remote code execution or denial of service. The activex control, atucfobj.dll, is installed when a user connects to a WebEx meeting service. When users connect to an upgraded meeting service, the client side activex is automatically upgraded. Exploit code for this vulnerability has been publicly released.

As an aside, the interesting part of this vulnerability, according to a post from NANOG, is that even if you have cleaned the install of the client off your machine and have the latest version, if you connect to a meeting service that is NOT up to date, you could then become vulnerable again.

The full vulnerability details can be found at http://www.cisco.com/warp/public/707/cisco-sa-20080814-webex.shtml

Cisco IPS Denial of Service

Posted on by
Reply

Cisco has released an advisory for IPS platforms, they are susceptible to denial of service attacks. The vulnerability is in the handling of jumbo ethernet frames. A specially crafted packet can cause the device to kernel panic, a power cycle is required to reset the device. However, if the device is deployed in promiscous mode, or does not have a gigabit interface, it is not vulnerable. For vulnerable devices, Cisco has released updates and a workaround. Install the updates, or disable support for jumbo Ethernet to mitigate this issue.

Fear Renewed: The Cisco Router Rootkit

Posted on by
Reply

The media is all abuzz about a possible Cisco router rootkit that may be part of a presentation at a near future security conference.

While various issues with Cisco gear have emerged over the years and there has been at least one really public overreaction on the part of Cisco to vulnerability disclosure talks, there is probably little to really get spun up about here for the average corporate manager or infosec person.

The big news is that hostile, difficult to detect code could be introduced to routers at any point in their lifespan if an attacker has access to introduce images onto the router. This is a common problem with almost every type of device. There have been a number of trojan horse loads for everything from home firewalls to other forms of network gear for a number of years. Sure, the Cisco router is almost ubiquitous, and sure, it powers a lot of the Internet at large, but I think we pretty much always assumed that attackers with physical access and opportunity could introduce bad things to a device if they gained opportunity.

So before you give in to the hype or fear mongering, consider how this is different than any other form of software/firmware or the like. Likely, you already have a process in place for blowing new firmware onto all devices you purchase before putting them into use (right???). If not, it might be time to think about writing one…

Cisco Network Admission Control Appliance Vulnerability

Posted on by
Reply

The Cisco Network Admission Control Appliance (NAC) contains a vulnerability that allows the shared secret used by the Cisco Clean Access Server (CAS) and the Cisco Clean Access Manager (CAM) to be captured. This can then be leveraged to gain control over the CAS.

The following versions of NAC are known to be vulnerable:
 All 3.5.x versions
 All 3.6.x versions prior to 3.6.4.4
 All 4.0.x versions prior to 4.0.6
 All 4.1.x versions prior to 4.1.2

For full details see Cisco’s original advisory at: http://www.cisco.com/warp/public/707/cisco-sa-20080416-nac.shtml

Cisco Unified Communications Disaster Recovery Framework Vulnerability

Posted on by
Reply

The Disaster Recovery Framework is able to receive and execute commands without authentication. This can allow an attacker to cause denial of service conditions, obtain sensitive configuration information, overwrite configuration parameters, or execute DRF-related commands, including arbitrary system commands with full administrative privileges.

For further details and mitigation suggestions please see the original advisory at:http://www.cisco.com/warp/public/707/cisco-sa-20080403-drf.shtml

Slew of Cisco Alerts

Posted on by
Reply

The Cisco Systems Product Security Incident Response Team release a group of security advisories today. The majority of the vulnerabilities can result in Denial of Service for multiple products. Here’s the round up:

Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability

Devices running certain versions of Cisco IOS prior to 12.3 with VPDN enabled may be affected by the vulnerabilities. The vulnerabilities are a result of a memory leak and an inability to reuse virtual interfaces. See the original advisory for full details:
http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml

Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Certain Processors

Some Cisco Catalyst 6500 Series and Cisco 7600 Routers running particular branches of Cisco IOS based on 12.2 may be vulnerable to a denial of service vulnerability. To be vulnerable they must be configured to use OSPF and MPLS enabled VPNs. Products known to be vulnerable are based on the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720). See the original advisory for full details: http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml

Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers

Devices running Cisco IOS software with Internet Protocol version 6 (IPv6) enabled may be subject to a denial of service attack. To be vulnerable the device must also  have certain Internet Protocol version 4 (IPv4) User Datagram Protocol (UDP) services enabled. See the original advisory for full details: http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml

Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS

All devices running Cisco IOS with the Data-link Switching (DLSw) feature enabled may be susceptible to a vulnerability that can result in a reload or memory leak when processing specially crafted UDP or IP Protocol 91 packets.  See the original advisory for full details: http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml

Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak

All devices running Cisco IOS and configured for MVPN are susceptible to a vulnerability that can allow an attacker to receive multicast traffic from other MVPN networks. See the original advisory for full details:  http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml

CiscoWorks Remote Command Shell?

Posted on by
1

A vulnerability has been reported in CiscoWorks Internetwork Performance Monitor.   The vulnerability appears to be the result of a command shell bound to a random port. The could be exploited  to execute commands on the system. Cisco has released patch IPM version 2.6 CSCsj06260.

A cross site scripting vulnerability has been reported in Nagios. From the description, it appears to be a reflective XSS, but further information is unavailable at this time. We also do not have the input fields that are vulnerable.  Versions prior to 2.11 are vulnerable. Please apply version 2.11 if you are running Nagios.

Cisco Vulns, OS X DoS, SWFIntruder

Posted on by
Reply

A cross site scripting vulnerability has been found in CiscoWorks. The XSS is present in the initial login page. Attackers could use this to steal cookies or execute arbitrary html or script code on a remote user. CiscoWorks versions 2.6 and prior are vulnerable, and Cisco has released a patch for this issue.

The Cisco 7940 SIP Phone is vulnerable to an interesting denial of service. Sending malformed SIP INVITE messages to a 7940 phone can cause the device to reboot, or be put under the DoS condition. If INVITE packets are then sent at certain intervals, the DoS condition will persist. The phone will be in a seemingly working condition, where it continues to send REGISTER commands to the server, but will ring busy on incoming calls and return busy on any calls made by the user. There was no patch or update listed with the advisory.

Cisco Security Agent (CSA) for Windows and Cisco Security Manager are vulnerable to a remote buffer overflow attack. This can be exploited by sending a specially crafted TCP message to port 139 or 445 on a system running the CSA. This could result in a stop error (blue screen) or remote code execution. Cisco has released a free software update to address this vulnerability.

Two Denial of Service attacks for MacOS X have had their exploit code released. The first is in the vpnd which has been tested in Apple MACOS X 10.5.0. The second DoS in a local one in the kernel. This has been testing in Apple MACOS X 10.4 (xnu-792.22.5~1/RELEASE_I386), Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386) and Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_PPC).

WabiSabi Labs (the online exploit auction group), reportedly has a QuickTime vulnerability that could result in remote code execution that is different from the one we mention in “QuickTime 7.2/7.3 RTSP Exploits” (https://stateofsecurity.com/?p=162). We have no way to accurately verify this information though.

A new tool has been released yesterday. The tool, SWFIntruder, is “the first tool specifically developed for analyzing and testing security of Flash applications at runtime.” [1] This looks to be a powerful tool to test flash implementations for the presence of XSS of XSF issues in a semi automated manner. If you are responsible for testing web applications, this may be a tool you’ll want to have a look at.

1. https://www.owasp.org/index.php/Category:SWFIntruder

Cisco’s PCI Ultimatum Movie was a Big Hit!

Posted on by
Reply

The movie premiered in Columbus yesterday and seemed to be a great way to learn about PCI requirements.

It was hilarious to see people you know on the big screen.

Check it out when it comes to a city near you. You can check out the trailers and such at http://www.businessofsecurity.com.

We have put up a separate blog site to follow the movie as it tours and to give follow up info. You can check it out at http://pcimovie.blogspot.com!

Respond in comments and let us know what you thought of it!

Added Note: It is our CEO who gets killed in the opening scene, persistent isn’t he…  😉

Also, the movie premier followed our State of the Threat presentation yesterday morning, adding even more info to what has quickly become one of the leading edge security presentations around!