Cisco Releases Security Advisory for IronPort Encryption Appliance and IronPort PXE Encryption product
- http://www.us-cert.gov/current/#cisco_rele…y_advisory_for5
January 15, 2009 - "Cisco has released a Security Advisory* to address multiple vulnerabilities in the IronPort Encryption Appliance and the IronPort PXE Encryption product. These vulnerabilities may allow an unauthorized attacker to view the contents of secure email messages or gain access to the IronPort Encryption Appliance administration interface…"
* http://www.cisco.com/warp/public/707/cisco…t.shtml#details
Cisco wireless LANs multiple vulns - updates available
- http://www.cisco.com/warp/public/707/cisco…90204-wlc.shtml
2009 February 04 - "Multiple vulnerabilities exist in the Cisco Wireless LAN Controllers (WLCs), Cisco Catalyst 6500 Wireless Services Modules (WiSMs), and Cisco Catalyst 3750 Integrated Wireless LAN Controllers. This security advisory outlines details of the following vulnerabilities:
* Denial of Service Vulnerabilities (total of three)
* Privilege Escalation Vulnerability
These vulnerabilities are independent of each other. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities…"
- Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
- http://atlas.arbor.net/briefs/index#-1301369183
March 05, 2009 - …Analysis: This is a minor issue that could escalate, if sustained traffic were seen, to a major outage for a region. Sites using the SBC module in a 7600 should review this update and apply it as needed…
- http://isc.sans.org/diary.html?storyid=5980
Last Updated: 2009-03-09 22:07:42 UTC …(Version: 4) - "If you have a Cisco IP phone, your DST rollfoward may not have worked, so you might want to rely on a different clock until the issues gets fixed… Update 2: Soon after I published this, Cisco published a patch to fix the issue…"
ciscocm.dst_march_2009.html
- http://www.cisco.com/web/software/28220470…march_2009.html
****IMPORTANT*****
This patch is a temporary workaround for the March 2009 DST issue.
You must upgrade before November 1, 2009 to a Unified Communications Manager version containing the fix for CSCsy25150 (CUCM is not sending Daylight Saving Time updates):
* http://tools.cisco.com/Support/BugToolKit/…ugId=CSCsy25150
Installation Instructions for Unified Communications Manager Daylight Savings Time (DST) patch file:
File Name: ciscocm.dst_march_2009.cop.sgn
MD5 Sum: d4:f5:e2:56:29:82:f9:fd:af:44:46:be:2a:e0:8d:f1
1. Ensure that Database Replication is working correctly before installing this file, you can check this from RTMT or Cisco Unified Reporting.
2. Install this file only on the Publisher from the "Install/Upgrade" option under "Cisco Unified Communications Operating System Administration."
3. Wait for 60 seconds.
4. Ensure that Database Replication is working correctly after the installation is complete.
5. Restart Cisco CallManager service on all the nodes in the cluster that are running this service.
***NOTE: If you apply a device pack or other update after applying this patch and before March 15, this patch will need to be re-installed.
When a permanent fix is available for November time change a Field Notice will appear here: http://www.cisco.com/en/US/products/sw/voi…tices_list.html
Cisco Security Advisories
>> http://www.cisco.com/en/US/products/produc…es_listing.html
"Starting on March 26, 2008, Cisco will release bundles of IOS Security Advisories on the fourth Wednesday of the month in March and September of each calendar year.
This schedule change will not restrict us from promptly publishing an individual IOS Security Advisory for a serious vulnerability which is publicly disclosed or for which we are aware of active exploitation…"
- http://www.cisco.com/warp/public/707/cisco…25-bundle.shtml
March 25, 2009 - "… includes eight Security Advisories. All of the advisories address vulnerabilities in Cisco IOS Software. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory, and each security advisory also lists recommended releases that correct the vulnerabilities in the other seven advisories. The table in this document lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier…"
CiscoWorks TFTP vuln - update available
- http://www.cisco.com/warp/public/707/cisco…090520-cw.shtml
2009 May 20 - "… CiscoWorks Common Services contains a TFTP directory traversal vulnerability that could allow an unauthenticated remote attacker to access application and host operating system files.
Note: Only CiscoWorks Common Services systems that run on Microsoft Windows operating systems are vulnerable. The Solaris version of CiscoWorks Common Services is not affected by this vulnerability…
This vulnerability has been corrected in the following CiscoWorks Common Services software patch: cwcs3.x-win-CSCsx07107-0.zip
The CiscoWorks Common Services patch can be downloaded from the following link: http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one …"
- http://secunia.com/advisories/35179/2/
Release Date: 2009-05-21
Critical: Moderately critical
Impact: Exposure of system information, Exposure of sensitive information, System access
Where: From local network
Solution Status: Vendor Patch …
Cisco IOS - HTTP Server vuln
- http://www.cisco.com/warp/public/707/cisco…1201-http.shtml
Revision 1.2 - Last Updated 2009 June 19 - " A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a show buffers command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser and potentially execute malicious commands against the device or other possible cross-site scripting attacks. Successful exploitation of this vulnerability requires that a user browse a page containing dynamic content in which HTML commands have been injected. Cisco will be making free software available to address this vulnerability for affected customers. There are workarounds available to mitigate the effects of the vulnerability…
Vulnerable Products: This security advisory applies to all Cisco products that run Cisco IOS Software versions 11.0 through 12.4 with the HTTP server enabled. A system which contains the IOS HTTP server or HTTP secure server, but does not have it enabled, is not affected.
To determine if the HTTP server is running on your device, issue the show ip http server status and show ip http server secure status commands at the prompt and look for output similar to:
Router>show ip http server status
HTTP server status: Enabled
If the device is not running the HTTP server, you should see output similar to:
Router>show ip http server status
HTTP server status: Disabled
Any version of Cisco IOS prior to the versions which will be listed in the Fixed Software section…"
Cisco: TCP State Manipulation DoS vulns - Multiple Cisco Products
- http://www.cisco.com/warp/public/707/cisco…908-tcp24.shtml
2009 September 8 - "Multiple Cisco products are affected by denial of service (DoS) vulnerabilities that manipulate the state of Transmission Control Protocol (TCP) connections. By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely… In some cases, a system reboot may be necessary to recover normal system operation. To exploit these vulnerabilities, an attacker must be able to complete a TCP three-way handshake with a vulnerable system… Cisco has released free software updates that address these vulnerabilities…"
- http://www.cisco.com/public/sw-center/sw-usingswc.shtml
- http://secunia.com/advisories/36618/2/
Release Date: 2009-09-09
Critical: Moderately critical
Impact: DoS
Where: From remote
Solution Status: Vendor Patch…
