Cisco WebEx WRF Player vulns
- http://www.cisco.com/warp/public/707/cisco…216-webex.shtml
2009 December 16 - "Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) Player. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx WRF Player is an application that is used to play back WebEx meeting recordings that have been recorded on the computer of an on-line meeting attendee. The WRF Player can be automatically installed when the user accesses a WRF file that is hosted on a WebEx server… Multiple buffer overflow vulnerabilities exist in the WRF Player. The vulnerabilities may lead to a crash of the WRF Player application, or in some cases, lead to remote code execution…
(CVE) identifiers:
* CVE-2009-2875
* CVE-2009-2876
* CVE-2009-2877
* CVE-2009-2878
* CVE-2009-2879
* CVE-2009-2880 …
There are no workarounds for the vulnerabilities disclosed in this advisory… Cisco has released free software updates that address these vulnerabilities…"
Cisco InternetWork Performance Monitor GIOP Request Buffer Overflow
- http://secunia.com/advisories/38230/2/
Last Update: 2010-01-22
Critical: Moderately critical
Impact: DoS, System access
Where: From local network
Solution: Contact the vendor for instructions on migrating to non-vulnerable software
(please see the vendor advisory for details).
Restrict network access to an affected system.
Original Advisory: Cisco: http://www.cisco.com/warp/public/707/cisco…00120-ipm.shtml
Multiple Vulnerabilities in Cisco Unified MeetingPlace
- http://atlas.arbor.net/briefs/index#-478562949
Severity: Elevated Severity
Published: Friday, January 29, 2010 19:03
"Multiple issues have been found and fixed in Cisco Unified MeetingPlace versions 5, 6, and 7. These bugs could allow for SQL injection, privilege escalation, account enumeration, and unauthorized new account creation. Cisco has made updated software available to their customers to address these issues. Analysis: Sites using Cisco Unified MeetingPlace should review this update and apply the updates soon."
Cisco releases multiple Security Advisories
- http://www.us-cert.gov/current/#cisco_rele…rity_advisories
February 17, 2010
> http://www.cisco.com/en/US/products/produc…080b1910e.shtml
Security advisory, cisco-sa-20100217-fwsm, addresses a vulnerability in the Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers. Successful and repeated exploitation of this vulnerability could result in a denial-of-service condition.
> http://www.cisco.com/en/US/products/produc…080b1910c.shtml
Security advisory, cisco-sa-20100217-asa, addresses multiple vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances. These vulnerabilities may allow an attacker to gain unauthorized access to an affected system or cause a denial-of-service condition.
> http://www.cisco.com/en/US/products/produc…080b1910d.shtml
Security advisory, cisco-sa-20100217-csa, addresses multiple vulnerabilities in the Cisco Security Agent. These vulnerabilities may allow an attacker to execute arbitrary SQL commands, view and download arbitrary files, or cause a denial-of-service condition…
- http://atlas.arbor.net/briefs/index#1182447196
March 24, 2010 - "… Cisco has released 7 security bulletins for its IOS, IOS XR, and CUCM product features, all of which are denial of service issues…"
Cisco PGW vulns - updates available
- http://www.cisco.com/warp/public/707/cisco…00512-pgw.shtml
2010 May 12 - "Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch series of products… Cisco has released free software updates that address these vulnerabilities. There are no workarounds that mitigate these vulnerabilities… All vulnerabilities listed in this Security Advisory are addressed in Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and subsequent, software releases…"
- http://atlas.arbor.net/briefs/index#-1480011314
May 12, 2010 - Elevated Severity - "Analysis: This is a big set of medium risk vulnerabilities. We encourage sites using the PGW 2200 to update soon to address them."
Cisco Network Building Mediator - updates available
- http://www.cisco.com/warp/public/707/cisco…-mediator.shtml
May 26, 2010 - "These vulnerabilities affect the legacy Richards-Zeta Mediator 2500 product and Cisco Network Building Mediator NBM-2400 and NBM-4800 models. All Mediator Framework software releases prior to 3.1.1 are affected by all vulnerabilities listed in this security advisory… Fixed 3.1.1 and 3.0.9 Mediator Framework software can be downloaded from the Software Center… by visiting http://www.cisco.com/cisco/psn/web/download/index.html and navigating to Physical Security and Building Systems > Smart Connected Buildings > Cisco Network Building Mediator. To obtain fixed 1.5.1 and 2.2 Mediator Framework software and configTOOL version 3.1.0b1 contact Cisco TAC… There are no workarounds for these vulnerabilities…"
- http://www.cisco.com/warp/public/707/cisco…0707-snmp.shtml
2010 July 07 - "Summary: Cisco Industrial Ethernet 3000 (IE 3000) Series switches running Cisco IOS® Software releases 12.2(52)SE or 12.2(52)SE1, contain a vulnerability where well known SNMP community names are hard-coded for both read and write access. The hard-coded community names are "public" and "private." Cisco recommends that all administrators deploy the mitigation measures outlined in the Workarounds section or perform a Cisco IOS Software upgrade… Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available…
Impact: Successful exploitation of the vulnerability could result in an attacker obtaining full control of the device…"
- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2010-1574
CVSS v2 Base Score: 10.0 (HIGH)
- http://www.kb.cert.org/vuls/id/732671
Date Last Updated: 2010-07-12
Cisco CDS vuln - update available
- http://secunia.com/advisories/40701/
Release Date: 2010-07-22
Criticality level: Moderately critical
Impact: Exposure of system information, Exposure of sensitive information
Where: From remote
Software: Cisco Content Delivery System 2.x
CVE Reference: CVE-2010-1577
… The vulnerability is reported in versions 2.2.x, 2.3.x, 2.4.x, and 2.5.x.
Solution: Update to version 2.5.7 or later.
Original Advisory: Cisco: http://www.cisco.com/warp/public/707/cisco…721-spcdn.shtml
Last Updated: 2010 July 29 Revision 1.1 - "Updated Details and Workaround sections…"
