HARDWARE — THE HEADLINES

 2001/8/15 

Tunnel ports allowed on NetApp NetCaches

 2001/7/11 

Cisco multiple SSH vulnerabilities

 2001/7/04 

Cisco IOS HTTP Authorization vulnerability

 2001/7/02 

Cisco 6400 NRP2 Telnet vulnerability

 2001/6/07 

More multiple vulnerabilities in CBOS

HARDWARE — THE LINKS

Disclaimer: These hyper-links to external content may be submitted by visitors of https://zhk-teplye-kvartaly-pogoda-perm.avito.ru/. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

HARDWARE — THE NEWS

2001/8/15

08:55 +0100

Tunnel ports allowed on NetApp NetCaches

[Hardware] A security vulnerability in NetApp NetCache version 4.0 allows outside attackers to tunnel TCP based connections to internal hosts. This allows the attackers to arbitrarily connect to internal hosts; anything from using the SMTP servers for spam to connecting to restricted ports (SSH, Telnet, etc) posted Kevin O'Brien.

The option config.http.tunnel.allow_ports is set by default to +all. This allows anyone to tunnel through the cache to any TCP port—for example, to tunnel a connection in order to send spam email to port 25 (SMTP) on the mail servers.

To fix this vulnerability, type: set config.http.tunnel.allow_ports !all This will block any tunneling. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/7/11

10:30 +0100

Cisco multiple SSH vulnerabilities

[Hardware] Three different Cisco product lines are susceptible to multiple vulnerabilities in the Secure Shell (SSH) protocol. These issues are inherent to the SSH protocol version 1.5, which is implemented in several Cisco product lines. By exploiting the weakness in the SSH protocol, it is possible to insert an arbitrary commands into an established SSH session, collect information that may help in brute force key recovery, or brute force a session key.

Vulnerable systems include all devices running Cisco IOS software supporting SSH. That includes routers and switches running Cisco IOS. Catalyst 6000 switches running CatOS and the Cisco PIX Firewall.

An implementation of SSH in multiple Cisco products are vulnerable to three different vulnerabilities. These vulnerabilities are:
—CRC-32 integrity check vulnerability.
—Traffic analysis.
—Key recovery in SSH protocol 1.5.

By exploiting these weaknesses, the attacker can insert arbitrary commands in the session after the session has been established, guessing the password using the brute force attack and reveal information in an unencrypted form.

For a table listing all vulnerable products and appropriate patches please see: cisco.com/warp/public/707. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/7/04

10:08 +0100

Cisco IOS HTTP Authorization vulnerability

[Hardware] When 'HTTP server' is enabled and local authorization is used with a Cisco router, it is possible, under some circumstances, to bypass the authentication and execute any command on the device. It that case, the attacker will be able to exercise complete control over the device. All commands will be executed with the highest privilege (level 15). This vulnerability is documented as Cisco Bug ID CSCdt93862. It has been reported to Cisco independently by David Hyams, Ernst & Young, Switzerland and by Bashis. CERT/CC has dedicated Advisory CA-2001-14 to this problem.

All releases of Cisco IOS software, starting with the release 11.3 and later, are vulnerable. Virtually, all mainstream Cisco routers and\switches running Cisco IOS are affected by this vulnerability.

The workaround for this vulnerability is to disable HTTP server on the router or to use Terminal Access Controller Access Control System (TACACS+) or Radius for authentication. For a table listing all vulnerable versions and their fixes please see cisco.com/warp // c.f. SecuriTeam :: [dre].

Comments (0)

2001/7/02

10:49 +0100

Cisco 6400 NRP2 Telnet vulnerability

[Hardware] Cisco Systems warns its customers, that the Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) module allows Telnet access when no password has been set. This vulnerability may result in attackers gaining unintended access to secure systems with Cisco 6400 NRP2 modules running Cisco IOS(tm) release earlier than 12.1(05)DC01. This vulnerability is documented as Cisco bug ID CSCdt65960.

Cisco 6400 NSP and Cisco 6400 NRP1 modules are not affected by this vulnerability. No other Cisco product is currently known to be affected by this vulnerability. To determine your software revision, type show version at the command line prompt.

A workaround is to not allow any remote access to the module until the vty password has been set. This vulnerability can be eliminated by upgrading the IOS to Cisco IOS release 12.1(05)DC01 or later. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/6/07

09:04 +0100

More multiple vulnerabilities in CBOS

[Hardware] The Cisco Systems PSIRT admited that multiple vulnerabilities have been identified and fixed in CBOS, an operating system for the Cisco 600 family of routers:

Cisco CBOS Software contains a flaw that permits the successful prediction of TCP Initial Sequence Numbers. It only affects the security of TCP connections that originate or terminate on the affected Cisco device itself; it does not apply to TCP traffic forwarded through the affected device in transit between two other hosts. This vulnerability is documented as Cisco bug ID CSCds16078.

A Cisco 600 router may stop passing the traffic and responding to the console when an ECHO REQUEST packet with the record route option is routed through it. This vulnerability is documented as Cisco bug ID CSCds30150.

Passwords, exec and enable, are stored in the clear text in the NVRAM. This vulnerability is documented as Cisco bug ID CSCdt04882.

When multiple, large ECHO REPLY packets are routed through an affected Cisco 600 router, it will enter the ROMMON mode and stop passing any further traffic. This vulnerability is documented as Cisco bug ID CSCds74567.

The following releases of CBOS are containing all of mentioned vulnerabilities: 2.0.1, 2.1.0, 2.1.0a, 2.2.0, 2.2.1, 2.2.1a, 2.3, 2.3.2, 2.3.5, 2.3.7, and 2.3.8. These vulnerabilities are fixed in the following CBOS releases: 2.3.9, 2.4.1, and 2.4.2. Customers are urged to upgrade to releases that are not vulnerable. // c.f. SecuriTeam :: [dre].

Comments (0)