free software updates | KrowTen Security

Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability

Cisco IOS Software contains a vulnerability in the Smart Install feature that could allow an unauthenticated, remote attacker to cause a reload of an affected device if the Smart Install feature is enabled. The vulnerability is triggered when an affected device processes a malformed Smart Install message on TCP port 4786.

Cisco has released free software updates that address this vulnerability. There are no workarounds to mitigate this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-smartinstall

Cisco Security Advisory: Cisco Small Business SRP 500 Series (netsecurityit.wordpress.com)
Cisco: Multiple Vulnerabilities; ASA 5500, Catalyst 6500 (netsecurityit.wordpress.com)
Cisco Security Advisory: Cisco NX-OS (netsecurityit.wordpress.com)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers (netsecurityit.wordpress.com)

March 28, 2012 | Categories: Enterprise, General Security, Hacking, Network Management, Network Security, Patching, Security, Security Advisory, Vulnerabilities, Zero-Day | Tags: Cisco, Cisco IOS, Cisco Systems, Denial-of-service attack, enterprise-it, free software updates, lan controllers, mobile, nxos, Security, Technology, Transmission Control Protocol, VMware, Vulnerability (computing) | Leave a comment

Cisco Security Advisory: Cisco IOS Software RSVP Denial of Service Vulnerability

Cisco IOS Software and Cisco IOS XE Software contain a vulnerability in the RSVP feature when used on a device configured with VPN routing and forwarding (VRF) instances. This vulnerability could allow an
unauthenticated, remote attacker to cause an interface wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions. This vulnerability could be exploited repeatedly to cause an extended DoS condition.

A workaround is available to mitigate this vulnerability.

Cisco has released free software updates that address this
vulnerability. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-rsvp

Cisco: Multiple Vulnerabilities; ASA 5500, Catalyst 6500 (netsecurityit.wordpress.com)
Cisco Security Advisory: Cisco NX-OS (netsecurityit.wordpress.com)
Cisco Security Advisory: Cisco Small Business SRP 500 Series (netsecurityit.wordpress.com)
Cisco Releases Multiple Security Advisories (netsecurityit.wordpress.com)

March 28, 2012 | Categories: Enterprise, General Security, Hacking, Network Management, Network Security, Patching, Security, Security Advisory, Vulnerabilities, Zero-Day | Tags: cars, Cisco, Cisco IOS, cisco ios software, Cisco Systems, denial of service, denial of service dos, Denial-of-service attack, free software updates, nxos, Security, transportation, Virtual private network, Vulnerability (computing) | Leave a comment

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers

Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility.

These devices communicate with controller-based access points over any Layer 2 (Ethernet) or Layer 3 (IP) infrastructure using the Lightweight Access Point Protocol (LWAPP) and the Control and Provisioning of Wireless Access Points (CAPWAP) protocol.

The Cisco Wireless LAN Controller (WLC) product family is affected by
the following vulnerabilities:

* Cisco Wireless LAN Controllers HTTP Denial of Service Vulnerability
* Cisco Wireless LAN Controllers IPv6 Denial of Service Vulnerability
* Cisco Wireless LAN Controllers WebAuth Denial of Service Vulnerability
* Cisco Wireless LAN Controllers Unauthorized Access Vulnerability

Cisco has released free software updates that address these vulnerabilities. Workarounds are available that mitigate some of these vulnerabilities.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-wlc

Affected Products

The Cisco WLC product family is affected by multiple vulnerabilities. Affected versions of Cisco ASA Software vary depending on the specific vulnerability.

Vulnerable Products

Each of the following products is affected by at least one of the vulnerabilities covered in this Security Advisory:

* Cisco 2000 Series WLC
* Cisco 2100 Series WLC
* Cisco 2500 Series WLC
* Cisco 4100 Series WLC
* Cisco 4400 Series WLC
* Cisco 5500 Series WLC
* Cisco 500 Series Wireless Express Mobility Controllers
* Cisco Wireless Services Modules (WiSM)
* Cisco Wireless Services Modules version 2 (WiSM version 2)
* Cisco NME-AIR-WLC Modules for Integrated Services Routers (ISRs)
* Cisco NM-AIR-WLC Modules for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
* Cisco Flex 7500 Series Cloud Controllers

Measures to mitigate these risks can be found here: http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20120229-wlc

Cisco Releases Multiple Security Advisories (netsecurityit.wordpress.com)
Cisco Security Advisory: Cisco Small Business SRP 500 Series (netsecurityit.wordpress.com)
Cisco Security Advisory: Cisco NX-OS (netsecurityit.wordpress.com)

February 29, 2012 | Categories: Enterprise, General Security, Hacking, Network Management, Network Security, Network Security News, Patching, Remote Code Execution, Security, Security Advisory, Vulnerabilities, Wi-Fi, Wireless Security, Wireless VPN, Zero-Day | Tags: CAPWAP, Cisco, cisco 2500, cisco catalyst, Cisco Systems, Data Communications, Denial-of-service attack, free software updates, lan controllers, lan functions, Local area network, LWAPP, Security Advisory, Software Versions, Vendors, Vulnerability (computing), Wireless access point, wireless access points, Wireless LAN | 1 Comment

Cisco Security Advisory: Cisco Small Business SRP 500 Series

Cisco Releases Security Advisory for Cisco Small Business SRP 500 Series

Cisco Small Business (SRP 500) Series Services Ready Platforms contain the following three vulnerabilities:

* Cisco SRP 500 Series Web Interface Command Injection
Vulnerability
* Cisco SRP 500 Series Unauthenticated Configuration Upload
Vulnerability
* Cisco SRP 500 Series Directory Traversal Vulnerability

These vulnerabilities can be exploited using sessions to the Services Ready Platform Configuration Utility web interface. These vulnerabilities could be exploited from the local LAN side of the SRP
device by default configuration and the WAN side of the SRP device if remote management is enabled. Remote management is disabled by default.

Cisco has released free software updates that address these vulnerabilities.

Workarounds that mitigate these vulnerabilities are available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500

The following Cisco SRP 520 Series models are affected if running firmware prior to version 1.1.26:

* Cisco SRP 521W
* Cisco SRP 526W
* Cisco SRP 527W

The following Cisco SRP 520W-U Series models are affected if running firmware prior to version 1.2.4:

* Cisco SRP 521W-U
* Cisco SRP 526W-U
* Cisco SRP 527W-U

The following Cisco SRP 540 Series models are affected if running firmware prior to version 1.2.4:

* Cisco SRP 541W
* Cisco SRP 546W
* Cisco SRP 547W

To view the firmware version on a device, log in to the Services Ready Platform Configuration Utility and navigate to the Status > Router page to view information about the Cisco SRP Series device and its firmware status. The Firmware Version field indicates the current running version of firmware on the Cisco SRP 500 Series device.

More information regarding these vulnerabilities:

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html

The latest Cisco SRP 500 Series Services Ready Platforms firmware can

be downloaded at:
http://www.cisco.com/cisco/software/navigator.html?mdfid=282736194&i=rm