cisco fixes multiple vulnerabilities in dozen products
This week, Cisco has released patches for multiple vulnerabilities spanning across a dozen of its products which included two high severity vulnerabilties. The severe vulnerabilties couold allow an attacker to perform a DOS attack or bypass local authentication.
The severe vulnerabilities existed in Cisco ISE’s engine and its Videoscape Distribution Suite. Failure to properly handle authentication requests and policy assignment in Cisco ISE allowed an attacker to gain Super Admin privileges by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. On the other hand, the DOS vulnerability stemmed from excessive stress being put on the VDS product such as mapping a lot of connections. An attacker that sends a load of traffic could potentially overwhelm the device causing it to reload.
Furthermore, Cisco fixed other low severity issues including two SQL vulnerabilities, four cross site scripting vulnerabilities, a directory traversal vulnerability, and a cross-site request vulnerability. Cisco also warned users that several of their product are prone to a OSPF bug. “To exploit this vulnerability, an attacker must accurately determine certain parameters within the LSA database on the target router,” Cisco warned. “This vulnerability can only be triggered by sending crafted unicast or multicast OSPF LSA type 1 packets. No other LSA type packets can trigger this vulnerability.”
The company says devices that don’t have OSPF enabled aren’t affected, nor are the following Cisco products:
- Cisco IOS XR Software
- Cisco StarOS Software
- Cisco Connected Grid Routers
- Cisco Nexus 1000v Series
Patches were pushed by Cisco to address these problems.