<< Previous Next >>
based
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
=======
Cisco IOS Software Multi Protocol Label Switching (MPLS) Forwarding
Infrastructure (MFI) is vulnerable to a Denial of Service (DoS)
attack from specially crafted packets. Only the MFI is affected by
this vulnerability. Older Label Forwarding Information Base (LFIB)
implementation, which is replaced by MFI, is not affected.
Cisco has released free software updates that address this
vulnerability.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Solaris, Linux, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-1697 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Solaris, Linux, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-1842 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Solaris, Linux, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
===============================================
Reference Base Vector Base Score
CVE-2008-1842 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
Cisco Service and Application Module for IP (SAMI). Under certain
configurations this vulnerability could allow:
* Customers to access sites that would normally match a billing
policy to be accessed without being charged to the end customer
* Customers to access sites that would normally be denied based on
configured restriction policies
Additionally, Cisco IOS Software Release 12.4(24)MD1 on the Cisco
CSG2 contains two vulnerabilities that can be exploited by a remote,
unauthenticated attacker to create a denial of service condition that
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Details
=======
Cisco IOS XR Software, which is part of the Cisco IOS Software
family, uses a microkernel-based distributed operating system
infrastructure. Cisco IOS XR Software runs on the Cisco CRS, Cisco
12000 Series Routers, and Cisco ASR 9000 Series Aggregation Services
Routers. This vulnerability only affects the SPA interface processors
on the Cisco 12000 Series Routers that are running affected versions
of Cisco IOS XR Software.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Vulnerable Products
+------------------
This vulnerability affects all versions of CiscoWorks Common
Services-based products running on Microsoft Windows
Common Services version 4.1 and later are not affected by this
vulnerability.
The following CiscoWorks products with the default Common Services
Cisco WLCs and Cisco WiSMs are responsible for system-wide wireless
LAN functions, such as security policies, intrusion prevention, RF
management, quality of service (QoS), and mobility.
These devices communicate with controller-based access points over any
Layer 2 (Ethernet) or Layer 3 (IP) infrastructure using the
Lightweight Access Point Protocol (LWAPP) and the Control and
Provisioning of Wireless Access Points (CAPWAP) protocol.
The Cisco WLC family of devices is affected by the following
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software Zone-Based Policy
Firewall Vulnerability
Advisory ID: cisco-sa-20090923-ios-fw
Revision 1.0
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Aruba Networks Security Advisory
Title: Management User Authentication Bypass Vulnerability When Using
Public Key Based SSH Authentication.
Aruba Advisory ID: AID-42309
Revision: 1.0
For Public Release on 4/23/2009
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
=======
ANM is a network management application that manages Cisco ACE modules
or appliances. ANM is installed on customer provided servers with a Red
Hat Enterprise Linux operating system. The ACE Device Manager provides
a browser-based interface for configuring and managing a single ACE
appliance. The ACE Device Manager resides in flash memory on the ACE
appliance. Multiple vulnerabilities exist in ANM and one in the ACE
Device Manager products. The following details are provided for each
vulnerability addressed in this security advisory.
-----------------------------------------------------
When you speak of security threats you mostly speak about unsecure protocols, weak encryption
algorithms, buffer overflows, privileges escalation, human factor, etc.
There are also another class of attacks that are quite well documented and based on an environmental
analysis of a secure component you want to unsecure. These are known as "timing attacks".
Timing attacks were very popular years ago and this field of research is still under progress.
Briefly, timing attacks consist of analyzing the time it takes for a system to compute data in
Summary
=======
A Cisco IOS device may crash while processing an SSL packet. This can
happen during the termination of an SSL-based session. The offending
packet is not malformed and is normally received as part of the
packet exchange.
Cisco has released free software updates that address this
vulnerability. Aside from disabling affected services, there are no
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Details
=======
Cisco uBR10012 series devices need to communicate with an RF Switch
when configured for linecard redundancy. This communication is based
on SNMP (Simple Network Management Protocol). When linecard
redundancy is enabled on a Cisco uBR10012 series device, SNMP is also
automatically enabled with a default community string of private that
has read/write privileges. Since there are no access restrictions on
this community string, it may be exploited by an attacker to gain
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
The Real-Time Information Server (RIS) Data Collector service of CUCM
versions 4.x, 5.x, and 6.x contains an authentication bypass
vulnerability that may result in the unauthorized disclosure of
certain CUCM cluster information. In normal operation, Real-Time
Monitoring Tool (RTMT) clients gather CUCM cluster statistics by
authenticating to a Simple Object Access Protocol (SOAP) based web
interface. The SOAP interface proxies authenticated connections to
the RIS Data Collector process. The RIS Data Collector service
listens on TCP port 2556 by default and is user configurable. By
connecting directly to the port that the RIS Data Collector process
listens on, it may be possible to bypass authentication checks and
Cisco Internetwork Operating System Software
IOS (tm) 7200 Software (C7200-IS-M), Version 12.2(7), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Tue 15-Jan-02 18:31 by pwade
Image text-base: 0x600089C0, data-base: 0x613A6000
Additional information about Cisco IOS release naming can be found at
http://www.cisco.com/warp/public/620/1.html.
Products Confirmed Not Vulnerable
=================
Vulnerable Products
+------------------
Cisco devices running certain 12.2-based IOS releases and configured to
offer Secure Copy server functionality are affected by this issue.
A device running a vulnerable Cisco IOS 12.2-based is affected if the
following command is present in the device configuration:
<<Previous Next>>
|
