320 replies to this topic

[AplusWebMaster]

FYI...

> http://tools.cisco.c...cationListing.x

Cisco IOS Software Tunneled Traffic Queue Wedge vuln
- http://tools.cisco.c...26-c10k-tunnels
Last Updated: 2013 Jan 18 - "... Cisco has released free software updates that address the vulnerability described in this advisory. Prior to deploying software, customers are advised to consult their maintenance providers or check the software for feature set compatibility and known issues that are specific to their environments..."

Cisco Unified IP Phone - vuln
- http://tools.cisco.c...130109-uipphone
Last Updated: 2013 Jan 17 - "Update: An Engineering Special release has been made available for affected Cisco Customers that includes hardening measures to mitigate the known attack vectors for the vulnerability described in this advisory. This release is available upon request from the Cisco TAC. The release name is 9.3(1)-ES11..."
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

> http://tools.cisco.c...cationListing.x

Multiple Vulnerabilities in Cisco Wireless LAN Controllers
- http://tools.cisco.c...sa-20130123-wlc
Last Updated: 2013 Jan 30 - "Summary: The Cisco Wireless LAN Controller (Cisco WLC) product family is affected by the following four vulnerabilities:
• Cisco Wireless LAN Controllers Wireless Intrusion Prevention System (wIPS) Denial of Service Vulnerability
• Cisco Wireless LAN Controllers Session Initiation Protocol Denial of Service Vulnerability
• Cisco Wireless LAN Controllers HTTP Profiling Remote Code Execution Vulnerability
• Cisco Wireless LAN Controllers SNMP Unauthorized Access Vulnerability
Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available..."
- http://www.securityt....com/id/1028027
CVE Reference:

- http://web.nvd.nist....d=CVE-2013-1102 - 7.8 (HIGH)
- http://web.nvd.nist....d=CVE-2013-1103 - 7.8 (HIGH)
- http://web.nvd.nist....d=CVE-2013-1104 - 9.0 (HIGH)
- http://web.nvd.nist....d=CVE-2013-1105 - 9.0 (HIGH)
Jan 23 2013
Impact: Denial of service via network, Disclosure of system information, Execution of arbitrary code via network, Modification of system information, User access via network
Solution: The vendor has issued a fix (7.0.240.0, 7.2.111.3, 7.3.110.0).

Cisco Prime LAN Management Solution Command Execution vuln
- http://tools.cisco.c...sa-20130109-lms
Last Updated: 2013 Jan 23 - "Summary: Cisco Prime LAN Management Solution (LMS) Virtual Appliance contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with the privileges of the root user. The vulnerability is due to improper validation of authentication and authorization commands sent to certain TCP ports. An attacker could exploit this vulnerability by connecting to the affected system and sending arbitrary commands. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate these vulnerabilities are available..."
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 06 February 2013 - 12:47 PM.

[AplusWebMaster]

FYI...

> http://tools.cisco.c...lnerabilityNote

Cisco IOS Software HTTP Server Denial of Service Vuln
- http://tools.cisco.c...e/CVE-2013-1100
2013 Jan 30 - " Summary: Cisco IOS Software contains a vulnerability in the HTTP server feature which could allow an unauthenticated, remote attacker to cause a denial of service attack if the HTTP server feature is enabled. The vulnerability is due to incorrect handling of TCP socket events. An attacker could exploit this vulnerability by sending a special combination of crafted packets to TCP port 80 or 443. A successful exploit could cause a Cisco Catalyst switch to crash, resulting in a denial of service...
Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will -not- be provided for issues that are disclosed through a Cisco Security Notice...

Cisco Carrier Routing System Small Packets DoS vuln
- http://tools.cisco.c...e/CVE-2013-1112
Last Updated: 2013 January 28 - "Summary: Cisco Carrier Routing System (CRS) contains a vulnerability that could allow an unauthenticated, remote attacker to cause a partial drop of legitimate traffic passing through the affected system. The vulnerability is due to inefficient handling of some malformed packets, which may slow down the processing of legitimate traffic. An attacker could exploit this vulnerability by sending malformed packets through the affected system.:
> http://tools.cisco.c...ugId=CSCud79136
... Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will -not- be provided for issues that are disclosed through a Cisco Security Notice..."

- https://secunia.com/advisories/51989/
Release Date: 2013-01-29
Criticality level: Moderately critical
Impact: DoS
Where: From remote...
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 06 February 2013 - 04:16 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...lnerabilityNote

Cisco Unity Express Cross Site Request Forgery Vuln
- http://tools.cisco.c...e/CVE-2013-1120
2013 Feb 1 - "Summary: Cisco Unity Express software prior to version 8.0 contains vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross site request forgery attacks..."

- https://secunia.com/advisories/52045/
Release Date: 2013-02-04
Impact: Cross Site Scripting
Where: From remote...
CVE Reference(s): CVE-2013-1114, CVE-2013-1120
... vulnerabilities are reported in versions prior to 8.0.
Solution: Upgrade to version 8.0 or later
 

:ph34r:

[AplusWebMaster]

FYI...

> http://tools.cisco.c...cationListing.x

Cisco ATA 187 Analog Telephone Adaptor Remote Access Vuln
- http://tools.cisco.c...20130206-ata187
2013 Feb 6 - Summary: Cisco ATA 187 Analog Telephone Adaptor firmware versions 9.2.1.0 and 9.2.3.1 contain a vulnerability that could allow an unauthenticated, remote attacker to access the operating system of the affected device.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available...
Vulnerable Products: The Cisco ATA 187 Analog Telephone Adaptor is affected by this vulnerability when it is running firmware version 9.2.1.0 or 9.2.3.1.
To check the firmware version on the Cisco ATA 187 Analog Telephone Adaptor, an administrator can view the SW_Version ID field on the device web interface...
Fixes: This vulnerability is addressed in the Cisco ATA 187 Analog Telephone Adaptor firmware version 9.2.3.1 ES build 4 or later...
Workarounds: It is possible to terminate the listening Telnet process on the device by accessing the device remotely, listing the processes, and then terminating the Telnet process. This prevents further remote access to the device until the device is reloaded. Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Identifying and Mitigating Exploitation of the Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability," which is available at the following
link: http://tools.cisco.c...x?alertId=27921

- http://tools.cisco.c...lnerabilityNote

Cisco Nexus 7000 M1-Series Modules Crafted Packet Vuln
- http://tools.cisco.c...e/CVE-2013-1122
2013 Feb 6 -  Summary: Cisco Nexus 7000 contains a vulnerability that could allow an unauthenticated, remote attacker to cause an affected M1-Series module to reload.
The vulnerability is due to incorrect handling of crafted packets. An attacker could exploit this vulnerability by sending crafted packets to a device that is configured with Overlay Transport Virtualization (OTV), where the physical interface of the connection is over the M1-Series module. An exploit could allow the attacker to cause the M1-Series module to reload.
Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will -not- be provided for issues that are disclosed through a Cisco Security Notice...

:ph34r:

Edited by AplusWebMaster, 06 February 2013 - 02:19 PM.

[AplusWebMaster]

FYI...

> http://tools.cisco.c...ecurityAdvisory

Cisco multiple product Root Shell Access vuln
- http://tools.cisco.c...e/CVE-2013-1125
2013 Feb 15 - "Summary: A vulnerability in the command-line interface of multiple Cisco products could allow an authenticated, local attacker to gain shell access with root privileges. The vulnerability is due to incorrect input validation...
Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will -not- be provided for issues that are disclosed through a Cisco Security Notice...

Cisco Unity Connection Memory Leak DoS vuln
- http://tools.cisco.c...e/CVE-2013-1129
2013 Feb 15 - " Summary: Cisco Unity Connection version 9.x contains a vulnerability that could allow an unauthenticated, remote attacker to trigger a memory leak that can result in the crash of a critical process. The vulnerability is due to incorrect handling of incoming TCP sessions...
Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will -not- be provided for issues that are disclosed through a Cisco Security Notice..."
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Unified Communications Manager Multiple DoS vulns
- http://tools.cisco.c...a-20130227-cucm
2013 Feb 27 - "Summary: Cisco Unified Communications Manager contains two vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of these vulnerabilities could cause an interruption of voice services. Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1028218
CVE Reference: CVE-2013-1133, CVE-2013-1134
Feb 28 2013
Solution: The vendor has issued a fix (8.6(4)BE3K, 8.6(2a)su2, 9.1(1)).

Cisco Prime Central - Hosted Collaboration Solution - Excessive CPU Utilization vuln
- http://tools.cisco.c...sa-20130227-hcs
2013 Feb 27 - "Summary: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of this vulnerability could interrupt the monitoring of voice services. Cisco has released free software updates that address this vulnerability..."
- http://www.securityt....com/id/1028220
CVE Reference: CVE-2013-1135
Date:  Feb 28 2013
Solution: The vendor has issued a fix (9.1(1)).

Cisco Unified Presence Server DoS vuln
- http://tools.cisco.c...a-20130227-cups
2013 Feb 27 - "Summary: Cisco Unified Presence Server (CUPS) contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Cisco has released free software updates that address this vulnerability. A workaround is available to mitigate this vulnerability... Fixes may be obtained from the software download center on cisco.com, which you can access at the following link:
> http://software.cisc.../navigator.html
Note: The upgrade path for version 9.0 is to version 9.1.1 which is available at the link above..."
- http://www.securityt....com/id/1028219
CVE Reference: CVE-2013-1137
Feb 28 2013
 

:ph34r: :ph34r: :ph34r:

[AplusWebMaster]

FYI...

>> http://tools.cisco.c...oSecurityNotice

Cisco Small Business Switches - DoS vuln
- http://tools.cisco.c...x?alertId=27502
March 06, 2013
- https://cve.mitre.or...e=CVE-2013-1154
Summary: Cisco Small Business Switches contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition on a targeted device. Updates are available.
The following Cisco Small Business Series Switches are vulnerable:
- Cisco Small Business 200 Series Smart Switch versions 1.2.7.76 and prior
- Cisco Small Business 300 Series Managed Switch versions 1.2.7.76 and prior
- Cisco Small Business 500 Series Stackable Managed Switch version 1.2.7.76 and prior
> http://software.cisc...catid=268438038

Cisco Prime Infrastructure Cross-Site Request Forgery vuln
- http://tools.cisco.c...x?alertId=28502
March 06, 2013
- https://cve.mitre.or...e=CVE-2013-1153
Summary: Cisco Prime Infrastructure contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site request forgery attacks. Updates are not available... the code is not known to be publicly available.
Primary Products: Cisco Prime Infrastructure: 1.2 .0, .1 | 1.3 .0
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 17 March 2013 - 09:11 AM.

[AplusWebMaster]

FYI...

Cisco Video Surveillance Operations Manager - multiple vulns
- https://secunia.com/advisories/52611/
Release Date: 2013-03-15
Impact: Security Bypass, Cross Site Scripting, Exposure of sensitive information
Where: From remote
... vulnerabilities are reported in all 6.x versions.
Solution: Upgrade to a fixed 7.x version.

Release Notes for Cisco Video Surveillance Manager Release 7.0.1
> http://www.cisco.com..._1.html#wp23144
14 Mar 2013
 

:ph34r:

[AplusWebMaster]

FYI...

Semiannual Cisco IOS Software Security Advisory Bundled Publication
> http://www.cisco.com..._ERP_mar13.html
March 27, 2013

Cisco IOS Software Network Address Translation Vulnerability
- http://tools.cisco.c...sa-20130327-nat

Cisco IOS Software Resource Reservation Protocol Denial of Service Vulnerability
http://tools.cisco.c...a-20130327-rsvp

Cisco IOS Software Internet Key Exchange Vulnerability
http://tools.cisco.c...sa-20130327-ike

Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection Denial of Service Vulnerability
http://tools.cisco.c...sa-20130327-cce

Cisco IOS Software Smart Install Denial of Service Vulnerability
http://tools.cisco.c...27-smartinstall

Cisco IOS Software Protocol Translation Vulnerability
http://tools.cisco.c...-sa-20130327-pt

Cisco IOS Software IP Service Level Agreement Vulnerability
http://tools.cisco.c...-20130327-ipsla
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Multiple Vulnerabilities in Cisco ASA Software
- http://tools.cisco.c...sa-20130410-asa
2013 April 10 - "... Cisco has released free software updates that address these vulnerabilities. Workarounds are available for some of these vulnerabilities...
> https://secunia.com/advisories/53013/

Multiple Vulnerabilities in Cisco Firewall Services Module Software
- http://tools.cisco.c...a-20130410-fwsm
2013 April 10 - "... Cisco has released free software updates that address these vulnerabilities. A workaround is available for the IKE vulnerability...
> https://secunia.com/advisories/53012/

Multiple Vulnerabilities in Cisco Unified MeetingPlace Solution
- http://tools.cisco.c...-sa-20130410-mp
2013 April 10 - "... Cisco has released free software updates that address these vulnerabilities. A workaround is available for the Cisco Unified MeetingPlace Web Conferencing Server Arbitrary Login Vulnerability...
> https://secunia.com/advisories/53014/

Cisco Prime Network Control Systems Database Default Credentials Vulnerability
- http://tools.cisco.c...sa-20130410-ncs
2013 April 10 - "... Cisco has released free software updates that address this vulnerability. There is no workaround for this vulnerability...
> https://secunia.com/advisories/53010/

Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
- http://tools.cisco.c...0130410-asr1000
2013 April 10 - "... Cisco has released free software updates that address these vulnerabilities...
> https://secunia.com/advisories/53011/
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS Software Resource Reservation Protocol DoS vuln
- http://tools.cisco.c...a-20130327-rsvp
2013 April 11 - Revision 1.2 - "... Cisco has released free software updates that address this vulnerability. There are no workarounds available to mitigate this vulnerability..."

Cisco IOS Software Protocol Translation vuln
- http://tools.cisco.c...-sa-20130327-pt
2013 April 11 - Revision 1.1 - "... Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available..."

Cisco IOS Software Internet Key Exchange vuln
- http://tools.cisco.c...sa-20130327-ike
2013 April 11 - Revision 1.1 - "... Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."

Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection DoS vuln
- http://tools.cisco.c...sa-20130327-cce
2013 April 11 - Revision 1.1 - "... Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP inspection..."

Cisco IOS Software Smart Install DoS vuln
- http://tools.cisco.c...27-smartinstall
2013 April 11 - Revision 1.1 - "... Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that have the Smart Install client feature enabled..."

Cisco IOS Software Network Address Translation vuln
- http://tools.cisco.c...sa-20130327-nat
2013 April 11 - Revision 1.3 - "... Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."

Cisco IOS Software IP Service Level Agreement vuln
- http://tools.cisco.c...-20130327-ipsla
2013 April 12 - Revision 1.3 - "... Cisco has released free software updates that address this vulnerability. Mitigations for this vulnerability are available..."
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS XE Software for 1000 Series Aggregation Services Routers - multiple vulns
- http://tools.cisco.c...0130410-asr1000
Last Updated: 2013 April 15 Revision 1.2 - "Summary: Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities:
- Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability
- Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability
- Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability
- Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability
- Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others.
- Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigger a reload of the Embedded Services Processors (ESP) card or the Route Processor (RP) card, causing an interruption of services. Repeated exploitation could result in a sustained DoS condition.
Note: Cisco IOS Software and Cisco IOS-XR Software are not affected by these vulnerabilities.
Cisco has released free software updates that address these vulnerabilities..."

- http://www.securityt....com/id/1028418
CVE Reference: CVE-2013-1164, CVE-2013-1165, CVE-2013-1166, CVE-2013-1167
Apr 10 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): IOS XE 2.x - 3.7 ...
 

:ph34r:

Edited by AplusWebMaster, 16 April 2013 - 04:08 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco TelePresence Infrastructure Denial of Service Vuln
- http://tools.cisco.c...sa-20130417-tpi
2013 April 17 Revision 1.0 - "... Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."
CVE: CVE-2013-1164, CVE-2013-1165, CVE-2013-1166, CVE-2013-1167

Cisco Network Admission Control Manager SQL Injection Vuln
- http://tools.cisco.c...sa-20130417-nac
2013 April 17 Revision 1.0 - "... Cisco has released free software updates that address this vulnerability. There are no workarounds for this vulnerability..."
CVE: CVE-2013-1177

Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers
- http://tools.cisco.c...0130410-asr1000
2013 April 17 Revision 1.3 - "... Summary: Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities:
- Cisco IOS XE Software IPv6 Multicast Traffic Denial of Service Vulnerability
- Cisco IOS XE Software MVPNv6 Traffic Denial of Service Vulnerability
- Cisco IOS XE Software L2TP Traffic Denial of Service Vulnerability
- Cisco IOS XE Software Bridge Domain Interface Denial of Service Vulnerability
- Cisco IOS XE Software SIP Traffic Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigger a reload of the Embedded Services Processors (ESP) card or the Route Processor (RP) card, causing an interruption of services. Repeated exploitation could result in a sustained DoS condition.
Note: Cisco IOS Software and Cisco IOS-XR Software are not affected by these vulnerabilities.
Cisco has released free software updates that address these vulnerabilities..."
CVE: CVE-2013-1177
 

:ph34r:

[AplusWebMaster]

FYI...

> http://tools.cisco.c...cationListing.x

Multiple Vulnerabilities in Cisco Unified Computing System
- http://tools.cisco.c...130424-ucsmulti
2013 April 24 - "Summary:
Managed and standalone Cisco Unified Computing System (UCS) deployments contain one or more of the vulnerabilities:
- Cisco Unified Computing System LDAP User Authentication Bypass Vulnerability
- Cisco Unified Computing System IPMI Buffer Overflow Vulnerability
- Cisco Unified Computing Management API Denial of Service Vulnerability
- Cisco Unified Computing System Information Disclosure Vulnerability
- Cisco Unified Computing System KVM Authentication Bypass Vulnerability
Cisco has released free software updates that address these vulnerabilities..."
- http://tools.cisco.c...x?alertId=28729
CVE: CVE-2013-1182, CVE-2013-1183, CVE-2013-1184, CVE-2013-1185, CVE-2013-1186
- https://secunia.com/advisories/53188/
Release Date: 2013-04-25
Criticality level: Moderately critical
Impact: Security Bypass, DoS, System access
Where: From local network...

Cisco Device Manager Command Execution Vulnerability
- http://tools.cisco.c...a-20130424-fmdm
2013 April 24 - "Summary: Cisco Device Manager contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands on a client host with the privileges of the user. This vulnerability affects Cisco Device Manager for the Cisco MDS 9000 Family and Cisco Nexus 5000 Series Switches when it is installed or launched via the Java Network Launch Protocol (JNLP) on a host running Microsoft Windows... Cisco has released free software updates that address this vulnerability in the Cisco Device Manager for Cisco MDS 9000 Family Switches. Cisco Nexus 5000 Series Switches have discontinued the support of the Cisco Device Manager installation via JNLP and updates are not available. Workarounds that mitigate this vulnerability are available..."
- https://web.nvd.nist...d=CVE-2013-1192 - 9.3 (HIGH)

- https://secunia.com/advisories/53190/
Release Date: 2013-04-25
Criticality level: Highly critical
Impact: System access
Where: From remote...

 

Multiple Vulnerabilities in Cisco NX-OS-Based Products
- http://tools.cisco.c...30424-nxosmulti
2013 April 24 - "Summary:
Cisco Nexus, Cisco Unified Computing Systemn (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system.  These products are affected by one or more of the following vulnerabilities:
- Multiple Cisco Discovery Protocol Vulnerabilities in Cisco NX-OS-Based Products
- Cisco NX-OS Software SNMP and License Manager Buffer Overflow Vulnerability
- Cisco NX-OS Software SNMP Buffer Overflow Vulnerability
- Cisco NX-OS Software Jumbo Packet Denial of Service Vulnerability
Cisco has released free software updates that address these vulnerabilities..."
Revision 1.2 - 2013-April-26 - Updated summary table in Affected Products for clarification. Corrected UCS 6100/6200 information for jumbo frame vulnerability in summary table.
- http://tools.cisco.c...x?alertId=28737
CVE: CVE-2013-1178, CVE-2013-1179, CVE-2013-1180, CVE-2013-1181
- https://secunia.com/advisories/53189/
Release Date: 2013-04-25
Criticality level: Moderately critical
Impact: DoS, System access
Where: From local network...

 

:ph34r:

Edited by AplusWebMaster, 28 April 2013 - 08:23 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Prime Data Center Network Manager Remote Command Execution Vuln
- http://tools.cisco.c...a-20121031-dcnm
Last Updated: 2013 May 8 Revision 2.0 - "Summary: Cisco Prime Data Center Network Manager (DCNM) contains a remote command execution vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands on the computer that is running the Cisco Prime DCNM application. Cisco has released free software updates that address this vulnerability...
- Revision 2.0 - 2013-May-08 - Updated advisory to indicate that the DCNM LAN server component of DNCM is also affected by this vulnerability. Added corresponding Cisco bug ID CSCua31204 and updated fixed software..."

Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software
- http://tools.cisco.c...sa-20130508-cvp
2013 May 8 Revision 1.0 - "Summary: Cisco Unified Customer Voice Portal Software (Unified CVP) contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one vulnerability could be exploited on the same device. Cisco has released free software updates that address these vulnerabilities..."
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- https://tools.cisco....cationListing.x

Cisco TelePresence Supervisor MSE 8050 DoS vuln
- http://tools.cisco.c...sa-20130515-mse
2013 May 15 Revision 1.0 - "Cisco TelePresence Supervisor MSE 8050 contains a vulnerability that may allow an unauthenticated, remote attacker to cause high CPU utilization and a reload of the affected system. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."

- https://secunia.com/advisories/53388/
Release Date: 2013-05-16
Impact: DoS
Where: From local network
CVE Reference: https://web.nvd.nist...d=CVE-2013-1236 - 7.8 (HIGH)
... vulnerability is reported in versions 2.2(1.17) and prior.
Solution: Update to version 2.3(1.31).
___

Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software
- http://tools.cisco.c...sa-20130508-cvp
2013 May 10 Revision 1.1 - "Cisco Unified Customer Voice Portal Software (Unified CVP) contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one vulnerability could be exploited on the same device. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate some of these vulnerabilities are available..."
Revision 1.1 - 2013-May-10 - Updated Workaround and Software Versions sections.
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 16 May 2013 - 10:15 PM.

[AplusWebMaster]

FYI...

Multiple Vulnerabilities in Cisco ASA Software
- http://tools.cisco.c...sa-20130410-asa
Last Updated  2013 May 23 - "... Successful exploitation of any of these vulnerabilities may result in a reload of an affected device, leading to a denial of service (DoS) condition.
Cisco has released free software updates that address these vulnerabilities. Workarounds are available for some of these vulnerabilities..."
Affected Products: Cisco ASA Software for Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, and Cisco ASA 1000V Cloud Firewall are affected by multiple vulnerabilities. Affected versions of Cisco ASA Software will vary depending on the specific vulnerability. Consult the "Software Versions and Fixes" section of this security advisory for more information about the affected versions.
Cisco PIX Security Appliances may be affected by some of the vulnerabilities described in this security advisory. Cisco PIX has reached the End of Software Maintenance Releases milestone. Cisco PIX Security Appliance customers are encouraged to migrate to Cisco ASA 5500 Series Adaptive Security Appliances.
Revision 1.1 - 2013-May-23 - Made Cisco ASA Software release 9.1(2) the recommended 9.1.x release because the previous 9.1.x recommended release (9.1.1.4) was reported to be unstable in certain configurations. This instability issue is fixed in release 9.1(2).
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco TelePresence TC and TE Software - Multiple Vulnerabilities
- http://tools.cisco.c...sa-20130619-tpc
Revision 1.0 / 2013 June 19 - "Summary: Cisco TelePresence TC and TE Software contain two vulnerabilities in the implementation of the Session Initiation Protocol (SIP) that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. Additionally, Cisco TelePresence TC Software contain an adjacent root access vulnerability that could allow an attacker on the same physical or logical Layer-2 network as the affected system to gain an unauthenticated root shell. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate the Cisco TelePresence TC and TE Software SIP Denial of Service vulnerabilities are available..."
CVE-2013-3377, CVE-2013-3378, CVE-2013-3379
___

Cisco Unified Computing System - Multiple Vulnerabilities
- http://tools.cisco.c...130424-ucsmulti
Revision 1.2 / 2013 June 6 - "Summary: Managed and standalone Cisco Unified Computing System (UCS) deployments contain one or more of the vulnerabilities:
- Cisco Unified Computing System LDAP User Authentication Bypass Vulnerability
- Cisco Unified Computing System IPMI Buffer Overflow Vulnerability
- Cisco Unified Computing Management API Denial of Service Vulnerability
- Cisco Unified Computing System Information Disclosure Vulnerability
- Cisco Unified Computing System KVM Authentication Bypass Vulnerability
Cisco has released free software updates that address these vulnerabilities..."
CVE-2013-1182, CVE-2013-1183, CVE-2013-1184, CVE-2013-1185, CVE-2013-1186
Revision 1.2 - 2013-June-06: Updated software availability status for first generation (C200/C2210/C250) UCS Stand Alone servers.
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 20 June 2013 - 06:06 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Web Security Appliance - multiple vulns
- http://tools.cisco.c...sa-20130626-wsa
Revision 1.0 / 2013 June 26 - Summary: Cisco IronPort AsyncOS Software for Cisco Web Security Appliance is affected by the following vulnerabilities:
- Two authenticated command injection vulnerabilities
- Management GUI Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of the two command injection vulnerabilities could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with elevated privileges.
Successful exploitation of the Management GUI Denial of Service Vulnerability could cause several critical processes to become unresponsive and make the affected system unstable. Cisco has released free software updates that address these vulnerabilities...

Cisco ASA Next-Generation Firewall - DoS vuln
- http://tools.cisco.c...a-20130626-ngfw
Revision 1.0 / 2013 June 26 - Summary: Cisco ASA Next-Generation Firewall (NGFW) Services contains a Fragmented Traffic Denial of Service (DoS) vulnerability. Successful exploitation of this vulnerability on the Cisco ASA NGFW could cause the device to reload or stop processing user traffic that has been redirected by the parent Cisco ASA to the ASA NGFW module for further inspection. There are no workarounds for this vulnerability, but mitigations are available. Cisco has released free software updates that address this vulnerability...

Cisco Content Security Management Appliance - multiple vulns
- http://tools.cisco.c...sa-20130626-sma
Revision 1.0 / 2013 June 26 - Summary: Cisco IronPort AsyncOS Software for Cisco Content Security Management Appliance is affected by the following vulnerabilities:
- Web Framework Authenticated Command Injection Vulnerability
- IronPort Spam Quarantine Denial of Service Vulnerability
- Management GUI Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of the Web Framework Authenticated Command Injection Vulnerability could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with elevated privileges.
Successful exploitation of either of the two denial of service vulnerabilities could cause several critical processes to become unresponsive and make the affected system unstable. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available...

Cisco Email Security Appliance - multiple vulns
- http://tools.cisco.c...sa-20130626-esa
Revision 1.0 / 2013 June 26 - Summary: Cisco IronPort AsyncOS Software for Cisco Email Security Appliance is affected by the following vulnerabilities:
- Web Framework Authenticated Command Injection Vulnerability
- IronPort Spam Quarantine Denial of Service Vulnerability
- Management GUI Denial of Service Vulnerability
Successful exploitation of the Web Framework Authenticated Command Injection Vulnerability could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with elevated privileges. Successful exploitation of either of the two denial of service vulnerabilities may cause several critical processes to become unresponsive and make the affected system unstable. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available...
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

Cisco Intrusion Prevention System Software - multiple vulns
- http://tools.cisco.c...sa-20130717-ips
2013 July 17 - "Summary: Cisco Intrusion Prevention System (IPS) Software is affected by the following vulnerabilities:
- Cisco IPS Software Malformed IP Packets Denial of Service Vulnerability
- Cisco IPS Software Fragmented Traffic Denial of Service Vulnerability
- Cisco IPS NME Malformed IP Packets Denial of Service Vulnerability
- Cisco IDSM-2 Malformed TCP Packets Denial of Service Vulnerability
The Cisco IPS Software Malformed IP Packets Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the MainApp process to become unresponsive. The Cisco IPS Software Fragmented Traffic Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the Analysis Engine process to become unresponsive due to memory corruption or could cause the reload of the affected system. The Cisco IPS NME Malformed IP Packets Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause a reload of a Cisco Intrusion Prevention System Network Module Enhanced (IPS NME). The Cisco IDSM-2 Malformed TCP Packets Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the kernel of the Cisco Catalyst 6500 Series Intrusion Detection System (IDSM-2) Module to become unresponsive. Successful exploitation of any of these vulnerabilities could result in a denial of service (DoS) condition. Cisco has released free software updates that address all the vulnerabilities in this advisory with the exception of the Cisco IDSM-2 Malformed TCP Packets Denial of Service Vulnerability. Customers running a vulnerable version of the Cisco IDSM-2 Module should refer to the "Workarounds" section of this advisory for available mitigations. Workarounds that mitigate the Cisco IPS Software Fragmented Traffic Denial of Service Vulnerability and Cisco IDSM-2 Malformed TCP Packets Denial of Service Vulnerability are available..."
See: Affected Products, Workarounds

CVE References:
- https://web.nvd.nist...d=CVE-2013-1218 - 7.8 (HIGH)
- https://web.nvd.nist...d=CVE-2013-1243 - 7.8 (HIGH)
- https://web.nvd.nist...d=CVE-2013-3410 - 7.8 (HIGH)
- https://web.nvd.nist...d=CVE-2013-3411 - 7.8 (HIGH)
___

Cisco Unified Communications Manager - multiple vulns
- http://tools.cisco.c...a-20130717-cucm
2013 July 17 - "Summary: Cisco Unified Communications Manager (Unified CM) contains multiple vulnerabilities that could be used together to allow an unauthenticated, remote attacker to gather user credentials, escalate privileges, and execute commands to gain full control of the vulnerable system. A successful attack could allow an unauthenticated attacker to access, create or modify information in Cisco Unified CM. On June 6, 2013, a French security firm, Lexfo, delivered a public presentation on VoIP security that included a demonstration of multiple vulnerabilities used to compromise Cisco Unified CM. During the presentation, the researchers demonstrated a multistaged attack that chained a number of vulnerabilities, which resulted in a complete compromise of the Cisco Unified CM server. The attack chain used the following types of vulnerabilities:
- Blind Structured Query Language (SQL) injection
- Command injection
- Privilege escalation
Cisco PSIRT greatly appreciates the opportunity to work with researchers on security vulnerabilities and welcomes the opportunity to review and assist in product reports. Cisco has released a Cisco Options Package (COP) file that addresses three of the vulnerabilities documented in this advisory. Cisco is currently investigating the remaining vulnerabilities. Workarounds that mitigate these vulnerabilities are not available..."

- https://secunia.com/advisories/54249/
2013-07-18
CVE Reference(s):
- https://web.nvd.nist...d=CVE-2013-3402 - 6.5
- https://web.nvd.nist...d=CVE-2013-3403 - 6.8
- https://web.nvd.nist...d=CVE-2013-3404 - 6.4
- https://web.nvd.nist...d=CVE-2013-3412 - 6.5
- https://web.nvd.nist...d=CVE-2013-3433 - 6.8
- https://web.nvd.nist...d=CVE-2013-3434 - 6.8

- https://www.us-cert....rity-Advisories
July 18, 2013
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 18 July 2013 - 12:08 PM.

[AplusWebMaster]

FYI...

Cisco Video Surveillance Mgr - multiple vulns
- http://tools.cisco.c...sa-20130724-vsm
2013 July 24 - "Summary: The Cisco Video Surveillance Manager (VSM) allows operations managers and system integrators to build customized video surveillance networks to meet their needs. Cisco VSM provides centralized configuration, management, display, and control of video from Cisco and third-party surveillance endpoints. Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system... Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available..."

- http://www.securityt....com/id/1028827
CVE Reference: CVE-2013-3429, CVE-2013-3430, CVE-2013-3431
Jul 24 2013
Impact: Disclosure of system information, Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes ...
Solution: The vendor has issued a fix (7.0.1)...
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Authenticated Command Injection Vuln in multiple Cisco Content Network and Video Delivery Products
- http://tools.cisco.c...-sa-20130731-cm
2013 July 31 - "Summary: Multiple Cisco content network and video delivery products contain a vulnerability when they are configured to run in central management mode. This vulnerability could allow an authenticated but unprivileged, remote attacker to execute arbitrary code on the affected system and on the devices managed by the affected system. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."
- http://www.securityt....com/id/1028852
- http://www.securityt....com/id/1028853
___

Cisco WAAS Central Manager Remote Code Execution Vuln
- http://tools.cisco.c...20130731-waascm
2013 July 31 - "Summary: Cisco Wide Area Application Services (WAAS) when configured as Central Manager (CM), contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the affected system. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."
- http://www.securityt....com/id/1028851
___

Cisco Unified Customer Voice Portal Software ...
- http://tools.cisco.c...sa-20130508-cvp
Revision 1.2 - Last Updated  2013 July 30 - Added location of patches for 8.x releases...
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

Cisco - OSPF LSA Manipulation vuln in multiple products
- http://tools.cisco.c...0130801-lsaospf
2013 August 1 - "Summary: Multiple Cisco products are affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. This vulnerability could allow an unauthenticated attacker to take full control of the OSPF Autonomous System (AS) domain routing table, blackhole traffic, and intercept traffic. The attacker could trigger this vulnerability by injecting crafted OSPF packets. Successful exploitation could cause flushing of the routing table on a targeted router, as well as propagation of the crafted OSPF LSA type 1 update throughout the OSPF AS domain... Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available..."
(See "Affected Products" at the URL above.)

Cisco PIX Firewall OSPF...
- http://www.securityt....com/id/1028858
Solution: The vendor has issued a fix (8.4.6.5, 9.0.3, 9.1.2.5)...

Cisco Firewall Services Module OSPF...
- http://www.securityt....com/id/1028859

Cisco NX-OS OSPF...
- http://www.securityt....com/id/1028860

Cisco ASR Router OSPF...
- http://www.securityt....com/id/1028861

Cisco ASA OSPF...
- http://www.securityt....com/id/1028862

Cisco IOS OSPF...
- http://www.securityt....com/id/1028863
Solution: The vendor has issued a fix.
A patch matrix is available in the vendor's advisory...
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco TelePresence System Default Credentials vuln
- http://tools.cisco.c...-sa-20130807-tp
Revision 1.2 - 2013-August-09 - Changes to "Vulnerable Products"/"Software Versions and Fixes" sections

Cisco OSPF LSA Manipulation vuln in multiple products
- http://tools.cisco.c...0130801-lsaospf
Revision 1.1 - 2013-August-05 - Fixed broken links
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Unified Communications Manager - multiple vulns
- http://tools.cisco.c...a-20130821-cucm
2013 August 21 - "Summary: Cisco Unified Communications Manager (Unified CM) contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to modify data, execute arbitrary commands, or cause a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1028938
CVE Reference: CVE-2013-3459, CVE-2013-3460, CVE-2013-3461, CVE-2013-3462
Aug 21 2013
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.1(x) ,8.5(x) ,8.6(x), 9.0(x), 9.1(x)...

Cisco Unified Communications Manager IM and Presence Service DoS vuln
- http://tools.cisco.c...sa-20130821-cup
2013 August 21 - "Summary: Cisco Unified Communications Manager IM and Presence Service contains a denial of service (DoS) vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of this vulnerability could cause an interruption of presence services. Cisco has released free software updates that address this vulnerability. There are no workarounds available to mitigate exploitation of this vulnerability..."
- http://www.securityt....com/id/1028937
CVE Reference: CVE-2013-3453
Aug 21 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 9.1(2)...

Cisco Prime Central for Hosted Collaboration Solution Assurance DoS vuln
- http://tools.cisco.c...sa-20130821-hcm
2013 August 21 - "Summary: Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of these vulnerabilities could interrupt the monitoring of voice services and exhaust system resources.  Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1028936
CVE Reference: CVE-2013-3387, CVE-2013-3388, CVE-2013-3389, CVE-2013-3390
Aug 21 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 9.1 and prior...
 

:ph34r: :ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Secure Access Control Server Remote Command Execution vuln
- http://tools.cisco.c...sa-20130828-acs
2013 August 28 - "Summary: A vulnerability in the EAP-FAST authentication module of Cisco Secure Access Control Server (ACS) versions 4.0 through 4.2.1.15 could allow an unauthenticated, remote attacker to execute arbitrary commands on the Cisco Secure ACS server. This vulnerability is only present when Cisco Secure ACS is configured as a RADIUS server. The vulnerability is due to improper parsing of user identities used for EAP-FAST authentication. An attacker could exploit this vulnerability by sending crafted EAP-FAST packets to an affected device. An exploit could allow the attacker to execute arbitrary commands on the Cisco Secure ACS server and take full control of the affected server. There are no workarounds for this vulnerability.
Cisco has released free software updates that address this vulnerability..."
- https://secunia.com/advisories/54610/
Release Date: 2013-08-29
Criticality: Moderately Critical
Where: From local network
Impact: System access
Software: Cisco Secure ACS 4.x
CVE Reference: https://web.nvd.nist...d=CVE-2013-3466 - 9.3 (HIGH)
... vulnerability is reported in versions 4.0 through 4.2.1.15 running on Windows.
Solution: Update to version 4.2.1.15.11.
Original Advisory: Cisco (CSCui57636):
http://tools.cisco.c...sa-20130828-acs

Cisco Unified Customer Voice Portal Software - multiple vulns
- http://tools.cisco.c...sa-20130508-cvp
Revision 1.3 / 2013-August-28 / Updated Workarounds section.
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 29 August 2013 - 09:19 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco WebEx Recording Format and Advanced Recording Format Players - multiple vulns
- http://tools.cisco.c...-20130904-webex
2013 September 4 - "Summary: Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to crash an affected player, and in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on the computer of an on-line meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. Cisco has updated affected versions of the Cisco WebEx Business Suite meeting sites, Cisco WebEx 11 meeting sites, Cisco WebEx Meetings Server, and Cisco WebEx WRF and ARF Players to address these vulnerabilities. Cisco has released free software updates that address these vulnerabilities... there are no workarounds for the vulnerabilities detailed in this advisory..."
- http://www.securityt....com/id/1028975
CVE Reference:
- https://web.nvd.nist...d=CVE-2013-1115 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2013-1116 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2013-1117 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2013-1118 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2013-1119 - 9.3 (HIGH)
Sep 4 2013
Impact: Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Solution: The vendor has issued a fix:
Cisco WebEx Business Suite (WBS28) client builds T28.8 (28.8 ) or later
Cisco WebEx Business Suite (WBS27) client builds 27.32.16 (T27LDSP32EP16) or later
Cisco WebEx 11 1.2.6.0 (1.2 SP6) builds T28.8 (28.8 ) or later ...

- https://secunia.com/advisories/54724/
Release Date: 2013-09-05
Criticality: Highly Critical
Where: From remote
Impact: System access
Solution Status: Vendor Patch
CVE Reference(s): CVE-2013-1115, CVE-2013-1116, CVE-2013-1117, CVE-2013-1118, CVE-2013-1119
Solution: Update to version 28.8 or 27.32.16.
Original Advisory:
http://tools.cisco.c...-20130904-webex
http://tools.cisco.c...x?alertId=30533
http://tools.cisco.c...x?alertId=30534
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 06 September 2013 - 11:17 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Prime Data Center Network Manager - Multiple Vulnerabilities
- http://tools.cisco.c...a-20130918-dcnm
2013 September 18 - "Summary: Cisco Prime Data Center Network Manager (DCNM) contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to disclose file components, and access text files on an affected device. Various components of Cisco Prime DCNM are affected.  These vulnerabilities can be exploited independently on the same device; however, a release that is affected by one of the vulnerabilities may not be affected by the others. Cisco Prime DCNM is affected by the following vulnerabilities:
- Cisco Prime DCNM Information Disclosure Vulnerability
- Cisco Prime DCNM Remote Command Execution Vulnerabilities
- Cisco Prime DCNM XML External Entity Injection Vulnerability
Cisco has released free software updates that address these vulnerabilities. There are currently no workarounds that mitigate these vulnerabilities..."
Revision 1.1 - 2013-Sep-19 ...Updated "Software Versions and Fixes" section
- http://www.securityt....com/id/1029049
CVE Reference: CVE-2013-5486, CVE-2013-5487, CVE-2013-5490
Sep 18 2013
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.1, 4.2, 5.0, 5.1, 5.2, 6.1 ...
Solution:   The vendor has issued a fix (6.2(3))...
___

Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance vuln
- http://tools.cisco.c...-sa-20130918-pc
2013 September 18 - "Summary: A vulnerability in the web framework of Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance could allow an unauthenticated, remote attacker to access sensitive information on the system. The vulnerability is due to improper user authentication and inadequate session management. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HTTP request to the web user interface. Successful exploitation of this vulnerability may reveal sensitive information, including user credentials. Cisco has released a free software update that addresses this vulnerability. There are currently no workarounds that mitigate this vulnerability..."
- http://www.securityt....com/id/1029050
CVE Reference: CVE-2013-3473
Sep 18 2013
Impact: Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.0.1, 1.1 ...
Solution: The vendor has issued a fix (9.1.1)...
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 20 September 2013 - 09:31 AM.

[AplusWebMaster]

FYI...

Cisco IOS Software Security Advisory Bundle - Semiannual
- http://www.cisco.com..._ERP_sep13.html
Sep 25, 2013 - "Cisco released its semiannual Cisco IOS Software Security Advisory Bundled Publication on September 25, 2013... Cisco releases bundles of Cisco IOS Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year. The publication includes eight Security Advisories that all address vulnerabilities in Cisco IOS Software. Exploits of the individual vulnerabilities could result in a denial of service (DoS) condition, interface queue wedge, or a device reload. Use the Cisco IOS Software Checker* to quickly determine whether a given Cisco IOS Software release is exposed to Cisco product vulnerabilities..."
* http://tools.cisco.c...ectIOSVersion.x
___

Cisco IOS Software Multicast Network Time Protocol DoS Vulnerability
- http://tools.cisco.c...sa-20130925-ntp
Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability
- http://tools.cisco.c...sa-20130925-ike
Cisco IOS Software IPv6 Virtual Fragmentation Reassembly DoS Vulnerability
- http://tools.cisco.c...0130925-ipv6vfr
Cisco IOS Software DHCP DoS Vulnerability
- http://tools.cisco.c...a-20130925-dhcp
Cisco IOS Software Zone-Based Firewall and Content Filtering Vulnerability
- http://tools.cisco.c...sa-20130925-cce
Cisco IOS Software Queue Wedge DoS Vulnerability
- http://tools.cisco.c...-20130925-wedge
Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability
- http://tools.cisco.c...a-20130925-rsvp
Cisco IOS Software Network Address Translation Vulnerabilities
- http://tools.cisco.c...sa-20130925-nat

- http://www.securityt....com/id/1029087
CVE Reference: CVE-2013-5472, CVE-2013-5473, CVE-2013-5474, CVE-2013-5475, CVE-2013-5476, CVE-2013-5477, CVE-2013-5478, CVE-2013-5479, CVE-2013-5480, CVE-2013-5481
Sep 25 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
 

:ph34r:

Edited by AplusWebMaster, 25 September 2013 - 09:18 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS XR Software Memory Exhaustion Vulnerability
- http://tools.cisco.c...-20131002-iosxr
2013 October 2 - "Summary: Cisco IOS XR Software version 4.3.1 contains a vulnerability that could result in complete packet memory exhaustion.  Successful exploitation could render critical services on the affected device unable to allocate packets resulting in a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available..."

- http://www.securityt....com/id/1029123
CVE Reference: https://web.nvd.nist...d=CVE-2013-5503 - 7.8 (HIGH)
Oct 2 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): XR 4.3.1 ...
Solution: The vendor has issued a fix (XR 4.3.2)...
 

:ph34r:

Edited by AplusWebMaster, 04 October 2013 - 01:56 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Firewall Services - Multiple Vulnerabilities
- http://tools.cisco.c...a-20131009-fwsm
2013 Oct 9 - "Summary: Cisco Firewall Services Module (FWSM) Software for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers is affected by the following vulnerabilities:
    Cisco FWSM Command Authorization Vulnerability
    SQL*Net Inspection Engine Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the other. Successful exploitation of the Cisco FWSM Command Authorization Vulnerability may result in a complete compromise of the confidentiality, integrity and availability of the affected system. Successful exploitation of the SQL*Net Inspection Engine Denial of Service Vulnerability may result in a reload of an affected device, leading to a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available..."
- http://www.securityt....com/id/1029163
CVE Reference: CVE-2013-5506, CVE-2013-5508
Oct 9 2013
Impact: Denial of service via network, Disclosure of system information, Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to versions 3.2(27), 4.1(14)...
Solution: The vendor has issued a fix (3.2(27), 4.1(14))...

Cisco ASA Software - Multiple Vulnerabilities
- http://tools.cisco.c...sa-20131009-asa
Last Updated 2013 Oct 10 - Revision 1.1 - "Summary: Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities:
    IPsec VPN Crafted ICMP Packet Denial of Service Vulnerability
    SQL*Net Inspection Engine Denial of Service Vulnerability
    Digital Certificate Authentication Bypass Vulnerability
    Remote Access VPN Authentication Bypass Vulnerability
    Digital Certificate HTTP Authentication Bypass Vulnerability
    HTTP Deep Packet Inspection Denial of Service Vulnerability
    DNS Inspection Denial of Service Vulnerability
    AnyConnect SSL VPN Memory Exhaustion Denial of Service Vulnerability
    Clientless SSL VPN Denial of Service Vulnerability ...
Cisco has released free software updates that address these vulnerabilities. Workarounds are available for some of the vulnerabilities..."
Revision 2.2 - 2013-Dec-13 - Corrected some information about the SSL VPN Web Portal Denial of Service Vulnerability - CSCua22709
- http://www.securityt....com/id/1029162
CVE Reference: CVE-2013-3415, CVE-2013-5507, CVE-2013-5508, CVE-2013-5509, CVE-2013-5510, CVE-2013-5511, CVE-2013-5512, CVE-2013-5513, CVE-2013-5515
Oct 9 2013
Impact: Denial of service via network, Host/resource access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
Cisco ASA 5510, Cisco ASA 5520, Cisco ASA 5540, and Cisco ASA 5550 are not affected...
Solution:   The vendor has issued a fix (7.2(5.12), 8.2(5.46), 8.3(2.39), 8.4(7), 8.5(1.18), 8.6(1.12), 8.7(1.7), 9.0(3.6), 9.1(2.8))...
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 17 December 2013 - 10:09 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS XR Software Route Processor DoS vuln
- http://tools.cisco.c...-20131023-iosxr
2013 Oct 23 - "Summary: Cisco IOS XR Software Releases 3.3.0 to 4.2.0 contain a vulnerability when handling fragmented packets that could result in a denial of service (DoS) condition of the Cisco CRS Route Processor cards listed in the "Affected Products" section of this advisory... Customers that are running version 4.2.1 or later of Cisco IOS XR Software, or that have previously installed the Software Maintenance Upgrades (SMU) for Cisco bug ID CSCtz62593 are not affected by this vulnerability. Cisco has released free software updates that address this vulnerability..."
- https://secunia.com/advisories/55468/
Release Date: 2013-10-24
Criticality: Less Critical
Where: From local network
Impact: DoS
Operating System: Cisco IOS XR 3.x, 4.x
CVE Reference: https://web.nvd.nist...d=CVE-2013-5549 - 7.1 (HIGH)
... vulnerability is reported in versions 3.8.1 through 4.2.0....
Solution: Apply update...
Original Advisory: Cisco (CSCuh30380):
http://tools.cisco.c...-20131023-iosxr
http://tools.cisco.c...x?alertId=31369

Multiple Cisco Products - Apache Struts 2 Command Execution vuln
- http://tools.cisco.c...0131023-struts2
2013 Oct 23 - "Summary: Multiple Cisco products include an implementation of the Apache Struts 2 component that is affected by a remote command execution vulnerability... Cisco has released free software updates that address this vulnerability for all the affected products -except- Cisco Business Edition 3000. Cisco Business Edition 3000 should contact their Cisco representative for available options. Workarounds that mitigate this vulnerability are not available..."
- https://secunia.com/advisories/55467/
Release Date: 2013-10-24
Criticality: Moderately Critical
Where: From local network
Impact: Security Bypass
Operating System: Cisco Unified SIP Proxy (USP)
CVE Reference: https://web.nvd.nist...d=CVE-2013-2251 - 9.3 (HIGH)
... vulnerability is reported in versions prior to 8.5(5).
Solution: Update to version 8.5(5).
Original Advisory: Cisco (CSCui40582):
http://tools.cisco.c...0131023-struts2

Cisco Identity Services Engine - Multiple vulns
- http://tools.cisco.c...sa-20131023-ise
2013 Oct 23 - "Summary: Cisco Identity Services Engine (ISE) contains the following vulnerabilities:
    Cisco ISE Authenticated Arbitrary Command Execution Vulnerability
    Cisco ISE Support Information Download Authentication Bypass Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the other... Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available..."
- https://secunia.com/advisories/55469/
Release Date: 2013-10-24
Criticality: Moderately Critical
Where: From local network
Impact:Security Bypass, System access
Operating System: Cisco Identity Services Engine (ISE) 1.x
CVE Reference(s):
- https://web.nvd.nist...d=CVE-2013-2251 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2013-5530 - 9.0 (HIGH)
- https://web.nvd.nist...d=CVE-2013-5531 - 5.0
Solution: Apply patch....
Original Advisory: Cisco (CSCty20405, CSCuh81511, CSCui22841):
http://tools.cisco.c...0131023-struts2
http://tools.cisco.c...sa-20131023-ise
http://tools.cisco.c...x?alertId=31294
http://tools.cisco.c...x?alertId=31295
 

:ph34r: :ph34r: :ph34r:

Edited by AplusWebMaster, 25 October 2013 - 01:16 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS XE Software for 1000 Series Aggregation Services Routers - multiple vulns  
- http://tools.cisco.c...0131030-asr1000
2013 Oct 30 - "Summary: Cisco IOS XE Software for 1000 Series Aggregation Services Routers (ASR) contains the following denial of service (DoS) vulnerabilities:
    Cisco IOS XE Software Malformed ICMP Packet Denial of Service Vulnerability
    Cisco IOS XE Software PPTP Traffic Denial of Service Vulnerability
    Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability
    Cisco IOS XE Software Malformed EoGRE Packet Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of any of these vulnerabilities could allow an unauthenticated remote attacker to trigger a reload of the embedded services processors (ESP) card or the route processor (RP) card, causing an interruption of services. Repeated exploitation could result in a sustained DoS condition.
Note: Cisco IOS Software and Cisco IOS-XR Software are not affected by these vulnerabilities.
Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1029277
CVE Reference: CVE-2013-5543, CVE-2013-5545, CVE-2013-5546, CVE-2013-5547
Oct 30 2013
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): IOS XE for 1000 Series ASR; 3.4.x, 3.5.x, 3.7.x, 3.8.x, 3.9.x ...
Solution: The vendor has issued a fix (3.4.2S, 3.5.1S, 3.7.3S, 3.8.1S, 3.9.2S)...
 

:ph34r:

Edited by AplusWebMaster, 31 October 2013 - 04:01 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco WAAS Mobile Remote Code Execution vuln
- http://tools.cisco.c...-20131106-waasm
2013 Nov 6 - "Summary: Cisco Wide Area Application Services (WAAS) Mobile contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the Cisco WAAS Mobile server with the privileges of the Microsoft Internet Information Services (IIS) web server. Cisco has released free software updates that address this vulnerability..."
- http://www.securityt....com/id/1029309
CVE Reference: CVE-2013-5554
Nov 6 2013
Impact: Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 3.5.5...
Solution: The vendor has issued a fix (3.5.5)...

Cisco TelePresence VX Clinical Assistant Administrative Password Reset vuln
- http://tools.cisco.c...-20131106-tvxca
2013 Nov 6 - "Summary: A vulnerability in the WIL-A module of Cisco TelePresence VX Clinical Assistant could allow an unauthenticated, remote attacker to log in as the admin user of the device using a blank password. The vulnerability is due to a coding error that resets the password for the admin user to a blank password on every reboot. An attacker could exploit this vulnerability by logging in to the administrative interface as the admin user with a blank password. Cisco has released free software updates that address this vulnerability..."
- http://www.securityt....com/id/1029307
CVE Reference: CVE-2013-5558
Nov 6 2013
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): VX Clinical Assistant version 1.2 only ...
Solution: The vendor has issued a fix (TelePresence VX Clinical Assistant software version 1.21)...

Cisco IOS Software Session Initiation Protocol DoS vuln
- http://tools.cisco.c...sa-20131106-sip
2013 Nov 6 - "Summary: A vulnerability exists in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or cause memory leaks that may result in system instabilities. To exploit this vulnerability, affected devices must be configured to process SIP messages. Limited Cisco IOS Software releases are affected. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to the vulnerability..."
Rev 1.1 2013-Nov-15 Minor changes to wording of "Disabling SIP Listening Ports" section in Workarounds.
- http://www.securityt....com/id/1029308
CVE Reference: CVE-2013-5553
Nov 6 2013
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 15.1GC ...
Solution: The vendor has issued a fix (15.1M, 15.1(4)M7)...
 

:ph34r: :ph34r: :ph34r:

Edited by AplusWebMaster, 18 November 2013 - 10:37 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Small Business Devices - Undocumented Test Interface
- http://tools.cisco.c...sa-20140110-sbd
Jan 10, 2014 - "Summary: A vulnerability in the Cisco WAP4410N Wireless-N Access Point, Cisco WRVS4400N Wireless-N Gigabit Security Router, and the Cisco RVS4000 4-port Gigabit Security Router could allow an unauthenticated, remote attacker to gain root-level access to an affected device. Cisco will release free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available... The following products are affected by the vulnerabilities that are described in this advisory:
• Cisco RVS4000 4-port Gigabit Security Router running firmware version 2.0.3.2 and prior
• Cisco WRVS4400N Wireless-N Gigabit Security Router hardware version 1.0 and 1.1 running firmware version 1.1.13 and prior
• Cisco WRVS4400N Wireless-N Gigabit Security Router hardware version 2.0 running firmware version 2.0.2.1 and prior
• Cisco WAP4410N Wireless-N Access Point running firmware version 2.0.6.1 and prior..."
Rev 1.3 - 2014-Jan-28 - Added fixed software version information. Added Cisco Small Business Support Center contact information.

- https://web.nvd.nist...d=CVE-2014-0659 - 10.0 (HIGH)
Last revised: 01/13/2014
 

:ph34r:

Edited by AplusWebMaster, 13 February 2014 - 05:36 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Secure Access Control System - multiple vulns
- http://tools.cisco.c...-20140115-csacs
2014 Jan 15 - "Summary: Cisco Secure Access Control System (ACS) is affected by the following vulnerabilities:
• Cisco Secure ACS RMI Privilege Escalation Vulernability
• Cisco Secure ACS RMI Unauthenticated User Access Vulnerability
• Cisco Secure ACS Operating System Command Injection Vulnerability
Cisco Secure ACS uses the Remote Method Invocation (RMI) interface for internode communication using TCP ports 2020 and 2030. These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the other. Cisco has released free software updates that address these vulnerabilities...
Affected Products/ Vulnerable Products: All releases of Cisco Secure ACS -prior- to release 5.5 are affected by the RMI-based vulnerabilities in this advisory. All releases of Cisco Secure ACS -prior- to ACS 5.4 patch 3 are affected by the OS command injection vulnerability in this advisory..."
(More detail at the cisco URL above.)
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco TelePresence Video Communication Server SIP DoS vuln
- http://tools.cisco.c...sa-20140122-vcs
2014 Jan 22 - "Summary: Cisco TelePresence Video Communication Server (VCS) contains a vulnerability that could allow an unauthenticated, remote attacker to trigger the failure of several critical processes which may cause active call to be dropped and prevent users from making new calls until the affected system is reloaded. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."
- http://www.securityt....com/id/1029655
- https://web.nvd.nist...d=CVE-2014-0662 - 7.1 (HIGH)
Jan 22 2014

Cisco TelePresence System Software Command Execution vuln
- http://tools.cisco.c...sa-20140122-cts
2014 Jan 22 - "Summary: Cisco TelePresence System Software contains a vulnerability in the System Status Collection Daemon (SSCD) code that could allow an unauthenticated, adjacent attacker to execute arbitrary commands with the privileges of the root user. Cisco has released free software updates that address this vulnerability. No workarounds that mitigate this vulnerability are available..."
- http://www.securityt....com/id/1029656
- https://web.nvd.nist...d=CVE-2014-0661 - 8.3 (HIGH)
Jan 22 2014

Cisco TelePresence ISDN Gateway D-Channel DoS vuln
- http://tools.cisco.c...20140122-isdngw
2014 Jan 22 - "Summary: Cisco TelePresence ISDN Gateway contains a vulnerability that could allow an unauthenticated, remote attacker to trigger the drop of the data channel (D-channel), causing all calls to be terminated and preventing users from making new calls. Cisco has released free software updates that address this vulnerability. No workarounds that mitigate this vulnerability are available..."
- http://www.securityt....com/id/1029657
- https://web.nvd.nist...d=CVE-2014-0660 - 7.1 (HIGH)
Jan 22 2014
 

:ph34r: :ph34r: :ph34r:

Edited by AplusWebMaster, 23 January 2014 - 01:36 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Unauthorized Access Vulnerability in Cisco Unified SIP Phone 3905
- http://tools.cisco.c...-20140219-phone
2014 Feb 19
Summary: A vulnerability in the Cisco Unified SIP Phone 3905 could allow an unauthenticated, remote attacker to gain root-level access to an affected device. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available...
- http://www.securityt....com/id/1029789
CVE Reference: CVE-2014-0721
Feb 20 2014
Impact: Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes...
Solution: The vendor has issued a fix (Phone 3905 Firmware Release 9.4(1))...

Cisco UCS Director Default Credentials vuln
- http://tools.cisco.c...a-20140219-ucsd
2014 Feb 19
Summary: A vulnerability in Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to take complete control of the affected device. The vulnerability is due to a default root user account created during installation. An attacker could exploit this vulnerability by accessing the server command-line interface (CLI) remotely using the default account credentials. An exploit could allow the attacker to log in with the default credentials, which provide full administrative rights to the system. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available...
- http://www.securityt....com/id/1029788
CVE Reference: CVE-2014-0709
Feb 20 2014
Impact: User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes...  
Version(s): Prior to Director 4.0.0.3 HOTFIX...

Multiple Vulnerabilities in Cisco IPS Software
- http://tools.cisco.c...sa-20140219-ips
2014 Feb 19
Summary: Cisco Intrusion Prevention System (IPS) Software is affected by the following vulnerabilities:
    Cisco IPS Analysis Engine Denial of Service Vulnerability
    Cisco IPS Control-Plane MainApp Denial of Service Vulnerability
    Cisco IPS Jumbo Frame Denial of Service Vulnerability
The Cisco IPS Analysis Engine Denial of Service Vulnerability and the Cisco IPS Jumbo Frame Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the Analysis Engine process to become unresponsive or crash. When this occurs, the Cisco IPS will stop inspecting traffic. The Cisco IPS Control-Plane MainApp Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the MainApp process to become unresponsive and prevent it from executing several tasks including alert notification, event store management, and sensor authentication. The Cisco IPS web server will also be unavailable while the MainApp process is unresponsive, and other processes such as the Analysis Engine process may not work properly.Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate some of the vulnerabilities are available...
- http://www.securityt....com/id/1029787
Feb 20 2014
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.x, 7.0, 7.1, 7.2 ...
Solution: The vendor has issued a fix (7.1(8p2)E4, 7.2(2)E4)...

Cisco Firewall Services Module Cut-Through Proxy DoS vuln
- http://tools.cisco.c...a-20140219-fwsm
2014 Feb 19
Summary: Cisco Firewall Services Module (FWSM) Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to a race condition when releasing the memory allocated by the cut-through proxy function. An attacker could exploit this vulnerability by sending traffic to match the condition that triggers cut-through proxy authentication. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate the vulnerability are not available...
- http://www.securityt....com/id/1029784
CVE Reference: CVE-2014-0710
Feb 19 2014
Fix Available:  Yes  Vendor Confirmed:  Yes ...  
Impact: A remote user can cause the target device to reload.
Solution: The vendor has issued a fix (3.2(28), 4.1(15))...
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Prime Infrastructure Command Execution vuln
- http://tools.cisco.c...-sa-20140226-pi
2014 Feb 26 - "Summary: A vulnerability in Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands with root-level privileges. The vulnerability is due to improper validation of URL requests. An attacker could exploit this vulnerability by requesting an unauthorized command via a specific URL. Successful exploitation could allow an authenticated attacker to execute system commands with root-level privileges. Cisco has released free software updates that address this vulnerability. A software patch that addresses this vulnerability in all affected versions is also available. Workarounds that mitigate this vulnerability are not available..."
- http://www.securityt....com/id/1029832
CVE Reference: https://web.nvd.nist...d=CVE-2014-0679 - 9.0
Feb 26 2014
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.2, 1.3, 1.4, 2.0 ...
Impact: A remote authenticated user can execute arbitrary commands on the target system with root privileges.
Solution: The vendor has issued a fix (1.3.0.20-2, 1.4.0.45-2, 2.0.0.0.294-2)...
 

:ph34r:

Edited by AplusWebMaster, 28 February 2014 - 11:32 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco Wireless LAN Controllers - multiple vulns
- http://tools.cisco.c...sa-20140305-wlc
2014 March 5 - "Summary: The Cisco Wireless LAN Controller (WLC) product family is affected by the following vulnerabilities:
    Cisco Wireless LAN Controller Denial of Service Vulnerability
    Cisco Wireless LAN Controller Unauthorized Access to Associated Access Points Vulnerability
    Cisco Wireless LAN Controller IGMP Version 3 Denial of Service Vulnerability
    Cisco Wireless LAN Controller MLDv2 Denial of Service Vulnerability
    Cisco Wireless LAN Controller Crafted Frame Denial of Service Vulnerability
    Cisco Wireless LAN Controller Crafted Frame Denial of Service Vulnerability
Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1029865
CVE Reference: CVE-2014-0701, CVE-2014-0703, CVE-2014-0704, CVE-2014-0705, CVE-2014-0706, CVE-2014-0707
Mar 5 2014
Impact: Denial of service via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
Solution: The vendor has issued a fix (7.0.250.0, 7.4.121.0, 7.6.100.0)...
___

Cisco Small Business Router Password Disclosure Vuln
- http://tools.cisco.c...sa-20140305-rpd
2014 March 5 - "Summary: A vulnerability in the web management interface of the Cisco RV110W Wireless-N VPN Firewall, the Cisco RV215W Wireless-N VPN Router, and the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain administrative-level access to the web management interface of the affected device. The vulnerability is due to improper handling of authentication requests by the web framework. An attacker could exploit this vulnerability by intercepting, modifying and resubmitting an authentication request. Successful exploitation of this vulnerability could give an attacker administrative-level access to the web-based administration interface on the affected device. Cisco has released free software updates that address this vulnerability.There are currently no known workarounds that mitigate this vulnerability..."
- http://www.securityt....com/id/1029866
CVE Reference: CVE-2014-0683
Mar 5 2014
Impact: Disclosure of authentication information, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): RV110W, RV215W, CVR100W ...
Solution: The vendor has issued a fix.
Cisco CVR100W firmware version 1.0.1.21
Cisco RV110W firmware version 1.2.0.10
Cisco RV215W firmware version 1.1.0.6 ...
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco AsyncOS Software Code Execution vuln
- http://tools.cisco.c...0140319-asyncos
2014 March 19 - "Summary: Cisco AsyncOS Software for Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available..."
- http://www.securityt....com/id/1029937
CVE Reference: https://web.nvd.nist...d=CVE-2014-2119 - 8.5 (HIGH)
Mar 19 2014
Impact: Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.1 and prior, 7.3, 7.5, 7.6, 7.8, 8.0 for ESA; 7.2 and prior, 7.7, 7.8, 7.9, 8.0, 8.1 for SMA...
Impact: A remote authenticated user can execute arbitrary code on the target system with root privileges.
Solution: The vendor has issued a fix (7.9.1-110, 8.1.1-013 for SMA; 7.6.3-023, 8.0.1-023 for ESA).
 

:ph34r:

Edited by AplusWebMaster, 21 March 2014 - 03:28 PM.

[AplusWebMaster]

FYI...

Cisco IOS Software Security Advisory Bundled Publication - Semiannual
- http://www.cisco.com..._ERP_mar14.html
March 26, 2014 - "Cisco released its semiannual Cisco IOS Software Security Advisory Bundled Publication... In direct response to customer feedback, Cisco releases bundles of Cisco IOS Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year. The publication includes 5 Security Advisories that address vulnerabilities in Cisco IOS Software and 1 Security Advisory that addresses a vulnerability in the Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks. Exploits of the individual vulnerabilities could result in a denial of service (DoS) condition..."
(Links to individual advisories at the URL above.)
___

Cisco IOS SSL VPN HTTP Processing Flaw Lets Remote Users Deny Service
- http://www.securityt....com/id/1029962

Cisco IOS IPv6 Stack Bug Lets Remote Users Deny Service
- http://www.securityt....com/id/1029961

Cisco IOS Bugs in DNS ALG and TCP Input Module Let Remote Users Deny Service
- http://www.securityt....com/id/1029960

Cisco IOS IKEv2 Processing Flaw Lets Remote Users Deny Service
- http://www.securityt....com/id/1029959

Cisco 7600 Series Route Switch Processor 720 FPGA Bug Lets Remote Users Deny Service
- http://www.securityt....com/id/1029958

Cisco IOS SIP Processing Flaw Lets Remote Users Deny Service
- http://www.securityt....com/id/1029957
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 26 March 2014 - 04:18 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

OpenSSL Heartbeat Extension Vuln - Multiple Cisco Products
- http://tools.cisco.c...0409-heartbleed
Last Updated 2014 April 10 Rev 1.1 - "Summary: Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server. The vulnerability is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension. An attacker could exploit this vulnerability by implementing a malicious TLS or Datagram Transport Layer Security (DTLS) client, if trying to exploit the vulnerability on an affected server, or a malicious TLS or DTLS server, if trying to exploit the vulnerability on an affected client. An exploit could send a specially crafted TLS or DTLS heartbeat packet to the connected client or server. An exploit could allow the attacker to disclose a limited portion of memory from a connected client or server for every heartbeat packet sent. The disclosed portions of memory could contain sensitive information that may include private keys and passwords. This advisory will be updated as additional information becomes available. Cisco will release free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities may be available..."
Also see: http://www.spywarein...ed/#entry787845

 

- http://blogs.cisco.c...nd-mitigations/
Apr 9, 2014
___

 

Cisco ASA Software - multiple vulns
- http://tools.cisco.c...sa-20140409-asa

Last Updated 2014 April 18 - "Summary: Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities:
• Cisco ASA ASDM Privilege Escalation Vulnerability
• Cisco ASA SSL VPN Privilege Escalation Vulnerability
• Cisco ASA SSL VPN Authentication Bypass Vulnerability
• Cisco ASA SIP Denial of Service Vulnerability
These vulnerabilities are independent of one another; a release that is affected by one of the vulnerabilities may not be affected by the others... Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available for some of the vulnerabilities...
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 21 April 2014 - 12:06 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Multiple Cisco Products - OpenSSL Heartbeat Extension Vulnerability
- http://tools.cisco.c...0409-heartbleed
Last Updated: 2014 April 18 - "Summary: Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server. The vulnerability is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension. An attacker could exploit this vulnerability by implementing a malicious TLS or Datagram Transport Layer Security (DTLS) client, if trying to exploit the vulnerability on an affected server, or a malicious TLS or DTLS server, if trying to exploit the vulnerability on an affected client. An exploit could send a specially crafted TLS or DTLS heartbeat packet to the connected client or server. An exploit could allow the attacker to disclose a limited portion of memory from a connected client or server for every heartbeat packet sent. The disclosed portions of memory could contain sensitive information that may include private keys and passwords. Please note that the devices that are affected by this vulnerability are the devices acting as an SSL server terminating SSL connections or devices acting as an SSL Client initiating an SSL connection. Devices that are simply traversed by SSL traffic without terminating it are not affected. This advisory will be updated as additional information becomes available. Cisco will release free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities may be available..."
Revision 1.10 - 2014-April-18 - Updated the Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable, and Software Versions and Fixes sections.
 

:ph34r:

Edited by AplusWebMaster, 21 April 2014 - 12:01 PM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco TelePresence TC and TE Software - multiple vulns
- http://tools.cisco.c...a-20140430-tcte
2014 April 30 - "Summary: Cisco TelePresence TC and TE Software are affected by the following vulnerabilities:
• Six Session Initiation Protocol (SIP) denial of service vulnerabilities
• Cisco TelePresence TC and TE Software DNS Buffer Overflow Vulnerability
• Cisco TelePresence TC and TE Software Input Validation Vulnerability
• Cisco TelePresence TC and TE Software tshell Command Injection Vulnerability
• Cisco TelePresence TC and TE Software Heap Overflow Vulnerability
• Cisco TelePresence TC and TE Software U-Boot Buffer Overflow Vulnerability
• Cisco TelePresence TC and TE Software Unauthenticated Serial Port Access Vulnerability
• Cisco TelePresence TC H.225 Denial of Service Vulnerability
Successful exploitation of these vulnerabilities could allow an attacker to cause the affected system to reload, execute arbitrary commands or obtain privileged access to the affected system... Cisco has released free software updates that address these vulnerabilities. There are no workarounds that mitigate these vulnerabilities..."
- http://www.securityt....com/id/1030181
CVE Reference: CVE-2014-2162, CVE-2014-2163, CVE-2014-2164, CVE-2014-2165, CVE-2014-2166, CVE-2014-2167, CVE-2014-2168, CVE-2014-2169, CVE-2014-2170, CVE-2014-2171, CVE-2014-2172, CVE-2014-2173, CVE-2014-2175
Apr 30 2014
Impact: Denial of service via network, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): TC and TE 4.x, TC 5.x, TC 6.x, TE 6.0, TC 7.x ...
Solution: The vendor has issued a fix (TC 6.3.1, TC 7.1.1).

Cisco TelePresence System MXP Series - multiple vulns
- http://tools.cisco.c...sa-20140430-mxp
2014 April 30 - "Summary: Cisco TelePresence System MXP Series Software contains the following vulnerabilities:
• Three SIP denial of service vulnerabilities
• Three H.225 denial of service vulnerabilities
Successful exploitation of these vulnerabilities may allow an attacker to cause system instability and the affected system to reload... Cisco has released free software updates that address these vulnerabilities. There are no workarounds that mitigate these vulnerabilities...
- http://www.securityt....com/id/1030183
CVE Reference: CVE-2014-2156, CVE-2014-2157, CVE-2014-2158, CVE-2014-2159, CVE-2014-2160, CVE-2014-2161
Apr 30 2014
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): MXP Series prior to F9.3.1 ...
Solution: The vendor has issued a fix (MXP Series Software version F9.3.1)...

OpenSSL Heartbeat Extension vuln - Multiple Cisco Products
- http://tools.cisco.c...0409-heartbleed
Revision 1.17 Last Updated 2014 April 30 - "Updated the Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable sections..."
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

Cisco - OpenSSL Heartbeat Extension vuln
- http://tools.cisco.c...tbleed#affected
Rev 1.19 - 2014 May 6 - "Summary: Multiple Cisco products incorporate a version of the OpenSSL package... The list of affected products will be updated as the investigation continues..."
Rev 1.21 - 2014-May-15 - Updated the Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable sections. Upon further investigation the Cisco Edge 300 Digital Media Player was moved to the Products Confirmed Not Vulnerable section.

- http://www.cisco.com...Heartbleed.html

- http://tools.cisco.c...x?alertId=33695
 

:ph34r: :ph34r:

Edited by AplusWebMaster, 19 May 2014 - 10:42 AM.

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco WebEx Recording Format and Advanced Recording Format Players - multiple vulns
- http://tools.cisco.c...-20140507-webex
2014 May 7 - "Summary: Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to cause an affected player to crash and, in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. The Cisco WebEx Players are applications that are used to play back WebEx meeting recordings that have been recorded on the computer of an online meeting attendee. The players can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. Cisco has updated affected versions of the Cisco WebEx Business Suite meeting sites, Cisco WebEx 11 meeting sites, Cisco WebEx Meetings Server, and Cisco WebEx WRF and ARF Players to address these vulnerabilities..."
- http://www.securityt....com/id/1030206
CVE Reference: CVE-2014-2132, CVE-2014-2133, CVE-2014-2134, CVE-2014-2135, CVE-2014-2136
May 7 2014
Impact: Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
Solution: The vendor has issued a fix:
Cisco WebEx Business Suite (WBS29) client builds T29.2
Cisco WebEx Business Suite (WBS28) client builds T28.12
Cisco WebEx Business Suite (WBS27) client builds T27TLSP32EP16 (27.32.16)
Cisco WebEx 11 version 1.2.10 with client builds T28.12
Cisco WebEx Meetings Server client builds 2.0.0.1677 ...
 

:ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco NX-OS-Based Products - Multiple Vulnerabilities
- http://tools.cisco.c...a-20140521-nxos
2014 May 21 - "Summary: Cisco Nexus, Cisco Unified Computing System (UCS), Cisco MDS 9000 Series Multilayer Switches, and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities:
- Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability
- Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability
- Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
- Cisco NX-OS Message Transfer Service Denial of Service Vulnerability
Cisco has released free software updates that address these vulnerabilities..."
- http://www.securityt....com/id/1030268
CVE Reference: CVE-2013-1191, CVE-2014-2200, CVE-2014-2201, CVE-2014-3261
May 21 2014
Solution: The vendor has issued a fix.
A patch matrix is available in the vendor's advisory...
___

Cisco Wide Area Application Services Remote Code Execution Vulnerability
- http://tools.cisco.c...a-20140521-waas
2014 May 21 - "Summary: A vulnerability in Cisco Wide Area Application Services (WAAS) software versions 5.1.1 through 5.1.1d, when configured with the SharePoint acceleration feature, could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution. The vulnerability is due to incorrect buffer handling for SharePoint responses. An attacker could exploit this vulnerability by convincing a user to access a malicious SharePoint application. An exploit could allow the attacker to crash the application optimization handler and execute arbitrary code with elevated privileges on the WAAS appliance. Cisco has released free software updates that address this vulnerability..."
- http://www.securityt....com/id/1030265
CVE Reference: CVE-2014-2196
May 21 2014
Solution: The vendor has issued a fix (5.1.1e).
___

Cisco AsyncOS Software Administration Role Authorization Vulnerability
- http://tools.cisco.c...e/CVE-2014-2195
2014 May 21 - "Summary: A vulnerability exists in the group processing functions of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) devices that are configured to use Microsoft Active Directory services as the authentication database. This configuration could allow an unauthenticated, remote attacker to bypass security restrictions and be assigned a role that the attacker was not explicitly assigned. The vulnerability is due to incorrect processing of group names retrieved from a Microsoft Active Directory server. An attacker could exploit this vulnerability if the attacker belongs to a group with a name that contains a similar set of characters as the name of an authorized group. An exploit could allow the attacker to access the device or obtain access to a role for which the attacker was not specifically authorized on the device... Customers who wish to upgrade to a software version that includes fixes for these issues should contact their normal support channels. Free software updates will not be provided for issues that are disclosed through a Cisco Security Notice..."
- http://www.securityt....com/id/1030258
CVE Reference: https://web.nvd.nist...d=CVE-2014-2195
May 20 2014
___

Cisco IOS Software IPv6 DoS vuln
- http://tools.cisco.c...a-20110928-ipv6
2011 Sep 28 / Last Updated: 2014 May 20 - "Summary: Cisco IOS Software contains a vulnerability in the IP version 6 (IPv6) protocol stack implementation that could allow an unauthenticated, remote attacker to cause a reload of an affected device that has IPv6 operation enabled. The vulnerability is triggered when an affected device processes a malformed IPv6 packet. Cisco has released free software updates that address this vulnerability. There are no workarounds to mitigate this vulnerability...
Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
- http://www.cisco.com..._ERP_sep11.html
 

:ph34r: :ph34r:

[AplusWebMaster]

FYI...

- http://tools.cisco.c...cationListing.x

Cisco IOS XR Software IPv6 Malformed Packet DoS vuln
- http://tools.cisco.c...a-20140611-ipv6
2014 June 11 - "Summary: A vulnerability in the parsing of malformed Internet Protocol version 6 (IPv6) packets in Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a lockup and eventual reload of a Network Processor (NP) chip and a line card processing traffic. Only Trident-based line cards on Cisco ASR 9000 Series Aggregation Services Routers are affected by this vulnerability. The vulnerability is due to insufficient logic in parsing malformed IPv6 packets. An attacker could exploit this vulnerability by sending a stream of malformed IPv6 packets to the affected device. An exploit could allow the attacker to cause a lockup and eventual reload of an NP chip and a line card, leading to a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. There are no workarounds that address this vulnerability..."
- http://www.securityt....com/id/1030400
CVE Reference: CVE-2014-2176
Jun 11 2014
Impact: Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
Solution:   The vendor has issued a fix:
For 4.2.1: asr9k-p-4.2.1.CSCun71928 and asr9k-px-4.2.1.CSCun71928
For 4.2.3: asr9k-px-4.2.3.CSCun71928 and asr9k-p-4.2.3.CSCun71928
For 4.3.1: asr9k-px-4.3.1.CSCun71928
For 4.3.2: asr9k-px-4.3.2.CSCun71928
For 4.3.4: asr9k-px-4.3.4.CSCuo22306
For 5.1.1: asr9k-px-5.1.1.CSCuo22306 ..."

Cisco Products - OpenSSL vuln multiple products
- http://tools.cisco.c...0140605-openssl
Last Updated  2014 June 11 20:45  UTC (GMT) Rev 1.4 - "Updated the Affected Products, Vulnerable Products, and Products Confirmed Not Vulnerable sections..."
 

:ph34r: :ph34r: